Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe
Analysis ID:	1521501
MD5:	d178cd15e8e69662a943bf0a9da7ff60
SHA1:	13475dfb0075d3adc31ac02b8dc10dec3c3e84e9
SHA256:	482a86391842a2b869ffd38af0dbfa96de7501a92986e644b54d8ae731bdaf64
Tags:	exeMeterpreter
Infos:

Detection

Metasploit

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe (PID: 716 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe" MD5: D178CD15E8E69662A943BF0A9DA7FF60)

conhost.exe (PID: 1796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: Metasploit

{"Type": "Metasploit Download", "URL": "http://84.201.150.223/blog.html/jBIvhv7O-Lnyc_NxlIGNkA2eqPXwyH2tWFMqE9rGON6m5Me7qKHLtXFrX71OaCs5JSqzLx8SmijRwWz3ygEPuzWbwlW2dF8RGznIQHPzsqj8"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_0f5a852d	Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families.	unknown	0x36b:$a: 49 BE 77 69 6E 69 6E 65 74 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5
00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x311:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T17:52:25.515462+0200	2028765	3	Unknown Traffic	192.168.2.9	49705	84.201.150.223	8443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Metasploit {"Type": "Metasploit Download", "URL": "http://84.201.150.223/blog.html/jBIvhv7O-Lnyc_NxlIGNkA2eqPXwyH2tWFMqE9rGON6m5Me7qKHLtXFrX71OaCs5JSqzLx8SmijRwWz3ygEPuzWbwlW2dF8RGznIQHPzsqj8"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown

HTTPS traffic detected: 84.201.150.223:443 -> 192.168.2.9:49707 version: TLS 1.2

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F420EA0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,

0_2_00007FF70F420EA0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 4x nop then sub rsp, 58h

0_2_00007FF70F47AF00

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://84.201.150.223/blog.html/jBIvhv7O-Lnyc_NxlIGNkA2eqPXwyH2tWFMqE9rGON6m5Me7qKHLtXFrX71OaCs5JSqzLx8SmijRwWz3ygEPuzWbwlW2dF8RGznIQHPzsqj8

Source: global traffic

TCP traffic: 192.168.2.9:49705 -> 84.201.150.223:8443

Source: Joe Sandbox View

ASN Name: YANDEXCLOUDRU YANDEXCLOUDRU

Source: Joe Sandbox View

JA3 fingerprint: 72a589da586844d7f0818ce684948eea

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49705 -> 84.201.150.223:8443

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Content-Length: 332Host: 84.201.150.223
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Content-Length: 332Host: 84.201.150.223
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Content-Length: 332Host: 84.201.150.223
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Content-Length: 332Host: 84.201.150.223

Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.150.223

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F412FB0 recv,WSAGetLastError,

0_2_00007FF70F412FB0

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: */*User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Content-Length: 332Host: 84.201.150.223

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000003.1491719861.0000023F4DF71000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000003.1492213868.0000023F4DFE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000003.1492089630.0000023F4DFBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bd5b3cecb95e0
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabW
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C15C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C1B9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C113000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710505505.0000023F4DFF7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223/
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223/7
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C1B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223/8
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223/CI
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223/V
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223/rq
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223:443/
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223:443/h
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://84.201.150.223:8443/blog.html/jBIvhv7O-Lnyc_NxlIGNkA2eqPXwyH2tWFMqE9rGON6m5Me7qKHLtXFrX71OaC

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown

HTTPS traffic detected: 84.201.150.223:443 -> 192.168.2.9:49707 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families. Author: unknown
Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3E0020 NtAllocateVirtualMemory,NtProtectVirtualMemory,	0_3_0000023F4C3E0020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F420020 RtlNtStatusToDosError,NtOpenFile,RtlNtStatusToDosError,	0_2_00007FF70F420020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F421640 GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,NtOpenFile,SetFileInformationByHandle,CloseHandle,RtlNtStatusToDosError,NtOpenFile,RtlNtStatusToDosError,GetLastError,SetFileInformationByHandle,GetLastError,CloseHandle,SwitchToThread,CloseHandle,SwitchToThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,memcpy,CloseHandle,CloseHandle,	0_2_00007FF70F421640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C4136F0 NtAddBootEntry,	0_2_0000023F4C4136F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C413EF0 NtAddBootEntry,	0_2_0000023F4C413EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C413830 NtAddBootEntry,	0_2_0000023F4C413830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C414050 NtAddBootEntry,	0_2_0000023F4C414050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C4148A0 NtAddBootEntry,	0_2_0000023F4C4148A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C4139E0 NtAddBootEntry,	0_2_0000023F4C4139E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C414310 NtAddBootEntry,	0_2_0000023F4C414310

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F422EB0: memcpy,DeviceIoControl,CloseHandle,CloseHandle,GetLastError,

0_2_00007FF70F422EB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3EA71A	0_3_0000023F4C3EA71A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3E876F	0_3_0000023F4C3E876F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3E0BDF	0_3_0000023F4C3E0BDF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3F58AF	0_3_0000023F4C3F58AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3F890B	0_3_0000023F4C3F890B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3EC13F	0_3_0000023F4C3EC13F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3F8937	0_3_0000023F4C3F8937
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3F764F	0_3_0000023F4C3F764F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F41D0B0	0_2_00007FF70F41D0B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F402F70	0_2_00007FF70F402F70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F464FA0	0_2_00007FF70F464FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F456FD0	0_2_00007FF70F456FD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3FEE80	0_2_00007FF70F3FEE80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F458E90	0_2_00007FF70F458E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E2EF4	0_2_00007FF70F3E2EF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F476EC0	0_2_00007FF70F476EC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E6D40	0_2_00007FF70F3E6D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F42CDB0	0_2_00007FF70F42CDB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F444DCD	0_2_00007FF70F444DCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F414C60	0_2_00007FF70F414C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E8C90	0_2_00007FF70F3E8C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F444C22	0_2_00007FF70F444C22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F43ED08	0_2_00007FF70F43ED08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3F8B60	0_2_00007FF70F3F8B60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F41AC00	0_2_00007FF70F41AC00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F460A60	0_2_00007FF70F460A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3F0AE0	0_2_00007FF70F3F0AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F466AE0	0_2_00007FF70F466AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F478B10	0_2_00007FF70F478B10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F414B00	0_2_00007FF70F414B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F446AC5	0_2_00007FF70F446AC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46E990	0_2_00007FF70F46E990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46AA00	0_2_00007FF70F46AA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45E890	0_2_00007FF70F45E890
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F454880	0_2_00007FF70F454880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F474840	0_2_00007FF70F474840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F450770	0_2_00007FF70F450770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45A720	0_2_00007FF70F45A720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45C640	0_2_00007FF70F45C640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46C6B0	0_2_00007FF70F46C6B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3F8560	0_2_00007FF70F3F8560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4705F0	0_2_00007FF70F4705F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F430610	0_2_00007FF70F430610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3EA5A0	0_2_00007FF70F3EA5A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E85A0	0_2_00007FF70F3E85A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E25C0	0_2_00007FF70F3E25C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E24C0	0_2_00007FF70F3E24C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F44831A	0_2_00007FF70F44831A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45C3A0	0_2_00007FF70F45C3A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4262C0	0_2_00007FF70F4262C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F44A201	0_2_00007FF70F44A201
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4281BE	0_2_00007FF70F4281BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F478080	0_2_00007FF70F478080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3FE0E0	0_2_00007FF70F3FE0E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4400F0	0_2_00007FF70F4400F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F423F70	0_2_00007FF70F423F70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F457F58	0_2_00007FF70F457F58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F457F5A	0_2_00007FF70F457F5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F43BF20	0_2_00007FF70F43BF20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F475FF0	0_2_00007FF70F475FF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F459E1B	0_2_00007FF70F459E1B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46DED0	0_2_00007FF70F46DED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F43DDE0	0_2_00007FF70F43DDE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F471DE0	0_2_00007FF70F471DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E7E10	0_2_00007FF70F3E7E10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45BDD0	0_2_00007FF70F45BDD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46FDD0	0_2_00007FF70F46FDD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F407C90	0_2_00007FF70F407C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F433B30	0_2_00007FF70F433B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3EDB40	0_2_00007FF70F3EDB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F43FA6A	0_2_00007FF70F43FA6A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F473A20	0_2_00007FF70F473A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F41FA40	0_2_00007FF70F41FA40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E9AD0	0_2_00007FF70F3E9AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F44993A	0_2_00007FF70F44993A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45B9F0	0_2_00007FF70F45B9F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4719E0	0_2_00007FF70F4719E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3EBA10	0_2_00007FF70F3EBA10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F40F9B0	0_2_00007FF70F40F9B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4599A0	0_2_00007FF70F4599A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F40D9D0	0_2_00007FF70F40D9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46D840	0_2_00007FF70F46D840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4018FA	0_2_00007FF70F4018FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F449754	0_2_00007FF70F449754
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45B650	0_2_00007FF70F45B650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F479650	0_2_00007FF70F479650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F421640	0_2_00007FF70F421640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E76E0	0_2_00007FF70F3E76E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F44569B	0_2_00007FF70F44569B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4016AE	0_2_00007FF70F4016AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F4396D0	0_2_00007FF70F4396D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F459594	0_2_00007FF70F459594
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F477590	0_2_00007FF70F477590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3FB440	0_2_00007FF70F3FB440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F401323	0_2_00007FF70F401323
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F43B340	0_2_00007FF70F43B340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F44F340	0_2_00007FF70F44F340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F3E93E0	0_2_00007FF70F3E93E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F46B410	0_2_00007FF70F46B410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F45F180	0_2_00007FF70F45F180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F401150	0_2_00007FF70F401150
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C40B740	0_2_0000023F4C40B740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C407D70	0_2_0000023F4C407D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C414EB0	0_2_0000023F4C414EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C4001E0	0_2_0000023F4C4001E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C416C50	0_2_0000023F4C416C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C409D1B	0_2_0000023F4C409D1B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: String function: 00007FF70F463A40 appears 124 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: String function: 00007FF70F463C98 appears 42 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: String function: 00007FF70F47AA38 appears 77 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: String function: 00007FF70F4697B0 appears 64 times

Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_0f5a852d os = windows, severity = x86, description = Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families., creation_date = 2021-04-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 97daac4249e85a73d4e6a4450248e59e0d286d5e7c230cf32a38608f8333f00d, id = 0f5a852d-cacd-43d7-8754-204b09afba2f, last_modified = 2021-08-23
Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal84.troj.evad.winEXE@2/2@0/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F4253E0 memset,FormatMessageW,GetLastError,

0_2_00007FF70F4253E0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F433490 CreateToolhelp32Snapshot,memset,Module32FirstW,Module32NextW,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,

0_2_00007FF70F433490

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1796:120:WilError_03

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Section loaded: wkscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Static file information: File size 1169665 > 1048576

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3F8AF3 push 2F672291h; retf	0_3_0000023F4C3F8B32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3F2D0B push ds; ret	0_3_0000023F4C3F2D0E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_3_0000023F4C3E51C3 push FF00009Eh; ret	0_3_0000023F4C3E51C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C0F0804 push ecx; ret	0_2_0000023F4C0F0B32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C0F058E push ds; retf	0_2_0000023F4C0F0590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C4047C4 push FF00009Eh; ret	0_2_0000023F4C4047C9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_0000023F4C41230C push ds; ret	0_2_0000023F4C41230F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: GetUserNameA,GetComputerNameExA,GetComputerNameExA,GetAdaptersInfo,GetAdaptersInfo,

0_2_0000023F4C407D70

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

API coverage: 1.6 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F420EA0 memcpy,memcpy,memset,FindFirstFileW,memcpy,GetLastError,FindClose,GetLastError,

0_2_00007FF70F420EA0

Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C15C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C113000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C15C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_0000023F4C40D510 LdrGetProcedureAddress,

0_2_0000023F4C40D510

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F41C420 IsDebuggerPresent,

0_2_00007FF70F41C420

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F3E1180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,

0_2_00007FF70F3E1180

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	NtTerminateThread: Indirect: 0x23F4C41490D	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	NtQueueApcThread: Indirect: 0x23F4C4143A1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	NtCreateThreadEx: Indirect: 0x23F4C4137EA	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	NtQueryInformationProcess: Indirect: 0x23F4C413F7F	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_00007FF70F41B2C0 GetSystemTimePreciseAsFileTime,

0_2_00007FF70F41B2C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Code function: 0_2_0000023F4C407D70 GetUserNameA,GetComputerNameExA,GetComputerNameExA,GetAdaptersInfo,GetAdaptersInfo,

0_2_0000023F4C407D70

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected Metasploit Payload

Source: Yara match

File source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F432D7C bind,WSAGetLastError,closesocket,		0_2_00007FF70F432D7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	Code function: 0_2_00007FF70F432A06 bind,listen,WSAGetLastError,closesocket,		0_2_00007FF70F432A06

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	3 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe	39%	ReversingLabs	Win64.Exploit.Marte

Name	Malicious	Antivirus Detection	Reputation
https://84.201.150.223/	true		unknown
http://84.201.150.223/blog.html/jBIvhv7O-Lnyc_NxlIGNkA2eqPXwyH2tWFMqE9rGON6m5Me7qKHLtXFrX71OaCs5JSqzLx8SmijRwWz3ygEPuzWbwlW2dF8RGznIQHPzsqj8	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://84.201.150.223:443/h	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223/rq	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C113000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223:443/	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223/V	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223/7	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C188000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223:8443/blog.html/jBIvhv7O-Lnyc_NxlIGNkA2eqPXwyH2tWFMqE9rGON6m5Me7qKHLtXFrX71OaC	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C113000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223/CI	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C15C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://84.201.150.223/8	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe, 00000000.00000002.2710224262.0000023F4C1B9000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
84.201.150.223	unknown	Russian Federation		200350	YANDEXCLOUDRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521501
Start date and time:	2024-09-28 17:51:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@2/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 145
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YANDEXCLOUDRU	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	130.193.42.23
	http://vidaliaonion.org	Get hash	malicious	Unknown	Browse	130.193.53.230
	Vt5wr1Hj3H.elf	Get hash	malicious	Mirai	Browse	178.154.229.200
	https://faq-kak.ru/kak-najti-svoyu-biblioteku-v-steam/	Get hash	malicious	Unknown	Browse	130.193.58.13
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	84.201.130.205
	http://paypal.6887xyyz.biz.id/	Get hash	malicious	Unknown	Browse	130.193.53.144
	file.exe	Get hash	malicious	Raccoon Stealer v2, RedLine, SmokeLoader	Browse	130.193.51.105
	file.exe	Get hash	malicious	DarkTortilla, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	130.193.51.105
	file.exe	Get hash	malicious	DarkTortilla, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	130.193.51.105
	file.exe	Get hash	malicious	DarkTortilla, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	130.193.51.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	file.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	KTh1gQlT9a.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	file.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	YPDi0gRMHU.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	CNpQfI8eIT.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	6NlY2E3Wqi.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	4EtLXn5pqI.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	RWcyVDbMGQ.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	C1APU2jz2B.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223
	UvrMJYKtES.exe	Get hash	malicious	SmokeLoader	Browse	84.201.150.223

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKWPbs/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Ao/iDnLNkPlE99SNxAhUe/3
MD5:	5A4F0F681E0DD329AA13FAAECD5146AF
SHA1:	7100D0E1C1074C789BDBDD54EA3E5126E9C73746
SHA-256:	2589E9161F60F3E4887D9D81F9D57B6B310E5BAB7877A08506436AC15BC631B1
SHA-512:	D065B906D8B2137BE59B8915CD4862B0EA4C22758D231C9273E6560D0426AB391F9105865BCC5308084C775CED52FE99C07EF6AF8976B4B60619B4B3459FFAE6
Malicious:	false
Reputation:	low
Preview:	p...... ...........j....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.512528295738881
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe
File size:	1'169'665 bytes
MD5:	d178cd15e8e69662a943bf0a9da7ff60
SHA1:	13475dfb0075d3adc31ac02b8dc10dec3c3e84e9
SHA256:	482a86391842a2b869ffd38af0dbfa96de7501a92986e644b54d8ae731bdaf64
SHA512:	65a7f7fc0613f8c773d3b8627d53abb51e708f666986938b28bc4a8689fa63b32b9565b8b00973d8eb82416f1db486af8948fd88771c51c341c95e5ac6f4f841
SSDEEP:	24576:xm360uIhQFmq6XxxlFLRsY2TunLczsEsffWOpc8Ip/Q4k73zs/41kesms:xmK0ThQFmFLRD2TuAHsXW/8Ipo3zs/4m
TLSH:	BA458D12B9A46EADDA4AD174824F6732B779BC880733EEB700B6D3302D529536F1D709
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.6........&....+.....2.................@..........................................`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400013f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66F29892 [Tue Sep 24 10:46:42 2024 UTC]
TLS Callbacks:	0x40051f90, 0x1, 0x4009ab70, 0x1, 0x4009ab40, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	22568cffa8b7e625f5821de1591f8b8f

