Edit tour

Windows Analysis Report
192-34-56-49-32.exe

Overview

General Information

Sample name:	192-34-56-49-32.exe
Analysis ID:	1486764
MD5:	0ed35085bc066ad51240fe4bf40a53ab
SHA1:	c6fd220b6df65062714890d9d64313b98a109d2b
SHA256:	d275507a8c1af840c4da37391d92e9e144ee5d970b84499eae7f8c2a5c11b98a
Tags:	exeSliver
Infos:

Detection

Sliver

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Sliver Implants

AI detected suspicious sample

Contains functionality to call native functions

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

192-34-56-49-32.exe (PID: 5276 cmdline: "C:\Users\user\Desktop\192-34-56-49-32.exe" MD5: 0ED35085BC066AD51240FE4BF40A53AB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Sliver	According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army.	No Attribution	https://asec.ahnlab.com/en/47088/ https://asec.ahnlab.com/en/55652/ https://asec.ahnlab.com/en/56941/ https://blog.cluster25.duskrise.com/2024/01/30/russian-apt-opposition https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
192-34-56-49-32.exe	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
192-34-56-49-32.exe	INDICATOR_TOOL_Sliver	Detects Sliver implant cross-platform adversary emulation/red team	ditekSHen	0xf0522e:$s1: .commonpb.ResponseR 0xf0529b:$s1: .commonpb.ResponseR 0xf05316:$s1: .commonpb.ResponseR 0xf0542e:$s1: .commonpb.ResponseR 0xf054e2:$s1: .commonpb.ResponseR 0xf05598:$s1: .commonpb.ResponseR 0xf05721:$s1: .commonpb.ResponseR 0xf0587a:$s1: .commonpb.ResponseR 0xf05942:$s1: .commonpb.ResponseR 0xf059f6:$s1: .commonpb.ResponseR 0xf05a90:$s1: .commonpb.ResponseR 0xf05c44:$s1: .commonpb.ResponseR 0xf05d25:$s1: .commonpb.ResponseR 0xf05de3:$s1: .commonpb.ResponseR 0xf05f2e:$s1: .commonpb.ResponseR 0xf05fc8:$s1: .commonpb.ResponseR 0xf06042:$s1: .commonpb.ResponseR 0xf060e4:$s1: .commonpb.ResponseR 0xf061a0:$s1: .commonpb.ResponseR 0xf06289:$s1: .commonpb.ResponseR 0xf06356:$s1: .commonpb.ResponseR

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000000.00000000.2126383731.0000000001018000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: 192-34-56-49-32.exe PID: 5276	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.192-34-56-49-32.exe.140000.0.unpack	INDICATOR_TOOL_Sliver	Detects Sliver implant cross-platform adversary emulation/red team	ditekSHen	0xf0522e:$s1: .commonpb.ResponseR 0xf0529b:$s1: .commonpb.ResponseR 0xf05316:$s1: .commonpb.ResponseR 0xf0542e:$s1: .commonpb.ResponseR 0xf054e2:$s1: .commonpb.ResponseR 0xf05598:$s1: .commonpb.ResponseR 0xf05721:$s1: .commonpb.ResponseR 0xf0587a:$s1: .commonpb.ResponseR 0xf05942:$s1: .commonpb.ResponseR 0xf059f6:$s1: .commonpb.ResponseR 0xf05a90:$s1: .commonpb.ResponseR 0xf05c44:$s1: .commonpb.ResponseR 0xf05d25:$s1: .commonpb.ResponseR 0xf05de3:$s1: .commonpb.ResponseR 0xf05f2e:$s1: .commonpb.ResponseR 0xf05fc8:$s1: .commonpb.ResponseR 0xf06042:$s1: .commonpb.ResponseR 0xf060e4:$s1: .commonpb.ResponseR 0xf061a0:$s1: .commonpb.ResponseR 0xf06289:$s1: .commonpb.ResponseR 0xf06356:$s1: .commonpb.ResponseR
0.0.192-34-56-49-32.exe.140000.0.unpack	INDICATOR_TOOL_Sliver	Detects Sliver implant cross-platform adversary emulation/red team	ditekSHen	0xf0522e:$s1: .commonpb.ResponseR 0xf0529b:$s1: .commonpb.ResponseR 0xf05316:$s1: .commonpb.ResponseR 0xf0542e:$s1: .commonpb.ResponseR 0xf054e2:$s1: .commonpb.ResponseR 0xf05598:$s1: .commonpb.ResponseR 0xf05721:$s1: .commonpb.ResponseR 0xf0587a:$s1: .commonpb.ResponseR 0xf05942:$s1: .commonpb.ResponseR 0xf059f6:$s1: .commonpb.ResponseR 0xf05a90:$s1: .commonpb.ResponseR 0xf05c44:$s1: .commonpb.ResponseR 0xf05d25:$s1: .commonpb.ResponseR 0xf05de3:$s1: .commonpb.ResponseR 0xf05f2e:$s1: .commonpb.ResponseR 0xf05fc8:$s1: .commonpb.ResponseR 0xf06042:$s1: .commonpb.ResponseR 0xf060e4:$s1: .commonpb.ResponseR 0xf061a0:$s1: .commonpb.ResponseR 0xf06289:$s1: .commonpb.ResponseR 0xf06356:$s1: .commonpb.ResponseR

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 192-34-56-49-32.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 192-34-56-49-32.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: 192-34-56-49-32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 192-34-56-49-32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 4x nop then mov ecx, eax		0_2_0016B8D0
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 4x nop then mov ebp, ebx		0_2_0016A630

Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49
Source: unknown	TCP traffic detected without corresponding DNS query: 192.34.56.49

Source: 192-34-56-49-32.exe, 00000000.00000002.3383023469.0000000011D72000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_e7dd985b-4

System Summary

Malicious sample detected (through community Yara rule)

Source: 192-34-56-49-32.exe, type: SAMPLE	Matched rule: Detects Sliver implant cross-platform adversary emulation/red team Author: ditekSHen
Source: 0.2.192-34-56-49-32.exe.140000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Sliver implant cross-platform adversary emulation/red team Author: ditekSHen
Source: 0.0.192-34-56-49-32.exe.140000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Sliver implant cross-platform adversary emulation/red team Author: ditekSHen

Source: C:\Users\user\Desktop\192-34-56-49-32.exe

Code function: 0_2_001A4BB0 NtWaitForSingleObject,

0_2_001A4BB0

Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0016D020	0_2_0016D020
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0015A060	0_2_0015A060
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0014B930	0_2_0014B930
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00148140	0_2_00148140
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0016A960	0_2_0016A960
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0016C1E0	0_2_0016C1E0
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00150A40	0_2_00150A40
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0016E330	0_2_0016E330
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00151B4B	0_2_00151B4B
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0015E360	0_2_0015E360
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00190BC0	0_2_00190BC0
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0018EC20	0_2_0018EC20
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00153530	0_2_00153530
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00152590	0_2_00152590
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00178DE0	0_2_00178DE0
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00167E10	0_2_00167E10
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0016D630	0_2_0016D630
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0016DEA0	0_2_0016DEA0
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_00152700	0_2_00152700
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_001637C0	0_2_001637C0