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000C0095h]
mov dword ptr [eax], 00000000h
call 00007FE9F4CBDB2Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FE9F4D573B4h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FE9F4CBDD89h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
sub esp, 28h
dec eax
mov ecx, dword ptr [ecx]
call 00007FE9F4CBDDC9h
xor eax, eax
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
call ecx
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
dec eax
sub esp, 28h
dec eax
mov ecx, dword ptr [ecx]
call 00007FE9F4CBDD99h
xor eax, eax
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 38h
call 00007FE9F4D56A88h
mov edx, 00000B33h
xor ecx, ecx
inc ecx
mov eax, 00001000h
inc ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd5000	0x1b88	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc2000	0x6258	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd9000	0xd88	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc10e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd5678	0x5c0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab88	0x9ac00	fffb9c8174c5a9bd2c99c7c4ef720f30	False	0.4796531073303716	data	6.3557334201223865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x9c000	0x1b0	0x200	20f02f83edafbe3fc30088c7569e55cd	False	0.21875	data	1.6663583995176068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9d000	0x245b0	0x24600	0dc35cafe2e39e7714df7c2412e279e8	False	0.4333387027491409	data	5.930618274392702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xc2000	0x6258	0x6400	0224db5b7f9da3a5cc00fffda5ef0cb2	False	0.4826953125	data	5.871601291335109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0xc9000	0xaa5c	0xac00	a34102c3de82bc7b1764dadbafcfc220	False	0.26421693313953487	data	5.298415921990279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xd4000	0x2a0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd5000	0x1b88	0x1c00	151e593d5f7cd1e8f0b2900e857210c5	False	0.31277901785714285	COM executable for DOS	4.442365998984562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xd7000	0x68	0x200	b578238cf3dcc19ba1afcb944ace6bf4	False	0.076171875	data	0.4029411215812382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xd8000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xd9000	0xd88	0xe00	afc38a57c62cc22a2e5f313aa1e5808e	False	0.5823102678571429	data	5.388675661863244	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	AddVectoredExceptionHandler, CancelIo, CloseHandle, CompareStringOrdinal, CopyFileExW, CreateDirectoryW, CreateEventW, CreateFileMappingA, CreateFileW, CreateHardLinkW, CreateNamedPipeW, CreatePipe, CreateProcessW, CreateSymbolicLinkW, CreateThread, CreateToolhelp32Snapshot, CreateWaitableTimerExW, DeleteFileW, DeleteProcThreadAttributeList, DeviceIoControl, DuplicateHandle, ExitProcess, FindClose, FindFirstFileW, FindNextFileW, FlushFileBuffers, FormatMessageW, FreeConsole, FreeEnvironmentStringsW, GetCommandLineW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessId, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemTimePreciseAsFileTime, GetTempPathW, GetWindowsDirectoryW, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeProcThreadAttributeList, IsDebuggerPresent, MapViewOfFile, Module32FirstW, Module32NextW, MoveFileExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleW, ReadFile, ReadFileEx, RemoveDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetCurrentDirectoryW, SetEnvironmentVariableW, SetFileAttributesW, SetFileInformationByHandle, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnmapViewOfFile, UpdateProcThreadAttribute, VirtualAlloc, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte, WriteConsoleW, WriteFileEx
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwindEx, VirtualProtect, VirtualQuery, __C_specific_handler
msvcrt.dll	__getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, signal, strlen, strncmp, vfprintf
ntdll.dll	NtOpenFile, NtReadFile, NtWriteFile, RtlNtStatusToDosError
USERENV.dll	GetUserProfileDirectoryW
WS2_32.dll	WSACleanup, WSADuplicateSocketW, WSAGetLastError, WSARecv, WSASend, WSASocketW, WSAStartup, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getpeername, getsockname, getsockopt, ioctlsocket, listen, recv, recvfrom, select, send, sendto, setsockopt, shutdown

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-28T17:52:25.515462+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49705	84.201.150.223	8443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 17:52:24.765950918 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:24.770960093 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:24.771068096 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:24.779766083 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:24.784554005 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:25.515352011 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:25.515443087 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:25.515461922 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:25.515516996 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:26.684211969 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:26.689063072 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:26.907665014 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:26.907752037 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:26.911118984 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:26.915975094 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150266886 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150336027 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150368929 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150389910 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.150423050 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150439978 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.150439978 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.150475025 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.150562048 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150597095 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150624037 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.150633097 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.150667906 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.150688887 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.151087999 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.151166916 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.151217937 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.151252985 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.151278973 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.151308060 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.151360989 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.151418924 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.151787043 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.151820898 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.151850939 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.151878119 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.282741070 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.282800913 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.282810926 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.282816887 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.282869101 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283013105 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283029079 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283056021 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283081055 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283148050 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283200026 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283267021 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283282995 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283322096 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283354044 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283495903 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283512115 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.283544064 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283560991 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.283958912 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284008980 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284044981 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284060001 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284089088 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284126043 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284261942 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284277916 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284313917 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284382105 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284845114 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284892082 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284908056 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284924030 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.284960032 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.284985065 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.285065889 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.285082102 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.285116911 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.285134077 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.285689116 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.285736084 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.285757065 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.285773039 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.285811901 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.285847902 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.285917044 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.285969019 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413495064 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413573980 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413573027 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413604975 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413626909 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413645029 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413697004 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413729906 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413746119 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413774014 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413846970 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413902998 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.413959026 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.413992882 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414016008 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414028883 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414196014 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414246082 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414249897 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414283991 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414295912 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414331913 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414469957 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414518118 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414802074 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414853096 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414891005 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414925098 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.414942026 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.414971113 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415025949 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415076017 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415100098 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415133953 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415148020 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415169001 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415182114 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415232897 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415713072 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415764093 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415812969 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415846109 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.415863037 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.415894985 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416048050 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416080952 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416100979 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416115999 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416129112 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416152000 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416157961 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416202068 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416691065 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416740894 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416754961 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416789055 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.416804075 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.416836023 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417009115 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417042017 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417058945 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417078018 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417090893 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417114019 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417124033 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417161942 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417602062 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417651892 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417655945 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417690992 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417705059 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417740107 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417889118 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417922974 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417937994 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417957067 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417973042 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.417992115 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.417999983 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418040991 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418505907 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418555975 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418586016 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418621063 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418634892 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418673992 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418694973 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418744087 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418764114 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418797970 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418811083 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418833017 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.418848038 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.418879032 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.500432014 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.500489950 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.500489950 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.500519991 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.500540972 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.500560999 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.547317982 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.547400951 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.547410011 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.547454119 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.547467947 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.547522068 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.548398018 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.548418045 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.553293943 CEST	8443	49705	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.553358078 CEST	49705	8443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.919305086 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.919365883 CEST	443	49707	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:27.919483900 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.927664995 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:27.927687883 CEST	443	49707	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:28.648020029 CEST	443	49707	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:28.648139954 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:28.652910948 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:28.652924061 CEST	443	49707	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:28.653352976 CEST	443	49707	84.201.150.223	192.168.2.9
Sep 28, 2024 17:52:28.703562021 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:28.719961882 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:28.720061064 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:52:28.720071077 CEST	443	49707	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:01.610141039 CEST	49707	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:04.661086082 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:04.661112070 CEST	443	49715	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:04.661185026 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:04.661463022 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:04.661473036 CEST	443	49715	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:05.369510889 CEST	443	49715	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:05.371145010 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:05.371174097 CEST	443	49715	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:05.377639055 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:05.377655029 CEST	443	49715	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:05.377675056 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:05.377685070 CEST	443	49715	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:37.625848055 CEST	49715	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:41.333242893 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:41.333272934 CEST	443	49717	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:41.333378077 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:41.333646059 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:41.333657026 CEST	443	49717	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:42.052165985 CEST	443	49717	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:42.053170919 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:42.053181887 CEST	443	49717	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:42.053740978 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:42.053747892 CEST	443	49717	84.201.150.223	192.168.2.9
Sep 28, 2024 17:53:42.053761005 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:53:42.053778887 CEST	443	49717	84.201.150.223	192.168.2.9
Sep 28, 2024 17:54:13.621813059 CEST	49717	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:16.396483898 CEST	49718	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:16.396523952 CEST	443	49718	84.201.150.223	192.168.2.9
Sep 28, 2024 17:54:16.396611929 CEST	49718	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:16.396938086 CEST	49718	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:16.396960020 CEST	443	49718	84.201.150.223	192.168.2.9
Sep 28, 2024 17:54:17.149749994 CEST	443	49718	84.201.150.223	192.168.2.9
Sep 28, 2024 17:54:17.150582075 CEST	49718	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:17.150597095 CEST	443	49718	84.201.150.223	192.168.2.9
Sep 28, 2024 17:54:17.151112080 CEST	49718	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:17.151118994 CEST	443	49718	84.201.150.223	192.168.2.9
Sep 28, 2024 17:54:17.151145935 CEST	49718	443	192.168.2.9	84.201.150.223
Sep 28, 2024 17:54:17.151154041 CEST	443	49718	84.201.150.223	192.168.2.9