Source: C:\Users\user\Desktop\192-34-56-49-32.exe

Code function: String function: 0017A2E0 appears 146 times

Source: 192-34-56-49-32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 192-34-56-49-32.exe, type: SAMPLE	Matched rule: INDICATOR_TOOL_Sliver author = ditekSHen, description = Detects Sliver implant cross-platform adversary emulation/red team
Source: 0.2.192-34-56-49-32.exe.140000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_Sliver author = ditekSHen, description = Detects Sliver implant cross-platform adversary emulation/red team
Source: 0.0.192-34-56-49-32.exe.140000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_Sliver author = ditekSHen, description = Detects Sliver implant cross-platform adversary emulation/red team

Source: 192-34-56-49-32.exe

Binary or memory string: cvMm0ZjD.sln8qjaoQh6l8

Source: classification engine

Classification label: mal76.troj.winEXE@1/0@0/1

Source: 192-34-56-49-32.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\192-34-56-49-32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 192-34-56-49-32.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\192-34-56-49-32.exe

File read: C:\Users\user\Desktop\192-34-56-49-32.exe

Jump to behavior

Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Section loaded: mswsock.dll	Jump to behavior

Source: 192-34-56-49-32.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 192-34-56-49-32.exe

Static file information: File size 16050176 > 1048576

Source: 192-34-56-49-32.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x887800
Source: 192-34-56-49-32.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x64f000

Source: 192-34-56-49-32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 192-34-56-49-32.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0015C076 push esp; retf	0_2_0015C077
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0015F940 pushfd ; ret	0_2_0015F941
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0015FAE5 pushfd ; ret	0_2_0015FAE6
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Code function: 0_2_0015A7FF pushfd ; ret	0_2_0015A800

Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\192-34-56-49-32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: 192-34-56-49-32.exe	Binary or memory string: CYwhbHGFSXO.go
Source: 192-34-56-49-32.exe	Binary or memory string: JhgFSQsXXdh.go
Source: 192-34-56-49-32.exe, 00000000.00000002.3382217010.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\192-34-56-49-32.exe

Queries volume information: C:\Users\user\Desktop\192-34-56-49-32.exe VolumeInformation

Jump to behavior

Stealing of Sensitive Information

Yara detected Sliver Implants

Source: Yara match	File source: 192-34-56-49-32.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2126383731.0000000001018000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 192-34-56-49-32.exe PID: 5276, type: MEMORYSTR

Remote Access Functionality

Yara detected Sliver Implants

Source: Yara match	File source: 192-34-56-49-32.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2126383731.0000000001018000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 192-34-56-49-32.exe PID: 5276, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
192-34-56-49-32.exe	42%	ReversingLabs	Win32.Trojan.SliverMarte
192-34-56-49-32.exe	100%	Avira	TR/Patched.Gen

Domains and IPs

Download Network PCAP: filtered – full

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.34.56.49	unknown	United States		14061	DIGITALOCEAN-ASNUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1486764
Start date and time:	2024-08-02 14:55:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	192-34-56-49-32.exe
Detection:	MAL
Classification:	mal76.troj.winEXE@1/0@0/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 192-34-56-49-32.exe, PID 5276 because there are no executed function
VT rate limit hit for: 192-34-56-49-32.exe

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 2, 2024 14:55:58.618232012 CEST	49710	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:55:58.624093056 CEST	80	49710	192.34.56.49	192.168.2.6
Aug 2, 2024 14:55:58.624186039 CEST	49710	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:55:58.625616074 CEST	49710	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:55:58.630510092 CEST	80	49710	192.34.56.49	192.168.2.6
Aug 2, 2024 14:55:59.089433908 CEST	80	49710	192.34.56.49	192.168.2.6
Aug 2, 2024 14:55:59.089658976 CEST	49710	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:55:59.090049028 CEST	80	49710	192.34.56.49	192.168.2.6
Aug 2, 2024 14:55:59.090110064 CEST	49710	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:56:59.094392061 CEST	49720	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:56:59.099570036 CEST	80	49720	192.34.56.49	192.168.2.6
Aug 2, 2024 14:56:59.099720001 CEST	49720	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:56:59.100898981 CEST	49720	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:56:59.105930090 CEST	80	49720	192.34.56.49	192.168.2.6
Aug 2, 2024 14:56:59.584367990 CEST	80	49720	192.34.56.49	192.168.2.6
Aug 2, 2024 14:56:59.584525108 CEST	49720	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:56:59.584660053 CEST	80	49720	192.34.56.49	192.168.2.6
Aug 2, 2024 14:56:59.584716082 CEST	49720	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:57:59.590976954 CEST	49724	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:57:59.595907927 CEST	80	49724	192.34.56.49	192.168.2.6
Aug 2, 2024 14:57:59.596000910 CEST	49724	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:57:59.597011089 CEST	49724	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:57:59.601911068 CEST	80	49724	192.34.56.49	192.168.2.6
Aug 2, 2024 14:58:00.062828064 CEST	80	49724	192.34.56.49	192.168.2.6
Aug 2, 2024 14:58:00.062944889 CEST	80	49724	192.34.56.49	192.168.2.6
Aug 2, 2024 14:58:00.063051939 CEST	49724	80	192.168.2.6	192.34.56.49
Aug 2, 2024 14:58:00.063188076 CEST	49724	80	192.168.2.6	192.34.56.49

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	192.34.56.49	80	5276	C:\Users\user\Desktop\192-34-56-49-32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 14:55:58.625616074 CEST	239	OUT	Data Raw: 16 03 01 00 ea 01 00 00 e6 03 03 f6 0d 8b 45 a2 36 16 87 59 98 ee a1 fc 7d 04 d9 1d 62 67 93 97 bc df 82 3f 3d e5 17 8d 1c 83 78 20 4b 6d 21 0f a4 f4 6c 7b 62 f8 34 54 6a 13 c8 4d b0 92 5d ca 4b c6 2d 0a 46 1d 27 8f 10 43 0e ba 00 26 cc a9 cc a8 Data Ascii: E6Y}bg?=x Km!l{b4TjM]K-F'C&+/,0/5w+3&$ Wux#/fxO
Aug 2, 2024 14:55:59.089433908 CEST	891	IN	HTTP/1.1 400 Bad Request content-type: text/html cache-control: private, no-cache, max-age=0 pragma: no-cache content-length: 679 date: Fri, 02 Aug 2024 12:55:58 GMT server: LiteSpeed connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49720	192.34.56.49	80	5276	C:\Users\user\Desktop\192-34-56-49-32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 14:56:59.100898981 CEST	239	OUT	Data Raw: 16 03 01 00 ea 01 00 00 e6 03 03 c6 3f 53 17 ae 71 69 78 a5 d3 ed 2c 1a e4 28 1e 29 ce 7c e6 84 a8 f7 77 25 cb bf ae 70 39 4d 25 20 57 7c 80 0f ab 07 38 f5 af 29 73 e3 91 e3 1d aa f0 9d 50 18 7d 25 1c f7 36 6e e3 ac f1 0c 2e ff 00 26 cc a9 cc a8 Data Ascii: ?Sqix,()\|w%p9M% W\|8)sP}%6n.&+/,0/5w+3&$ s[JMbDpP<Iy
Aug 2, 2024 14:56:59.584367990 CEST	891	IN	HTTP/1.1 400 Bad Request content-type: text/html cache-control: private, no-cache, max-age=0 pragma: no-cache content-length: 679 date: Fri, 02 Aug 2024 12:56:59 GMT server: LiteSpeed connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49724	192.34.56.49	80	5276	C:\Users\user\Desktop\192-34-56-49-32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 2, 2024 14:57:59.597011089 CEST	239	OUT	Data Raw: 16 03 01 00 ea 01 00 00 e6 03 03 a2 4a e8 82 e8 27 37 c7 f1 1d 75 22 39 f7 f2 a8 49 09 78 84 e7 94 e6 56 9e 76 20 97 7a f5 00 2c 20 4f 2d f5 de 67 6d 37 d6 03 07 be 78 14 8e 08 5f a3 1f ef a9 21 4b 25 19 5e 7a 3d 78 8c bf d3 1d 00 26 cc a9 cc a8 Data Ascii: J'7u"9IxVv z, O-gm7x_!K%^z=x&+/,0/5w+3&$ 0`i}l(hF0W&<
Aug 2, 2024 14:58:00.062828064 CEST	891	IN	HTTP/1.1 400 Bad Request content-type: text/html cache-control: private, no-cache, max-age=0 pragma: no-cache content-length: 679 date: Fri, 02 Aug 2024 12:57:59 GMT server: LiteSpeed connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Statistics

CPU Usage

• 192-34-56-49-32.exe

Click to jump to process

Memory Usage

• 192-34-56-49-32.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Target ID:	0
Start time:	08:55:57
Start date:	02/08/2024
Path:	C:\Users\user\Desktop\192-34-56-49-32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\192-34-56-49-32.exe"
Imagebase:	0x140000
File size:	16'050'176 bytes
MD5 hash:	0ED35085BC066AD51240FE4BF40A53AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000000.00000000.2126383731.0000000001018000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0016A960 Relevance: 6.9, Strings: 5, Instructions: 655COMMON

Download Yara Rule

Strings

] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpacke, xrefs: 0016AC61
, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNO, xrefs: 0016B176
, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobberfreecreated by float32nan2float64nan1float64nan2float64nan3gccheckmarkmSpanManualminTrigger=netpollInitreflectOffsruntime: P runtime: g runtime, xrefs: 0016B149
] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar, xrefs: 0016B08D
][]_, xrefs: 0016AC36, 0016B062

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: , j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNO$, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobberfreecreated by float32nan2float64nan1float64nan2float64nan3gccheckmarkmSpanManualminTrigger=netpollInitreflectOffsruntime: P runtime: g runtime$] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpacke$] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar$][]_
API String ID: 0-864190955
Opcode ID: b4e57eba99545ebd481439f4acd0b9919f2369bfd48b3a4f319ad3927a598018
Instruction ID: 296347a46a7c2e3f12c2b04c8d7a8a1301ab101e6bf0216b94bb3aedb1f4fddf
Opcode Fuzzy Hash: b4e57eba99545ebd481439f4acd0b9919f2369bfd48b3a4f319ad3927a598018
Instruction Fuzzy Hash: B35204756093148FD324EF68C88076EBBF5BF88300F55892DE99987342DB75A849CB83

Function 00152700 Relevance: 3.3, Strings: 2, Instructions: 802COMMON

Download Yara Rule

Strings

heapBitsSetType: called with non-pointer typeproduced a trigger greater than the heap goalruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state , xrefs: 00153038
-, xrefs: 00153041

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: -$heapBitsSetType: called with non-pointer typeproduced a trigger greater than the heap goalruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state
API String ID: 0-1059721617
Opcode ID: d54d256c6ed65343d4fc01e3612c51729fdbaf64ada779e6fdb6a8b669a01f71
Instruction ID: 06692e19bb4e0ec0d9f951bd77b98a0b60ddf59ce50039bf5cfb333477a7085e
Opcode Fuzzy Hash: d54d256c6ed65343d4fc01e3612c51729fdbaf64ada779e6fdb6a8b669a01f71
Instruction Fuzzy Hash: 72628172A08355CFD725CF69C48065EF7E1BBCA301F15892EE8A98B341D7709D09CB92

Function 0018EC20 Relevance: 3.0, Strings: 2, Instructions: 454COMMON

Download Yara Rule

Strings

(targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQ, xrefs: 0018EFF9, 0018F1D8
and got= max= ms, ptr tab= top=, fp:] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(, xrefs: 0018EFA4, 0018F183

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQ$ and got= max= ms, ptr tab= top=, fp:] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(
API String ID: 0-2542637968
Opcode ID: 16858732397cf34a56aa67b5cc51df14c820b64093cd41d8432942a50e688b3a
Instruction ID: cc6cfa2823a78b71cd9317d3c6f6b4f203148e5ad27a8de231bf4c728617a889
Opcode Fuzzy Hash: 16858732397cf34a56aa67b5cc51df14c820b64093cd41d8432942a50e688b3a
Instruction Fuzzy Hash: 3812DCB46097018FC704EF68C58465EBBF1BF88700F51892DE89987352EB74E989DF82

Function 00167E10 Relevance: 1.9, Strings: 1, Instructions: 606COMMON

Download Yara Rule

Strings

+, xrefs: 001686D1

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 80a97670a6fb6ecbd7ac0c19286519ebf9834ad4d18576a38746598e84b8f02d
Instruction ID: 7101d7e387e4c7d6d06da7810b3edafa5ac473a85a2387864c2c39d12e3262de
Opcode Fuzzy Hash: 80a97670a6fb6ecbd7ac0c19286519ebf9834ad4d18576a38746598e84b8f02d
Instruction Fuzzy Hash: BB42F3746093418FC368DF28C490B6EBBE1BF89704F55892DE8D98B352DB35D845CB92

Function 001637C0 Relevance: 1.8, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

!, xrefs: 00163E08

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 84b85a91776f8847d922f3eee8e53fd44723527e952046c6609763b27cb2e6e5
Instruction ID: 9886be105869937a716df235a86d8be8a079c9eb790d231327dafdfef5dfaaca
Opcode Fuzzy Hash: 84b85a91776f8847d922f3eee8e53fd44723527e952046c6609763b27cb2e6e5
Instruction Fuzzy Hash: F802D23560971A8FC315DE99C8C065EB7E2FBC4304F55893CE8A58B381EB71E919CB82