HTTP Request Dependency Graph

84.201.150.223

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	84.201.150.223	443	716	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 15:52:28 UTC	271	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: / User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Content-Length: 332 Host: 84.201.150.223
2024-09-28 15:52:28 UTC	332	OUT	Data Raw: 00 00 01 48 de ad be ef 3c 5c 98 74 00 00 00 63 00 00 00 00 9e 9a c8 dc 78 60 48 12 c4 4e f2 86 0c 54 0c 1c 92 1c a8 54 38 ca 8c fc e2 06 a4 7e 28 d8 a8 f6 b6 34 34 aa fc 52 ac 68 2c b8 a8 4e 96 60 80 60 9d c7 b8 17 33 1b 21 4a 42 27 ec 06 a8 b3 d5 2f 73 3f 2d 7b dc 27 c9 7f db 25 b7 6c 88 4d 4c 1e 50 47 25 56 cf 4d 68 50 4d eb 37 05 80 3e 80 ad 81 04 59 a6 70 46 53 f8 91 e1 6f cf 65 15 b8 65 c3 2b 6a e8 d3 05 96 5a b7 20 3e 18 78 65 6c eb 5d c8 0f 19 50 5a 12 a1 34 8f 1d c0 a7 7c 18 7b d1 d4 3e 2a d8 76 4b 3d 5e 37 f2 20 ee 44 f5 b8 0b 02 cb 6e 06 53 b2 e0 87 c4 66 69 66 35 39 9e a8 79 cc 77 e2 07 e4 0f 37 4d 9c 4b b4 de b4 24 d4 75 78 e2 32 aa 97 ff 14 16 f1 b1 3f 19 18 d8 c8 5b 86 a2 d4 0e 57 ad 43 17 00 30 e0 c5 31 1a c9 ae ab 3e cc 80 15 bd d8 9d a0 Data Ascii: H<\tcx`HNTT8~(44Rh,N``3!JB'/s?-{'%lMLPG%VMhPM7>YpFSoee+jZ >xel]PZ4\|{>*vK=^7 DnSfif59yw7MK$ux2?[WC01>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49715	84.201.150.223	443	716	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 15:53:05 UTC	271	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: / User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Content-Length: 332 Host: 84.201.150.223
2024-09-28 15:53:05 UTC	332	OUT	Data Raw: 00 00 01 48 de ad be ef 3c 5c 98 74 00 00 00 63 00 00 00 00 9e 9a c8 dc 78 60 48 12 c4 4e f2 86 0c 54 0c 1c 92 1c a8 54 38 ca 8c fc e2 06 a4 7e 28 d8 a8 f6 b6 34 34 aa fc 52 ac 68 2c b8 a8 4e 96 60 80 60 c9 38 91 9e 4f 2f c1 6f df 43 c5 0c ac 71 4b 17 42 0f 8b c0 0e 3e 0c 88 51 33 3c be 88 5a 5e 57 21 fe 1c b2 29 0a ae f6 8d 5a 93 d2 1f 16 f1 01 fc 89 ee 2d fb ae ba 52 dd 91 00 8b 75 36 ee 01 d9 ff a4 45 28 53 b3 5e a7 ab 6a 15 96 4b 6d 75 6e 1e c1 a8 ae cd 3a 4c ca a7 3a 7c 20 b3 bf 9b bb ae f1 63 7f c3 97 a6 e8 76 8f d6 e1 f8 9e c3 00 1c 06 4d dc 78 40 a0 da ec 44 9e 18 f2 1a 0c 5a 94 46 de a9 97 4e 3b 3d c9 14 f2 b6 92 ac 8e b9 2e de 64 2c 49 2d 97 72 5c c3 13 17 44 0e d9 72 26 8b 61 8b c9 ab a9 a6 65 ae ec 3d 1f 15 e3 90 e8 30 0f 78 bc 8c 39 99 d0 c3 Data Ascii: H<\tcx`HNTT8~(44Rh,N``8O/oCqKB>Q3<Z^W!)Z-Ru6E(S^jKmun:L:\| cvMx@DZFN;=.d,I-r\Dr&ae=0x9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49717	84.201.150.223	443	716	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 15:53:42 UTC	271	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: / User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Content-Length: 332 Host: 84.201.150.223
2024-09-28 15:53:42 UTC	332	OUT	Data Raw: 00 00 01 48 de ad be ef 3c 5c 98 74 00 00 00 63 00 00 00 00 9e 9a c8 dc 78 60 48 12 c4 4e f2 86 0c 54 0c 1c 92 1c a8 54 38 ca 8c fc e2 06 a4 7e 28 d8 a8 f6 b6 34 34 aa fc 52 ac 68 2c b8 a8 4e 96 60 80 60 9d c7 b8 17 33 1b 21 4a 42 27 ec 06 a8 b3 d5 2f 73 3f 2d 7b dc 27 c9 7f db 25 b7 6c 88 4d 4c 1e 50 47 25 56 cf 4d 68 50 4d eb 37 05 80 3e 80 ad 81 04 59 a6 70 46 53 f8 91 e1 6f cf 65 15 b8 65 c3 2b 6a e8 d3 05 96 5a b7 20 3e 18 78 65 6c eb 5d c8 0f 19 50 5a 12 a1 34 8f 1d c0 a7 7c 18 7b d1 d4 3e 2a d8 76 4b 3d 5e 37 f2 20 ee 44 f5 b8 0b 02 cb 6e 06 53 b2 e0 87 c4 66 69 66 35 39 9e a8 79 cc 77 e2 07 e4 0f 37 4d 9c 4b b4 de b4 24 d4 75 78 e2 32 aa 97 ff 14 16 f1 b1 3f 19 18 d8 c8 5b 86 a2 d4 0e 57 ad 43 17 00 30 e0 c5 31 1a c9 ae ab 3e cc 80 15 bd d8 9d a0 Data Ascii: H<\tcx`HNTT8~(44Rh,N``3!JB'/s?-{'%lMLPG%VMhPM7>YpFSoee+jZ >xel]PZ4\|{>*vK=^7 DnSfif59yw7MK$ux2?[WC01>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49718	84.201.150.223	443	716	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 15:54:17 UTC	271	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: / User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Content-Length: 332 Host: 84.201.150.223
2024-09-28 15:54:17 UTC	332	OUT	Data Raw: 00 00 01 48 de ad be ef 3c 5c 98 74 00 00 00 63 00 00 00 00 9e 9a c8 dc 78 60 48 12 c4 4e f2 86 0c 54 0c 1c 92 1c a8 54 38 ca 8c fc e2 06 a4 7e 28 d8 a8 f6 b6 34 34 aa fc 52 ac 68 2c b8 a8 4e 96 60 80 60 c9 38 91 9e 4f 2f c1 6f df 43 c5 0c ac 71 4b 17 42 0f 8b c0 0e 3e 0c 88 51 33 3c be 88 5a 5e 57 21 fe 1c b2 29 0a ae f6 8d 5a 93 d2 1f 16 f1 01 fc 89 ee 2d fb ae ba 52 dd 91 00 8b 75 36 ee 01 d9 ff a4 45 28 53 b3 5e a7 ab 6a 15 96 4b 6d 75 6e 1e c1 a8 ae cd 3a 4c ca a7 3a 7c 20 b3 bf 9b bb ae f1 63 7f c3 97 a6 e8 76 8f d6 e1 f8 9e c3 00 1c 06 4d dc 78 40 a0 da ec 44 9e 18 f2 1a 0c 5a 94 46 de a9 97 4e 3b 3d c9 14 f2 b6 92 ac 8e b9 2e de 64 2c 49 2d 97 72 5c c3 13 17 44 0e d9 72 26 8b 61 8b c9 ab a9 a6 65 ae ec 3d 1f 15 e3 90 e8 30 0f 78 bc 8c 39 99 d0 c3 Data Ascii: H<\tcx`HNTT8~(44Rh,N``8O/oCqKB>Q3<Z^W!)Z-Ru6E(S^jKmun:L:\| cvMx@DZFN;=.d,I-r\Dr&ae=0x9