Function 00178DE0 Relevance: 1.6, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

', xrefs: 00179283

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 6bf015ef8be9322230dbeb1e063c378af662a7523f8eaa2630e192d68ac55fd5
Instruction ID: db9f7167f7796e467ecfed2292d171953b4389e735c8e885901a497a248f93b5
Opcode Fuzzy Hash: 6bf015ef8be9322230dbeb1e063c378af662a7523f8eaa2630e192d68ac55fd5
Instruction Fuzzy Hash: 5AD12F7420C3419FC308DF25C094A2ABBF2AF89754F55886CF8C99B392DB35E948DB42

Function 0016A630 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

@, xrefs: 0016A7A1

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 389a71abeaaf638bc8ee7f5ee15333f4eb728687b28dc0cc9f40fd430849ddca
Instruction ID: ba8db0453c9b916387c03599848aa24038269dccc8b1d270b368b0fe09c2038f
Opcode Fuzzy Hash: 389a71abeaaf638bc8ee7f5ee15333f4eb728687b28dc0cc9f40fd430849ddca
Instruction Fuzzy Hash: DA81D0B4A093459FC308DF18C490A2ABBE1BF89304F509A2DF99997352D734E955CF86

Function 0016B8D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

@, xrefs: 0016BAA9

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: bca2891e3ac8eec9ec6073d75a732ab16f785351b86e65a602e2d9b3ba4a9c41
Instruction ID: 03fc6bc74ddb9dd11283d5c1812e81e9e9f692d6060cb4866cba3cc8b6c3f28a
Opcode Fuzzy Hash: bca2891e3ac8eec9ec6073d75a732ab16f785351b86e65a602e2d9b3ba4a9c41
Instruction Fuzzy Hash: DA618CB5A083458FC305DF28C8C066ABBE0FF89340F41896DE999C7342E731D995CB82

Function 0016D630 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fba7a1bb74ef9ecc2155505425725d81a6fc7c227265f78871af2f8b6fe039
Instruction ID: d007ed966fc2a2675a73294a3f669c441cb734a5ab259ef27ed7998e02af8fa5
Opcode Fuzzy Hash: 87fba7a1bb74ef9ecc2155505425725d81a6fc7c227265f78871af2f8b6fe039
Instruction Fuzzy Hash: 3522D433B093294FC3159E999CC021AF7E2ABC8704F1A853DD9949B385EBB5AC19C7C5

Function 0016D020 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6554b44b1b6b01961b53db931adeab2b1aaebd5f87c39f1ffc708df59fd7052b
Instruction ID: 6b49424bba8dd6530ca9d6dbb69d9ea7ea73a60b255604ceb451602b2691eab8
Opcode Fuzzy Hash: 6554b44b1b6b01961b53db931adeab2b1aaebd5f87c39f1ffc708df59fd7052b
Instruction Fuzzy Hash: DA02D573F147244BD3148E5DCC80249B2D2ABC8634F4EC72DEDA9A7341DA74AD558BC6

Function 0015A060 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e25c6d279c37c9543c5891ad5c0c1185267587fce28e49fc48400f3f1a43efd
Instruction ID: 03f2ba350a0cdda03054b318f3249b20ee15b07a82307c435829adbc9acdef01
Opcode Fuzzy Hash: 3e25c6d279c37c9543c5891ad5c0c1185267587fce28e49fc48400f3f1a43efd
Instruction Fuzzy Hash: 4DE18F32A483158FC715DE5DC88074EFBE2AFC4344F598A3DE9948B355E7B5AC098B82

Function 0016DEA0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de97cfd140f4e646d14656085b8749f13820e187d97d20adc0ba79f2fb71bbac
Instruction ID: b91eb0e4c2bee1de2689248b0bcd41ef37c0be292040ce050570f0ee9abc18e3
Opcode Fuzzy Hash: de97cfd140f4e646d14656085b8749f13820e187d97d20adc0ba79f2fb71bbac
Instruction Fuzzy Hash: D2D1D2366093198FC315DE99C8C051EF7E3BBC9340F59863CE5944B385EB71A919CB86

Function 0016E330 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90c179dd5c65e3b61b503a112d243e0bef96ddfece3e6b3449257ce93951d8d
Instruction ID: bb35413883933a8919ecbb2087fe3069e77bb361c3aaeafc0a20122b97a82eaf
Opcode Fuzzy Hash: c90c179dd5c65e3b61b503a112d243e0bef96ddfece3e6b3449257ce93951d8d
Instruction Fuzzy Hash: DBB1383A7493264FC319DE998CD062EB6D3ABC8340F59823CE9658B3C5FB719C1986C1

Function 0016C1E0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f77d44c7d6418bab4298c02eb5e14b6c2ede4550d35b91c1be24ec96468a92
Instruction ID: 8f8bad2464a07d7e5f7ffdc4eb72a0d0bab49afa25f91f47c26bba1b4ddb5242
Opcode Fuzzy Hash: c0f77d44c7d6418bab4298c02eb5e14b6c2ede4550d35b91c1be24ec96468a92
Instruction Fuzzy Hash: A0B1E673A197244BC314CE59CCC060AF7E2BBC8610F4A862DEDA85B345EA71DD19CBC6

Function 00151B4B Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2b11d60776eb98c63dcce696301442a4cb1a78802dde9157ef96e14754b9d1
Instruction ID: 309695542be29cba5060bc568d5202b4c3972b46347cff6a59e482ff583b9654
Opcode Fuzzy Hash: 7b2b11d60776eb98c63dcce696301442a4cb1a78802dde9157ef96e14754b9d1
Instruction Fuzzy Hash: 23C12475A08345DFC319DF69C08061AFBF2BB89300F55896DEDA98B311E770E949CB82

Function 00150A40 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd58fe5d86d242d90a27a37d7476bf748a96f8fd73f2d797bd88b3b7d92d4b89
Instruction ID: ba28a49e6fed5c99ca5c9f81dc5a5f83eb24ade2a89a4c70826d97f05559cd29
Opcode Fuzzy Hash: dd58fe5d86d242d90a27a37d7476bf748a96f8fd73f2d797bd88b3b7d92d4b89
Instruction Fuzzy Hash: 00A18974608345CBC759CF98C0C062ABBE1BF89305F6989ADECA94F342D735AD49CB52

Function 00153530 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67856bbe18a4b47215ab4f21d0009ecce2ab93076ef74ae6b358dc588fb87433
Instruction ID: 9929fa8e5d6e64c24e0fff7f11a24dd0787499713b568934e7ec4a32dc97824c
Opcode Fuzzy Hash: 67856bbe18a4b47215ab4f21d0009ecce2ab93076ef74ae6b358dc588fb87433
Instruction Fuzzy Hash: ED81D976A48745CFC325CE29C88062AF7D2BBD8351F25866DD9B58B381EB30DA09DB41