Target ID:	0
Start time:	11:52:23
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe"
Imagebase:	0x7ff70f3e0000
File size:	1'169'665 bytes
MD5 hash:	D178CD15E8E69662A943BF0A9DA7FF60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_0f5a852d, Description: Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families., Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:52:23
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	47%
Signature Coverage:	48.6%
Total number of Nodes:	183
Total number of Limit Nodes:	14

Executed Functions

Function 0000023F4C407D70 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 0000023F4C407F66
GetComputerNameExA.KERNEL32 ref: 0000023F4C40800C
GetComputerNameExA.KERNEL32 ref: 0000023F4C408051
GetAdaptersInfo.IPHLPAPI ref: 0000023F4C4080B2
GetAdaptersInfo.IPHLPAPI ref: 0000023F4C4080E7

Strings

, xrefs: 0000023F4C407E33

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID: Name$AdaptersComputerInfo$User
String ID:
API String ID: 1713523329-3916222277
Opcode ID: 847f31a267256c4b477c3e55c6d651f5123c8fbdc2e5fbf7ef3bfa4e34fd3b77
Instruction ID: 007ec09a0744c929b51f6cd22295d43f19d7c6acf1ded764d20f1a21c54fb4c2
Opcode Fuzzy Hash: 847f31a267256c4b477c3e55c6d651f5123c8fbdc2e5fbf7ef3bfa4e34fd3b77
Instruction Fuzzy Hash: 74F123307149089FE7C4EB29E699F5673E1FB8C300F415578E68AC72A6DA38DE41CB52

Function 00007FF70F3E1180 Relevance: 10.6, APIs: 7, Instructions: 146
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF70F3E1406), ref: 00007FF70F3E11BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70F3E122F
malloc.MSVCRT ref: 00007FF70F3E1263
strlen.MSVCRT ref: 00007FF70F3E1284
malloc.MSVCRT ref: 00007FF70F3E1290
memcpy.MSVCRT ref: 00007FF70F3E12A8

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: 649668102e0e11a526956de2ff727b7b8ba60e3df94765b97e1fcbfe89641749
Instruction ID: a52965205d5a2729c3e4eb12f9c759abca698afc6209f60604eb839f55d41d87
Opcode Fuzzy Hash: 649668102e0e11a526956de2ff727b7b8ba60e3df94765b97e1fcbfe89641749
Instruction Fuzzy Hash: 8D510536A0D68685FA10BF55ED416F9E3A1EF84B98F844439ED0D4B7A2DF3CE8418720

Function 0000023F4C3E0020 Relevance: 3.3, APIs: 2, Instructions: 262nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0000023F4C3E00EF
NtProtectVirtualMemory.NTDLL ref: 0000023F4C3E0237

Memory Dump Source

Source File: 00000000.00000003.1503477090.0000023F4C3E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023F4C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_23f4c3e0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryVirtual$AllocateProtect
String ID:
API String ID: 2931642484-0
Opcode ID: 670168b2314164816ad4fff62a771d92f35dcb7a52677c9802cb5d6c25b1cd75
Instruction ID: 2e7777e8f7f7d291342b46333d8ad344463c3766e6f03b0d7ddc87cdcabf7974
Opcode Fuzzy Hash: 670168b2314164816ad4fff62a771d92f35dcb7a52677c9802cb5d6c25b1cd75
Instruction Fuzzy Hash: D2712730A1CA485BE75C9F28E88677B77D1F784310F50563DFA87C3292EA38D8428782

Function 0000023F4C40D510 Relevance: 1.6, APIs: 1, Instructions: 143
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 0000023F4C40D627

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: c880d098a533d0f3fb35a3b8b130c654e78c7eb0b2f2c7cb6df4c980cc83c31e
Instruction ID: 5b141aa11468e3046cd14e9628a8ad22b36316f6f07eb11ed07c9aad17b96076
Opcode Fuzzy Hash: c880d098a533d0f3fb35a3b8b130c654e78c7eb0b2f2c7cb6df4c980cc83c31e
Instruction Fuzzy Hash: A9413A30548A045FE798DB19FD89FB773E0FB85314F01043DEA8BC3261EA24E9468796

Function 0000023F4C40B740 Relevance: .6, Instructions: 582
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9f7026369abc2f533983e64922662aaf186562180a13f1a63ba32285e1e16d
Instruction ID: 1cc46726a4bb5c3b9c138a7a44a83b993bbfa57930472963429192cf49b474f7
Opcode Fuzzy Hash: eb9f7026369abc2f533983e64922662aaf186562180a13f1a63ba32285e1e16d
Instruction Fuzzy Hash: 94128F30618A089FEBA4EF19E548F66B7E1FB98300F05017DD64EC72A1CB74E945CB96

Function 0000023F4C4136F0 Relevance: .1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f85d6cc5d146f678718de6328ed8eda05c9f040f0331ba1138b2b3f728f502a
Instruction ID: 98b6b659f54884843f25d691e97cf6ceda63df22049de4df06f9e0a87620e392
Opcode Fuzzy Hash: 0f85d6cc5d146f678718de6328ed8eda05c9f040f0331ba1138b2b3f728f502a
Instruction Fuzzy Hash: D3314F7091CB489FD7A4DF09E846BABBBE0FB88710F14496EE18D83211C771A8418B93

Function 0000023F4C413830 Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208e31ad857d5dcce3a280dcc57152d1db46a14ad4ea6d6d8807739142cc44ce
Instruction ID: 34c3aec24189eb6466a11886dbceb6ffde60acbbc386050b7336db7cb638458c
Opcode Fuzzy Hash: 208e31ad857d5dcce3a280dcc57152d1db46a14ad4ea6d6d8807739142cc44ce
Instruction Fuzzy Hash: 4C214F7051C7449FD7A4DF08E549BABB7E0FB89714F04496EE18D93261CB3598418B93

Function 0000023F4C414310 Relevance: .1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3088a54474c0704e3a01d6a7ced4b2ede53a839219b38387c72ab5f3a59fde9
Instruction ID: 0a33c5694e41b7f33e92ed64f5a4d07ec5b1bb2a25dc60acf3ad78b144370568
Opcode Fuzzy Hash: c3088a54474c0704e3a01d6a7ced4b2ede53a839219b38387c72ab5f3a59fde9
Instruction Fuzzy Hash: 10116370558B489FD784DF18E589F66B7E0FB98700F50546DA18DC3271CB749441CB43

Function 0000023F4C413EF0 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6d45573732ca76e4f0fa793a294bb48da95218d991d8302224f0b43042d479
Instruction ID: 76a5bd3d8af7397f0ed21220c580b08d32f390c59aadf967426fa802553360d6
Opcode Fuzzy Hash: 4c6d45573732ca76e4f0fa793a294bb48da95218d991d8302224f0b43042d479
Instruction Fuzzy Hash: D7116070968B449FD788DF08E589F6AB7E0FB98344F54556DA28AC3261CB389441CF83

Function 0000023F4C414050 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca7dfaa4e91de42f9431d4f6194eae6a1f84e47b222d3be94b93e91ba7828c8
Instruction ID: 7ef9414240953f4371f22cd7edc4710edc23d9a8312da6934d6f5575d453be8c
Opcode Fuzzy Hash: 4ca7dfaa4e91de42f9431d4f6194eae6a1f84e47b222d3be94b93e91ba7828c8
Instruction Fuzzy Hash: B6119870628B449FD798DF08D599F6ABBE0FB94704F50556DE18AC3271CB349541CB43