Function 0015E360 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1890117c0a33d503e9899a9e16013c18bdd4f224567abd51f06dc5ab4ac7d95f
Instruction ID: efcd18d53b6453f924d9b5f8031aa1a3ccfb25d773dce6b6709d3d37470e755d
Opcode Fuzzy Hash: 1890117c0a33d503e9899a9e16013c18bdd4f224567abd51f06dc5ab4ac7d95f
Instruction Fuzzy Hash: 3D9107B4A18344CFC318DF58C480A2AFBE2BFC8315F55892DE9A94B351E775E945CB42

Function 0014B930 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b984673f65718e36cc4d0c9c3cc90082dd74ab3cc5b968f0cf27b3d7ca23ddac
Instruction ID: 7636fe66f849d265a951fafb1c031e522458cbb4fc926a3ae9b646d0d861f03f
Opcode Fuzzy Hash: b984673f65718e36cc4d0c9c3cc90082dd74ab3cc5b968f0cf27b3d7ca23ddac
Instruction Fuzzy Hash: FA419071918B448BC306DF78C49131AB7E1BFD6384F54872DF95AAB292EB35D882C741

Function 00152590 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ebf50410bb5509e4a7c95da251b1df140f672b52b793367d6471bab7db5f1a
Instruction ID: 320f5fe93eebc30d0fa6b6fc32ba5d0407a965cdbb9b7e896f4633271b4b8e82
Opcode Fuzzy Hash: 72ebf50410bb5509e4a7c95da251b1df140f672b52b793367d6471bab7db5f1a
Instruction Fuzzy Hash: C0412173C187298BC300AE4D8840149F7E5ABD4620F5FCA5EDDA857311E7B1AD15CBC6

Function 00148140 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c41e08194fe6a420ee19f7990692117a68eb01c77f356eb503bfdf941803b3
Instruction ID: 760304b94089fd6cb85e976f8e4d05761e2f69be3f5c80d92c57da4770c224ab
Opcode Fuzzy Hash: e4c41e08194fe6a420ee19f7990692117a68eb01c77f356eb503bfdf941803b3
Instruction Fuzzy Hash: A321C2317042458FC71CCE2DC89112EF7E2ABC9710F6A853ED5968B6A1EB35A807CB55

Function 00190BC0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50f0fb469b57228ed505e2df45f54804206c1e4c5a8b3cb3fd68a834ecdc0bd
Instruction ID: 93c2b88cf87cb999b7a60de22920f38673b97dc2f289f1b5849c470d50122797
Opcode Fuzzy Hash: e50f0fb469b57228ed505e2df45f54804206c1e4c5a8b3cb3fd68a834ecdc0bd
Instruction Fuzzy Hash: 68012C75A002108FD75CDF58C5D5B6673D1B788700F4585BEDE0E8BB97D6755812C780

Function 001A4BB0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c94f9028032a485ce5d55206892e50e561f6cc8a2dd00ac380df4fdc33c92e7
Instruction ID: b3dcba1b0c3b670b98637f3da9b474117d21d9d21b942cda33bc5bf7dd5e593a
Opcode Fuzzy Hash: 7c94f9028032a485ce5d55206892e50e561f6cc8a2dd00ac380df4fdc33c92e7
Instruction Fuzzy Hash: E8E0B6B44183419BC310EF0CC48150ABBE0BB84320F808B5DA8B8473D1D33595488B92

Function 0015FCD0 Relevance: 7.9, Strings: 6, Instructions: 428COMMON

Download Yara Rule

Strings

pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags ei, xrefs: 001600C1
B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 00160342
B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLea, xrefs: 001602B5
% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal , xrefs: 00160101
B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittrac, xrefs: 00160265
exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall, xrefs: 0016012B

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$ B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLea$ B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittrac$ exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall$% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal $pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags ei
API String ID: 0-2637309102
Opcode ID: 7525a63e3ddc508f63091fd2a27b2ab2eed0fefe0337684c174cb4be5a520076
Instruction ID: b1ccf7d1d6d4d58f2b9c8d782c8b6d18fa2c460c362998aa4d54dd395d979f46
Opcode Fuzzy Hash: 7525a63e3ddc508f63091fd2a27b2ab2eed0fefe0337684c174cb4be5a520076
Instruction Fuzzy Hash: 5322C0745097448FC365EF28C580A6EBBF5BF99740F458A2DE9CD87352EB309885CB42

Function 001596B0 Relevance: 7.8, Strings: 6, Instructions: 296COMMON

Download Yara Rule

Strings

work.full != 0x, xrefs: 001599EE
wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpan, xrefs: 00159908
jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 00159A99
8, xrefs: 00159B9A
runtime: P runtime: g runtime: p scheddetailtracealloc(unreachable B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit=, xrefs: 00159897
nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobberfreecreated by float32nan2float64nan1float64nan2float64nan3gccheck, xrefs: 00159AEE

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$ nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobberfreecreated by float32nan2float64nan1float64nan2float64nan3gccheck$ wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpan$8$runtime: P runtime: g runtime: p scheddetailtracealloc(unreachable B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit=$work.full != 0x
API String ID: 0-3941335326
Opcode ID: 7d041aa8792431104ac1bb1276ae4d924578b80561f37f0dbd5a890d4f265124
Instruction ID: e6f07760725b3f816122b89721406a1849bb36a5adfa3ade80f13849643e2d76
Opcode Fuzzy Hash: 7d041aa8792431104ac1bb1276ae4d924578b80561f37f0dbd5a890d4f265124
Instruction Fuzzy Hash: A4D1F5B450A301CFC714EF68D58566EBBF1BF98304F44882DE8898B346EB399849DB53

Function 0015EB40 Relevance: 7.7, Strings: 6, Instructions: 236COMMON

Download Yara Rule

Strings

s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine invalidptrmSpanInUsenotifyListprofInsertruntime: g, xrefs: 0015EC00
unknown( (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0, xrefs: 0015ED2A
s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrw, xrefs: 0015EC2A
... MB, and got= max= ms, ptr tab= top=, fp:] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= sp, xrefs: 0015EE0D, 0015EF18
*( - < > m= n=%: ...???FPEHUPILLINTNaNPC=\\?]:adxaesavxendfinfmagc gp in nilobjpc= <== at fp= is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidle, xrefs: 0015EE3E
s=nil text= zombie% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st, xrefs: 0015EDB9

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: *( - < > m= n=%: ...???FPEHUPILLINTNaNPC=\\?]:adxaesavxendfinfmagc gp in nilobjpc= <== at fp= is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidle$ ... MB, and got= max= ms, ptr tab= top=, fp:] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= sp$ s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine invalidptrmSpanInUsenotifyListprofInsertruntime: g$ s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrw$ s=nil text= zombie% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st$unknown( (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0
API String ID: 0-2074865883
Opcode ID: fd4a7fa4c380f6e8d5dcc2dc191f584c224d86eb77899e0c0045b472416b8c33
Instruction ID: f568f7a807cc0bf628fef667bdfdec587b42d72ab355b69ef32e65c7eae29881
Opcode Fuzzy Hash: fd4a7fa4c380f6e8d5dcc2dc191f584c224d86eb77899e0c0045b472416b8c33
Instruction Fuzzy Hash: B3B1C2B45093409FC304EFA4C585A5EBBF4AF98344F41882DF89A8B352EB35D989CB53