Function 0000023F4C4139E0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62bf9022b7866b8cf8bec5915bb64fbe05507ee611e7c9cc273e550b7568e5a4
Instruction ID: 5b24e1449dfe25376ca729d077541a1cd8f5965f70479cb2318359a19dbe30c8
Opcode Fuzzy Hash: 62bf9022b7866b8cf8bec5915bb64fbe05507ee611e7c9cc273e550b7568e5a4
Instruction Fuzzy Hash: 17118E70528B448FD788DB0CE14EF6AB7E0FB88704F15456DA5CE832B1CB789A418B83

Function 0000023F4C4148A0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3c666c990c68bc9d607ff77fafc9474886ca1d5a46c4580004139ecadac52d
Instruction ID: 99b91753adac7690116e0ca2befb556397c13901a593eff6032073790159fdcd
Opcode Fuzzy Hash: ab3c666c990c68bc9d607ff77fafc9474886ca1d5a46c4580004139ecadac52d
Instruction Fuzzy Hash: 23018430528A088FE788DF28E15DF6677E0FB44708F15156DA68ED32B1DB7C9A40CB96

Function 0000023F4C0F044E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84A83200,00000000), ref: 0000023F4C0F046D
VirtualAlloc.KERNEL32 ref: 0000023F4C0F050E
InternetReadFile.WININET ref: 0000023F4C0F052D

Strings

U.;, xrefs: 0000023F4C0F0467

Memory Dump Source

Source File: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023F4C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c0f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocFileHttpInternetOpenReadRequestVirtual
String ID: U.;
API String ID: 1187293180-4213443877
Opcode ID: 5690493dc9ff9f8f16933898c455d2a5e8e45ea3ee84a79ee5b969fd92fa3e91
Instruction ID: 56e00ae34615d0967b453a51cc56c991b5d0c045938ea4f941503c776861706c
Opcode Fuzzy Hash: 5690493dc9ff9f8f16933898c455d2a5e8e45ea3ee84a79ee5b969fd92fa3e91
Instruction Fuzzy Hash: 503137A070EB882FF75A016D3C6A7362AD9C79A255F1541ABF34DC71E3EC488C45827A

Function 0000023F4C0F03B2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000000,00000003,00000000,00000000), ref: 0000023F4C0F03CF

Part of subcall function 0000023F4C0F044E: HttpOpenRequestA.WININET(00000000,00000000,84A83200,00000000), ref: 0000023F4C0F046D

VirtualAlloc.KERNEL32 ref: 0000023F4C0F050E
InternetReadFile.WININET ref: 0000023F4C0F052D

Strings

U.;, xrefs: 0000023F4C0F0467

Memory Dump Source

Source File: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023F4C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c0f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$AllocConnectFileHttpOpenReadRequestVirtual
String ID: U.;
API String ID: 258568742-4213443877
Opcode ID: 6fc8f7e9d39f1beb81a02fe686e0033c171592fa012045b2ecca9d2f46ba6301
Instruction ID: f2d2e7f4a8a5506bbb7bbb84bde3fff27ad1cc03f667d4fb60cdf2a4ae53ac99
Opcode Fuzzy Hash: 6fc8f7e9d39f1beb81a02fe686e0033c171592fa012045b2ecca9d2f46ba6301
Instruction Fuzzy Hash: 4B413DD060DB883FF75A42282D5D7377B98E752719F0052ABE785CA0F3E8886D848375

Function 0000023F4C0F0366 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
librarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(696E6977,00000000), ref: 0000023F4C0F0381
InternetOpenA.WININET(00000000,00000000,00000000,00000000), ref: 0000023F4C0F039C

Strings

wini, xrefs: 0000023F4C0F036C

Memory Dump Source

Source File: 00000000.00000002.2710212619.0000023F4C0F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023F4C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c0f0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 0662d3df314d0fc764c5b615890f2d42f03bb8aebb061ff02a7170b5085c526b
Instruction ID: cd1f15311f922d45f5e74769b621d58b5ae746a296720073d69a992730567d61
Opcode Fuzzy Hash: 0662d3df314d0fc764c5b615890f2d42f03bb8aebb061ff02a7170b5085c526b
Instruction Fuzzy Hash: EAF055E060E68C3FE3694E74AC8A4373F9DDB5320930642AFF185C21B3CD940C808225

Function 00007FF70F404520 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadDescription.KERNELBASE ref: 00007FF70F404567

Part of subcall function 00007FF70F4318D0: WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,-00000008,?,?,?,?,?,?,00007FF70F4045C8), ref: 00007FF70F43194B
Part of subcall function 00007FF70F4318D0: GetLastError.KERNEL32(?,?,-00000008,?,?,?,?,?,?,00007FF70F4045C8), ref: 00007FF70F431955

Strings

main, xrefs: 00007FF70F40455D

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressDescriptionErrorLastThreadWait
String ID: main
API String ID: 2915094395-3207122276
Opcode ID: c52a097244dd1071374e55f5b798f0915c8acee24753f9a8faadf6f788744dce
Instruction ID: d0e5198903a8118d15cbfbad48f4ad9d10084509bb9b1e561b45d802765e293c
Opcode Fuzzy Hash: c52a097244dd1071374e55f5b798f0915c8acee24753f9a8faadf6f788744dce
Instruction Fuzzy Hash: 20111C21E0CA9699EB10FB65EC442EDA360EF44788FD40136EE0C56665EF3CD54AC360

Function 0000023F4C411ED0 Relevance: 3.1, APIs: 2, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFiberEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,000168BF,?,?,0000023F4C402904), ref: 0000023F4C411F66
DeleteFiber.KERNELBASE(?,?,?,?,?,?,?,?,?,?,000168BF,?,?,0000023F4C402904), ref: 0000023F4C411F8E

Memory Dump Source

Source File: 00000000.00000002.2710423583.0000023F4C400000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000023F4C400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23f4c400000_SecuriteInfo.jbxd

Similarity

API ID: Fiber$CreateDelete
String ID:
API String ID: 2527733159-0
Opcode ID: e666d9c0b0ba46b256699f288a6e5ecb4e148a06e009019892e951112d41f9a7
Instruction ID: feb1a1a7cf3ffa215cee041ae366626ade3c4f063d453504768a3e20c01b6be7
Opcode Fuzzy Hash: e666d9c0b0ba46b256699f288a6e5ecb4e148a06e009019892e951112d41f9a7
Instruction Fuzzy Hash: 50319130604A088FE7A0DF28E54CB6BB7E1FB98304F600679E28AC32A1DF38D540CB01

Function 00007FF70F3E14A0 Relevance: 1.9, APIs: 1, Instructions: 382
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF70F3E1EB3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 28af41fac67d6db8249826d68bed4cd226c56e348e9a327fe25b39d9c433fe7b
Instruction ID: 7c5dda35d61990c02654b5dc42fd7b75691a0090bac450a82faff8a103a4fb1e
Opcode Fuzzy Hash: 28af41fac67d6db8249826d68bed4cd226c56e348e9a327fe25b39d9c433fe7b
Instruction Fuzzy Hash: C962BF42C2DBC681F2029B289D016F5E7A0FFE9619F46F375EE9921132BF6832D58650

Non-executed Functions

Function 00007FF70F4281BE Relevance: 110.2, APIs: 50, Strings: 11, Instructions: 3484COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F4281BE
memcpy.MSVCRT ref: 00007FF70F428246
memcpy.MSVCRT ref: 00007FF70F4282C0
CloseHandle.KERNEL32 ref: 00007FF70F42BCA4
CloseHandle.KERNEL32 ref: 00007FF70F42BCEB
CloseHandle.KERNEL32 ref: 00007FF70F42BD52
CloseHandle.KERNEL32 ref: 00007FF70F42BD67
CloseHandle.KERNEL32 ref: 00007FF70F42C224

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF70F428AB6, 00007FF70F42949D
\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FF70F42A127, 00007FF70F42A168
PATHstd\src\sys_common\process.rs, xrefs: 00007FF70F429AF5
]?\\, xrefs: 00007FF70F428690
#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c ", xrefs: 00007FF70F42AEC5
.exeprogram not found, xrefs: 00007FF70F42882D
exe\\.\NULexit code: , xrefs: 00007FF70F429389, 00007FF70F4294F1, 00007FF70F4296D8, 00007FF70F42998B, 00007FF70F429BDE
p, xrefs: 00007FF70F42B610
assertion failed: self.height > 0, xrefs: 00007FF70F42BB3F
\?\\, xrefs: 00007FF70F428688
program path has no file name, xrefs: 00007FF70F42C290