Function 00165D10 Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobberfreecreated by float32nan2float64nan1float64nan2float64nan3gccheckmarkmSpanManualminTrigger=netpollInitreflectOffsruntime: P runtime, xrefs: 00165D67
freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobber, xrefs: 00165D91
marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqd, xrefs: 00165ED1
alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 00165E7F
zombie% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[, xrefs: 00165F37
., xrefs: 00165DC4

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$ freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobber$ marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqd$ zombie% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[$, elemsize=, npages = : frame.sp=EnumOptionsFileOptionsGOMEMLIMIT=GOTRACEBACKassistQueuebad m valuebad timedivcgocall nilclobberfreecreated by float32nan2float64nan1float64nan2float64nan3gccheckmarkmSpanManualminTrigger=netpollInitreflectOffsruntime: P runtime$.
API String ID: 0-3024913244
Opcode ID: b8eb75fefbb3442d1d27db0050b89533b029296b429a85a21978d7dcd43f9dbb
Instruction ID: 128dd1f6e2f1b9cd2243d28850407ef2ec644189749f3f8e585ecea13c57a9ec
Opcode Fuzzy Hash: b8eb75fefbb3442d1d27db0050b89533b029296b429a85a21978d7dcd43f9dbb
Instruction Fuzzy Hash: 2B71017000D7508EC344EF64C48566EBBF1AF99344F44896EF8CA87292DB79C989DB63

Function 0019BB30 Relevance: 7.7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

Strings

types value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax e, xrefs: 0019BCA8
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 0019BC2F
runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangeslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingtimer period must be non-negativeunaligned 64-bit atomic opera, xrefs: 0019BDC4
runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x, xrefs: 0019BD18
- < > m= n=%: ...???FPEHUPILLINTNaNPC=\\?]:adxaesavxendfinfmagc gp in nilobjpc= <== at fp= is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleita, xrefs: 0019BD90
!, xrefs: 0019BDCD

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: types value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax e$ - < > m= n=%: ...???FPEHUPILLINTNaNPC=\\?]:adxaesavxendfinfmagc gp in nilobjpc= <== at fp= is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleita$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$!$runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x$runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangeslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingtimer period must be non-negativeunaligned 64-bit atomic opera
API String ID: 0-971845996
Opcode ID: 5e5712d3ff2343581008b7bb5eecc5b8cea777f6277ef77a3518b99373030b21
Instruction ID: bb387778ac0be6f38dc0c0fb71635fba3bee5e4189f5ecb0692454755c097d37
Opcode Fuzzy Hash: 5e5712d3ff2343581008b7bb5eecc5b8cea777f6277ef77a3518b99373030b21
Instruction Fuzzy Hash: 6F610CB450D3048FC704EFA4D58566EBBF4BF98704F80882DE48987342EB789989DB93

Function 00173030 Relevance: 7.6, Strings: 6, Instructions: 60COMMON

Download Yara Rule

Strings

', xrefs: 001730B2
erRegisterSuspendResumeNotification, xrefs: 00173094
powr, xrefs: 00173060
Powe, xrefs: 001730A2
owrprof.dll, xrefs: 00173055
', xrefs: 001730AA

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: '$'$Powe$erRegisterSuspendResumeNotification$owrprof.dll$powr
API String ID: 0-2222458068
Opcode ID: 349c3fc9027871d138f34df6d980a0b39c8c074ef39c530edc63c9480aeec687
Instruction ID: e130964c48010208bea3a9452ea31e7b722076aaf324039af4a0c819ce46d87f
Opcode Fuzzy Hash: 349c3fc9027871d138f34df6d980a0b39c8c074ef39c530edc63c9480aeec687
Instruction Fuzzy Hash: 6421DFB44083459FD710EF64C58175ABBF0BB99708F80882EE49897251E775EA8ACF93

Function 00192150 Relevance: 6.6, Strings: 5, Instructions: 352COMMON

Download Yara Rule

Strings

targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine invalidptrmSpanInUsenotifyListprofInsertruntime: gs.state = schedtracesemacquirestackLargeticks.lock, xrefs: 00192484
tab= top=, fp:] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED ef, xrefs: 001924AE
pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar, xrefs: 0019245A
$, xrefs: 00192439
value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp , xrefs: 00192583

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp $ pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar$ tab= top=, fp:] = (deferfalsefaultgFreegcinggscanhchaninit mheappanicscav schedsleepsse41sse42ssse3sudogsweeptraceusage B -> addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED ef$ targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine invalidptrmSpanInUsenotifyListprofInsertruntime: gs.state = schedtracesemacquirestackLargeticks.lock$$
API String ID: 0-2676210223
Opcode ID: f9704f39f7ebc945ed7c6bf08612701698011927c80e33bd92f110e665797dda
Instruction ID: f9e3c63dd9b21d0fdf0994b7b42282c51651d4b44057594b011c3c394dedd59f
Opcode Fuzzy Hash: f9704f39f7ebc945ed7c6bf08612701698011927c80e33bd92f110e665797dda
Instruction Fuzzy Hash: 0FF1CBB4A097409FC714EF68C480A1ABBF1BF98740F418A2DF99987352E774E845CF42

Function 001610E0 Relevance: 6.6, Strings: 5, Instructions: 327COMMON

Download Yara Rule

Strings

trigger=unknown( (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackc, xrefs: 001613CD
minTrigger=netpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailtracealloc(unreachable B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s., xrefs: 00161430
heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine , xrefs: 001613F7
-, xrefs: 00161497
produced a trigger greater than the heap goalruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another, xrefs: 0016148E

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine $-$minTrigger=netpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailtracealloc(unreachable B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.$produced a trigger greater than the heap goalruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another$trigger=unknown( (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=(unknown), newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackc
API String ID: 0-3229666886
Opcode ID: 65e4943bea1ad727ebdc7e91916ecd1f834896b1bfde2505e3a3388751dad4f9
Instruction ID: 280be6b1cf80ac8859305f35d6923ef6ebb15ef3357922320ada1da271e0d4ad
Opcode Fuzzy Hash: 65e4943bea1ad727ebdc7e91916ecd1f834896b1bfde2505e3a3388751dad4f9
Instruction Fuzzy Hash: 5DB15F726493219FC755DFA8C9C090EB7E2BBC8744F49893DE898D7391EB719C05CA82

Function 00145FF0 Relevance: 6.4, Strings: 5, Instructions: 198COMMON

Download Yara Rule

Strings

is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar, xrefs: 001460CF
interfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen swee, xrefs: 00146022
is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runn, xrefs: 00146283
, not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 001460E9
, xrefs: 001461F8