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$memcpy
String ID: program path has no file name$#$*+-./:?@\_cmd.exe /e:ON /v:OFF /d /c "$.exeprogram not found$PATHstd\src\sys_common\process.rs$\?\\$\cmd.exemaximum number of ProcThreadAttributes exceeded$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NULexit code: $p
API String ID: 2397262393-1135848453
Opcode ID: 7168641fd2f8d9c11d44c0459243f3e3b2abd98d2595aa4d4429dfa4280c34e9
Instruction ID: 494541ca8999aa66f85a555b6ed80b082d9c374b0f3d52ed0210536407df4eef
Opcode Fuzzy Hash: 7168641fd2f8d9c11d44c0459243f3e3b2abd98d2595aa4d4429dfa4280c34e9
Instruction Fuzzy Hash: 76737D62A1CAD184EBB0AF25DC403FEA761FF44789F845136EE0D5BB99DF3996418320

Function 00007FF70F446AC5 Relevance: 99.4, Strings: 79, Instructions: 696COMMON

Download Yara Rule

Strings

$ft6, xrefs: 00007FF70F44734D
$f31, xrefs: 00007FF70F447299
$r28, xrefs: 00007FF70F447169
$fa0, xrefs: 00007FF70F4472A5
$ft7, xrefs: 00007FF70F447359
$f15, xrefs: 00007FF70F4471D5
$r29, xrefs: 00007FF70F447175
$f24, xrefs: 00007FF70F447241
$f17, xrefs: 00007FF70F4471ED
7sf$, xrefs: 00007FF70F4473DF
$f11, xrefs: 00007FF70F4471A5
$f10, xrefs: 00007FF70F447199
$ft1, xrefs: 00007FF70F447539
$r27, xrefs: 00007FF70F44715D
$ft9, xrefs: 00007FF70F447371
$ft1, xrefs: 00007FF70F4474D7
$r13, xrefs: 00007FF70F4470B5
$ft5, xrefs: 00007FF70F447341
$r22, xrefs: 00007FF70F447121
$fa1, xrefs: 00007FF70F4472B1
$f25, xrefs: 00007FF70F44724D
$ft8, xrefs: 00007FF70F447365
$f22, xrefs: 00007FF70F447229
$f20, xrefs: 00007FF70F447211
$r15, xrefs: 00007FF70F4470CD
$fs5, xrefs: 00007FF70F4473B9
$r17, xrefs: 00007FF70F4470E5
$r16, xrefs: 00007FF70F4470D9
$f13, xrefs: 00007FF70F4471BD
$fa4, xrefs: 00007FF70F4472D5
$f30, xrefs: 00007FF70F44728D
$f16, xrefs: 00007FF70F4471E1
$fs4, xrefs: 00007FF70F4473AD
$r20, xrefs: 00007FF70F447109
$f21, xrefs: 00007FF70F44721D
$f27, xrefs: 00007FF70F447265
$fa3, xrefs: 00007FF70F4472C9
$f23, xrefs: 00007FF70F447235
$ft1, xrefs: 00007FF70F447311
$ft4, xrefs: 00007FF70F447335
$r12, xrefs: 00007FF70F4470A9
$fa2, xrefs: 00007FF70F4472BD
$r23, xrefs: 00007FF70F44712D
$fa7, xrefs: 00007FF70F4472F9
$fs6, xrefs: 00007FF70F4473C5
$r25, xrefs: 00007FF70F447145
$fcc, xrefs: 00007FF70F44748D
$f28, xrefs: 00007FF70F447271
$fs1, xrefs: 00007FF70F447389
$r11, xrefs: 00007FF70F44709D
$ft0, xrefs: 00007FF70F447305
$ft2, xrefs: 00007FF70F44731D
$fa5, xrefs: 00007FF70F4472E1
$f12, xrefs: 00007FF70F4471B1
$f14, xrefs: 00007FF70F4471C9
$r24, xrefs: 00007FF70F447139
$r18, xrefs: 00007FF70F4470F1
$r31, xrefs: 00007FF70F44718D
$ft3, xrefs: 00007FF70F447329
$fs3, xrefs: 00007FF70F4473A1
$f18, xrefs: 00007FF70F4471F9
$r14, xrefs: 00007FF70F4470C1
$fs2, xrefs: 00007FF70F447395
$r21, xrefs: 00007FF70F447115
$r19, xrefs: 00007FF70F4470FD
$ft1, xrefs: 00007FF70F447508
$zer, xrefs: 00007FF70F4474BE
$f26, xrefs: 00007FF70F447259
$fs0, xrefs: 00007FF70F44737D
$fcc, xrefs: 00007FF70F4473F6
$r10, xrefs: 00007FF70F447091
$f19, xrefs: 00007FF70F447205
$f29, xrefs: 00007FF70F44727D
$fcc, xrefs: 00007FF70F44742B
$fa6, xrefs: 00007FF70F4472ED
$r26, xrefs: 00007FF70F447151
$fcc, xrefs: 00007FF70F44745C
$r30, xrefs: 00007FF70F447181
8sf$, xrefs: 00007FF70F4473D7

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $f10$$f11$$f12$$f13$$f14$$f15$$f16$$f17$$f18$$f19$$f20$$f21$$f22$$f23$$f24$$f25$$f26$$f27$$f28$$f29$$f30$$f31$$fa0$$fa1$$fa2$$fa3$$fa4$$fa5$$fa6$$fa7$$fcc$$fcc$$fcc$$fcc$$fs0$$fs1$$fs2$$fs3$$fs4$$fs5$$fs6$$ft0$$ft1$$ft1$$ft1$$ft1$$ft2$$ft3$$ft4$$ft5$$ft6$$ft7$$ft8$$ft9$$r10$$r11$$r12$$r13$$r14$$r15$$r16$$r17$$r18$$r19$$r20$$r21$$r22$$r23$$r24$$r25$$r26$$r27$$r28$$r29$$r30$$r31$$zer$7sf$$8sf$
API String ID: 0-2955985535
Opcode ID: 0a6f81c235ef483b718c61f0eeb0edeed620d1f5857fc61eb9a9533d98844833
Instruction ID: bbb8546935046920204f2f4db2a96747d98ed59989f174e25d021cc56df27ca4
Opcode Fuzzy Hash: 0a6f81c235ef483b718c61f0eeb0edeed620d1f5857fc61eb9a9533d98844833
Instruction Fuzzy Hash: E752D525A0D1E386F7347F289810AB9AED2CF16B49FE59071EE4819E84CB6F7403D661

Function 00007FF70F444DCD Relevance: 81.5, APIs: 52, Strings: 2, Instructions: 520COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF70F444F5D
memcmp.MSVCRT ref: 00007FF70F444F77
memcmp.MSVCRT ref: 00007FF70F444F91
memcmp.MSVCRT ref: 00007FF70F444FAB
memcmp.MSVCRT ref: 00007FF70F444FC5
memcmp.MSVCRT ref: 00007FF70F444FDF
memcmp.MSVCRT ref: 00007FF70F444FF9
memcmp.MSVCRT ref: 00007FF70F445013
memcmp.MSVCRT ref: 00007FF70F44502D
memcmp.MSVCRT ref: 00007FF70F445047
memcmp.MSVCRT ref: 00007FF70F445061
memcmp.MSVCRT ref: 00007FF70F44507B
memcmp.MSVCRT ref: 00007FF70F445095
memcmp.MSVCRT ref: 00007FF70F4450AF
memcmp.MSVCRT ref: 00007FF70F4450CD
memcmp.MSVCRT ref: 00007FF70F4450E7
memcmp.MSVCRT ref: 00007FF70F445101
memcmp.MSVCRT ref: 00007FF70F44511B
memcmp.MSVCRT ref: 00007FF70F445135
memcmp.MSVCRT ref: 00007FF70F44514F
memcmp.MSVCRT ref: 00007FF70F445169
memcmp.MSVCRT ref: 00007FF70F445183
memcmp.MSVCRT ref: 00007FF70F44519D
memcmp.MSVCRT ref: 00007FF70F4451B7
memcmp.MSVCRT ref: 00007FF70F4451D1
memcmp.MSVCRT ref: 00007FF70F4451EB
memcmp.MSVCRT ref: 00007FF70F445205
memcmp.MSVCRT ref: 00007FF70F44521F
memcmp.MSVCRT ref: 00007FF70F445239
memcmp.MSVCRT ref: 00007FF70F445253
memcmp.MSVCRT ref: 00007FF70F44526D
memcmp.MSVCRT ref: 00007FF70F445287
memcmp.MSVCRT ref: 00007FF70F4452A1
memcmp.MSVCRT ref: 00007FF70F4452BB
memcmp.MSVCRT ref: 00007FF70F4452D5
memcmp.MSVCRT ref: 00007FF70F4452EF
memcmp.MSVCRT ref: 00007FF70F445309
memcmp.MSVCRT ref: 00007FF70F445323
memcmp.MSVCRT ref: 00007FF70F44533D
memcmp.MSVCRT ref: 00007FF70F445357
memcmp.MSVCRT ref: 00007FF70F445371
memcmp.MSVCRT ref: 00007FF70F44538B
memcmp.MSVCRT ref: 00007FF70F4453A5
memcmp.MSVCRT ref: 00007FF70F4453BF
memcmp.MSVCRT ref: 00007FF70F4453D9
memcmp.MSVCRT ref: 00007FF70F4453F3
memcmp.MSVCRT ref: 00007FF70F44540D
memcmp.MSVCRT ref: 00007FF70F445427
memcmp.MSVCRT ref: 00007FF70F445441
memcmp.MSVCRT ref: 00007FF70F44545B
memcmp.MSVCRT ref: 00007FF70F445475
memcmp.MSVCRT ref: 00007FF70F44548F