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: $ is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar$ is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runn$, not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$interfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen swee
API String ID: 0-2582584216
Opcode ID: b6e9bb4dc4c94766b4b2b1b3e6f649dc5d505930715cf1d9821a64f18ef2c866
Instruction ID: b598afae3096b542ef94761650033d7ade4d3e2de336215becab243bfc73a141
Opcode Fuzzy Hash: b6e9bb4dc4c94766b4b2b1b3e6f649dc5d505930715cf1d9821a64f18ef2c866
Instruction Fuzzy Hash: 8DA189B46083409FD318DF19D180A5ABBF1BBC8704F50892EF9D987361EB79A949CF52

Function 0019BDF0 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

types value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax e, xrefs: 0019BFA9
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 0019BF34
- < > m= n=%: ...???FPEHUPILLINTNaNPC=\\?]:adxaesavxendfinfmagc gp in nilobjpc= <== at fp= is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleita, xrefs: 0019C091
!, xrefs: 0019C0CE
runtime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to pallocChunkBytestried to park scavenger from a, xrefs: 0019C019

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: types value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax e$ - < > m= n=%: ...???FPEHUPILLINTNaNPC=\\?]:adxaesavxendfinfmagc gp in nilobjpc= <== at fp= is lr: of pc= sp: sp=) = ) m=+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleita$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$!$runtime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to pallocChunkBytestried to park scavenger from a
API String ID: 0-1774509432
Opcode ID: a8ed0d960f44b1e28e5d18e913fcf9ccf167cf5d22daaf427ef25bb033c6f6a3
Instruction ID: ba7fdcc9069e75cb5ac89427653075ac0ccc4692a053e228d16bb0ee7067c544
Opcode Fuzzy Hash: a8ed0d960f44b1e28e5d18e913fcf9ccf167cf5d22daaf427ef25bb033c6f6a3
Instruction Fuzzy Hash: DF81FEB45093059FC704EF64D585AAEBBF4BF98704F80882DF48887352EB749889DB93

Function 00179CC0 Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

e+, xrefs: 00179E5E
+Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar, xrefs: 00179D30
-, xrefs: 00179E69
-, xrefs: 00179D9A
., xrefs: 00179E59

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: +Inf-Inf0000: p=ABRTALRMGOGCKILLLEAFPIPEQUITSEGVTERMm=] = ] n=allgallpavx2basebmi1bmi2cas1cas2cas3cas4cas5cas6deadermsidleitabrootsbrksse3tar$-$-$.$e+
API String ID: 0-113836843
Opcode ID: 07e27a6aaf610968e5a7366492f71b1fd16c553882b1b6b022ff1e374e13cea5
Instruction ID: 9ea4019b4dae7351fa7ded2adb6bcf31f365e339434e90f2f86cebb3af4fac7a
Opcode Fuzzy Hash: 07e27a6aaf610968e5a7366492f71b1fd16c553882b1b6b022ff1e374e13cea5
Instruction Fuzzy Hash: CF512B7140DB408EC71BEF38C06536AB7B5BFA2380F44CB5EE88F66192EB75855D8252

Function 00165446 Relevance: 5.5, Strings: 4, Instructions: 476COMMON

Download Yara Rule

Strings

sweepgen= targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine invalidptrmSpanInUsenotifyListprofInsertruntime: gs.state = schedtracesemacquirestackLarge, xrefs: 0016590C
mspan.sweep: bad span state after sweepout of memory allocating heap arena mapruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetraceback: unexpected SPWR, xrefs: 0016596A
nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runnableruntime.rwmutexRrwmutexWscavengetrac, xrefs: 001659C4
, xrefs: 00165A60

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: $ nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runnableruntime.rwmutexRrwmutexWscavengetrac$ sweepgen= targetpc= throwing= until pc=, bound = , limit = Bad varintException GC forcedGOMAXPROCSGOMEMLIMITatomicand8debug callexitThreadfloat32nanfloat64nangoroutine invalidptrmSpanInUsenotifyListprofInsertruntime: gs.state = schedtracesemacquirestackLarge$mspan.sweep: bad span state after sweepout of memory allocating heap arena mapruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetraceback: unexpected SPWR
API String ID: 0-3663273245
Opcode ID: 1c14cd926f70005995a75788e3934370d5c003e7fb68adf2da40f62007d24f2b
Instruction ID: 140cd641a259682d244e9ee3ae1020883c26494551334721c0c365b5ef55b67c
Opcode Fuzzy Hash: 1c14cd926f70005995a75788e3934370d5c003e7fb68adf2da40f62007d24f2b
Instruction Fuzzy Hash: 862277B05097508FC310EF64C490A6EBBF1BF98704F45896DE8C88B392E735D999DB92

Function 00147B80 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

., xrefs: 00147CC3
pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runnableruntime.rwmutexRrwmutexWscavengetraceBuftrigger=unknown( (fo, xrefs: 00147DC7
panicwrap: unexpected string after type name: released less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base poin, xrefs: 00147CB9
panicwrap: unexpected string after package name: runtime.reflect_makemap: unsupported map key typeruntime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left ou, xrefs: 00147C0D

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runnableruntime.rwmutexRrwmutexWscavengetraceBuftrigger=unknown( (fo$.$panicwrap: unexpected string after package name: runtime.reflect_makemap: unsupported map key typeruntime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left ou$panicwrap: unexpected string after type name: released less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base poin
API String ID: 0-3380606691
Opcode ID: 1be52886e18083dee1c9098e61548a7f952a6d1b7145938bed70e547470a0ee8
Instruction ID: 268af0375960e5d57069484a9aefeabc4fb2d0c4385038780c59aa51a78dd783
Opcode Fuzzy Hash: 1be52886e18083dee1c9098e61548a7f952a6d1b7145938bed70e547470a0ee8
Instruction Fuzzy Hash: 9291AEB49083419FC328EF28D59465EBBE1BF98300F108D2EE9D9973A1DB749949CF52

Function 0019AD70 Relevance: 5.2, Strings: 4, Instructions: 174COMMON

Download Yara Rule

Strings

[', xrefs: 0019AECF
goroutine invalidptrmSpanInUsenotifyListprofInsertruntime: gs.state = schedtracesemacquirestackLargeticks.locktime.Date(time.Localtracefree(tracegc()unknown pc of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status , xrefs: 0019AEA5
(scan) MB in allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mco, xrefs: 0019AF0E
minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runnableruntime.rwmutexRrwmutexWscav, xrefs: 0019AF7C

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: (scan) MB in allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = : type GODEBUGIO waitUNKNOWNtypes value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mco$ ['$ minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax ebp ebx ecx edi edx eflags eip esi esp fs gs pollDescreflect.runnableruntime.rwmutexRrwmutexWscav$goroutine invalidptrmSpanInUsenotifyListprofInsertruntime: gs.state = schedtracesemacquirestackLargeticks.locktime.Date(time.Localtracefree(tracegc()unknown pc of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status
API String ID: 0-1288868605
Opcode ID: 9122a450c7a18febd9698b2d5c97e641b63f4e93e408eb29fd2b79a03038fa48
Instruction ID: 647c2c9851f1abdbcfe4b3815777336de70fad88fbe64b49018955ccf3e4fde9
Opcode Fuzzy Hash: 9122a450c7a18febd9698b2d5c97e641b63f4e93e408eb29fd2b79a03038fa48
Instruction Fuzzy Hash: A47127745493559FC700EF68C485A5EBBF0BF98744F81892CE88987352E734E98ACB93

Function 0016F480 Relevance: 5.1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

Strings

, xrefs: 0016F502
, xrefs: 0016F53F
, xrefs: 0016F57F
, xrefs: 0016F547

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: $ $ $
API String ID: 0-3535155489
Opcode ID: 17601f4e8ab25f85d8ff904fa5ba388fcc1d1b2c54e9d27e2387ccc53709f0fb
Instruction ID: c0a9fb60a4b05e66611f2dec597448da63450cdc95c1ec02b5ff8639e43860f3
Opcode Fuzzy Hash: 17601f4e8ab25f85d8ff904fa5ba388fcc1d1b2c54e9d27e2387ccc53709f0fb
Instruction Fuzzy Hash: AC611174509741CFD324DF24C484B5AFBE1BFC8314F158A2EE4999B3A1DB34A845CB92

Function 0019C0F0 Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

types value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax e, xrefs: 0019C26A
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar, xrefs: 0019C1DD
., xrefs: 0019C2E3
runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to , xrefs: 0019C2DA

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: types value=cpuprofforcegcgctracehead = minpc= pacer: panic: runningsyscallunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 00000000[signal stack=[_UNKNOWNcgocheckcs deadlockeax e$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not SCHED efenceobjectpackedpopcntrdtscpselectsweep sysmontimersustar ustar$.$runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to
API String ID: 0-2122804386
Opcode ID: 0129d8094a1ff28e90a98fb9b2857e1e167b86923335e683cb841187cc55d0c1
Instruction ID: 0bf2fe66980b9caad1b180d158a86670aee02d0630a52177906daabda9be08d2
Opcode Fuzzy Hash: 0129d8094a1ff28e90a98fb9b2857e1e167b86923335e683cb841187cc55d0c1
Instruction Fuzzy Hash: 6551F2B4908305CFD708EF64C485A6EB7F1BF98304F81892DE4C987352EB749989DB92

Function 0017C190 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfree, xrefs: 0017C21F, 0017C2C6
, newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushG, xrefs: 0017C249, 0017C2F0
7, xrefs: 0017C339
runtime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=unfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapyk, xrefs: 0017C2A4

Memory Dump Source

Source File: 00000000.00000002.3380681149.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.3380660672.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.00000000009C9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381422357.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381846397.0000000001018000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381860411.0000000001022000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381887046.000000000104F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381902995.0000000001051000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001053000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001060000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001065000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381916820.0000000001080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3381985388.0000000001091000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3382001825.0000000001092000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_192-34-56-49-32.jbxd

Yara matches

Similarity

API ID:
String ID: , newval=, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushG$, oldval=, size = , tail = : status=atomicor8chan sendcopystackctxt != 0debugLockhchanLeafinittraceinterfacemSpanDeadmSpanFreemap_entrypanicwaitpclmulqdqpreemptedprofBlockrecover: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfree$7$runtime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=unfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapyk
API String ID: 0-298204409
Opcode ID: 85ff4ab3932813c7314652884488534a2ef1ca6cece50a8dbf397bd5abf84c53
Instruction ID: 804d43116aa7c8d71165723228e52167227e2d6f3168325841a45bf84edd1626
Opcode Fuzzy Hash: 85ff4ab3932813c7314652884488534a2ef1ca6cece50a8dbf397bd5abf84c53
Instruction Fuzzy Hash: 2341DFB45097058ED700FFA4C58966EBBF4AF98744F80C82DE48C87252EB749889CB63

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	198-211-108-182-32.exe	Get hash	malicious	Sliver	Browse	198.211.108.182
	SecuriteInfo.com.Linux.Siggen.9999.7531.1432.elf	Get hash	malicious	Mirai	Browse	104.248.219.220
	198-211-108-187-32.exe	Get hash	malicious	Sliver	Browse	198.211.108.187
	192-34-56-91-32.exe	Get hash	malicious	Sliver	Browse	192.34.56.91
	198-211-108-190-32.exe	Get hash	malicious	Sliver	Browse	198.211.108.190
	7HddY6rYkf.elf	Get hash	malicious	Mirai	Browse	134.209.44.123
	visualizadorsm.pdf.2390.msi	Get hash	malicious	MicroClip	Browse	178.128.15.164
	bJTfMUzlNE.elf	Get hash	malicious	Mirai	Browse	157.230.114.232
	The Situ Group Ltd.pdf	Get hash	malicious	HTMLPhisher	Browse	208.68.37.26
	rOhEtfiB9i.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	157.245.182.28

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.45617684594575
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	192-34-56-49-32.exe
File size:	16'050'176 bytes
MD5:	0ed35085bc066ad51240fe4bf40a53ab
SHA1:	c6fd220b6df65062714890d9d64313b98a109d2b
SHA256:	d275507a8c1af840c4da37391d92e9e144ee5d970b84499eae7f8c2a5c11b98a
SHA512:	bc11b3a22ecdb4521324aff5bf09528253836c561686fc8c0a1ba411c0a063f851d35d4e5daac33cc5bb82786e3f78e96b06bddd0888a48ecb3bd33d70bb6c99
SSDEEP:	196608:fZx0bG4qXk9IJRJA5K5mIC0CpQSbrEPdll9g08krnO1Q5l:sqXfAM8bri3Ye
TLSH:	3CF63BD0FED78AB2DA039A30419361AF53343D894735E983E6443FC6E8BB3960977616
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................x..........PI............@.......................................@................................

Entrypoint:	0x464950
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf51000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf52000	0x39c10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xed8040	0xa0	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x88769c	0x887800	a176e76ea09aa62e5568a63b4d7c3912	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x889000	0x64eef8	0x64f000	e2aa22fc5395137628cff0e54e7c3748	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xed8000	0x7866c	0x3d800	9cad8acfb723afc7b25d56e00e5a1fd6	False	0.44260114964430897	DIY-Thermocam raw data (Lepton 2.x), scale 8192-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000122	5.891556263575651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xf51000	0x3dc	0x400	2ff35e328606b7385daa1800e08c188a	False	0.48828125	data	4.663264085783635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xf52000	0x39c10	0x39e00	6ff2dc4481993b7fe9eddaaf18a1ff59	False	0.6381656654967602	data	6.699159976046999	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0xf8c000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 192-34-56-49-32.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

TCP Packets

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: 192-34-56-49-32.exePID: 5276, Parent PID: 4004

Windows Analysis Report
192-34-56-49-32.exe