Strings

S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR_EL1TPIDR_EL2TPIDR_EL3VGFFRP0P1P2P3P4P5P6P7P8P9P10P11P12P13P14P15V0V1V2V3V4V5V6V7V8V9V10V11V12V13V14V15V16V17V18V19V20V21V22V23V, xrefs: 00007FF70F445482
wC0wC1wC2wC3wC4wC5wC6wC7D0D1D2D3D4D5D6D7D8D9D10D11D12D13D14D15D16D17D18D19D20D21D22D23D24D25D26D27D28D29D30D31TPIDRUROTPIDRURWTPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30, xrefs: 00007FF70F444F50

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID: S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR_EL1TPIDR_EL2TPIDR_EL3VGFFRP0P1P2P3P4P5P6P7P8P9P10P11P12P13P14P15V0V1V2V3V4V5V6V7V8V9V10V11V12V13V14V15V16V17V18V19V20V21V22V23V$wC0wC1wC2wC3wC4wC5wC6wC7D0D1D2D3D4D5D6D7D8D9D10D11D12D13D14D15D16D17D18D19D20D21D22D23D24D25D26D27D28D29D30D31TPIDRUROTPIDRURWTPIDPRHTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30
API String ID: 1475443563-3158491581
Opcode ID: 9e89b98e3b4b8b3e7a3fd131c16a2aacb681b05a67fad223d4d4a0d04a5db1a1
Instruction ID: 476edfd48e587664bbe4b94fa0ad374e3892470b05412ef2554702894472742f
Opcode Fuzzy Hash: 9e89b98e3b4b8b3e7a3fd131c16a2aacb681b05a67fad223d4d4a0d04a5db1a1
Instruction Fuzzy Hash: FE125744A0C6D752FE24B6165E901FE9295DF0ABC1BC8403AFD5E6A6DADF9CF1028330

Function 00007FF70F444C22 Relevance: 45.2, APIs: 1, Strings: 29, Instructions: 165COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF70F444DB8

Strings

R14_, xrefs: 00007FF70F444D43
R14_, xrefs: 00007FF70F444C7B
_USR, xrefs: 00007FF70F444C57
R13_, xrefs: 00007FF70F444CD6
_FIQ, xrefs: 00007FF70F444C99
R13_, xrefs: 00007FF70F444C69
_FIQ, xrefs: 00007FF70F444CC4
R12_, xrefs: 00007FF70F444C50
R13_, xrefs: 00007FF70F444D2A
R14_, xrefs: 00007FF70F444D6E
R14_, xrefs: 00007FF70F444D99
_UND, xrefs: 00007FF70F444D5C
_SVC, xrefs: 00007FF70F444D87
R12_, xrefs: 00007FF70F444CBD
R10_, xrefs: 00007FF70F444C92
_ABT, xrefs: 00007FF70F444D31
R14_, xrefs: 00007FF70F444CE8
_USR, xrefs: 00007FF70F444C29
HTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR, xrefs: 00007FF70F444DAB
R14_, xrefs: 00007FF70F444D18
R13_, xrefs: 00007FF70F444CFF
R11_, xrefs: 00007FF70F444CAB
_IRQ, xrefs: 00007FF70F444D06
R13_, xrefs: 00007FF70F444D55
R11_, xrefs: 00007FF70F444C3E
_FIQ, xrefs: 00007FF70F444CEF
R10_, xrefs: 00007FF70F444C22
R13_, xrefs: 00007FF70F444D80
_USR, xrefs: 00007FF70F444C82

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID: HTPIDPRSPLRPCACC0ACC1ACC2ACC3ACC4ACC5ACC6ACC7S0S1S2S3S4S5S6S7S8S9S10S11S12S13S14S15S16S17S18S19S20S21S22S23S24S25S26S27S28S29S30S31X0X1X2X3X4X5X6X7X8X9X10X11X12X13X14X15X16X17X18X19X20X21X22X23X24X25X26X27X28X29X30ELR_modeRA_SIGN_STATETPIDRRO_EL0TPIDR_EL0TPIDR$R10_$R10_$R11_$R11_$R12_$R12_$R13_$R13_$R13_$R13_$R13_$R13_$R14_$R14_$R14_$R14_$R14_$R14_$_ABT$_FIQ$_FIQ$_FIQ$_IRQ$_SVC$_UND$_USR$_USR$_USR
API String ID: 1475443563-995318
Opcode ID: f4a0205e7acadd5b3b877972655acb1242bb2a7e1140da83af69dff744d315df
Instruction ID: e16a8c900946b0b3a1f76669fde2b3c8545b68705cfa5f208b0d34a099a092c2
Opcode Fuzzy Hash: f4a0205e7acadd5b3b877972655acb1242bb2a7e1140da83af69dff744d315df
Instruction Fuzzy Hash: EA515C3AB0D0838BF7B8F66498514BAA293DF54710B588035EAAF977C8CF79F8059750

Function 00007FF70F433B30 Relevance: 43.2, APIs: 21, Strings: 2, Instructions: 2921COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F435965

Strings

.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF70F437742
.debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types, xrefs: 00007FF70F434EDE

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: .debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types$.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs
API String ID: 3510742995-17903541
Opcode ID: 90d8b3a01fc95d91aa6cc667e9572e900328faa8ff6a703d7351d0c715f2bad0
Instruction ID: 6a5870260a6db5e2665513d97e0999e61e7cd408747958ae53643c774774aeab
Opcode Fuzzy Hash: 90d8b3a01fc95d91aa6cc667e9572e900328faa8ff6a703d7351d0c715f2bad0
Instruction Fuzzy Hash: 6C732962608BC588EBB0AF29DC507ED73A0FB4578CF944226DE4D4BB99DF399285C350

Function 00007FF70F45C3A0 Relevance: 33.6, APIs: 14, Strings: 7, Instructions: 2135COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F45C952
memcpy.MSVCRT ref: 00007FF70F45CC56
memcpy.MSVCRT ref: 00007FF70F45CC78
memcpy.MSVCRT ref: 00007FF70F45CC9A

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF70F45D85C
assertion failed: d.minus > 0, xrefs: 00007FF70F45D7FC, 00007FF70F45E6EE
assertion failed: d.plus > 0, xrefs: 00007FF70F45D814, 00007FF70F45E706
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF70F45D82C, 00007FF70F45E71E
assertion failed: d.mant > 0, xrefs: 00007FF70F45D7E4, 00007FF70F45E6D6
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF70F45D77C, 00007FF70F45E78E
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF70F45D844, 00007FF70F45E736

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 3510742995-655871377
Opcode ID: 612f8e11f6fe933ddca790fe68068969c8a9f7b70d4c53282b633896a9066e92
Instruction ID: d9582f450817b7f38fef970aa0490a9c2ef7428b33bf8db52028a7ac12b092ee
Opcode Fuzzy Hash: 612f8e11f6fe933ddca790fe68068969c8a9f7b70d4c53282b633896a9066e92
Instruction Fuzzy Hash: 6B13C272E1D6D24AEB25EF209D507F96360EF55B88FC45231EE4E17B86DF38A6818310

Function 00007FF70F456FD0 Relevance: 28.9, APIs: 15, Strings: 3, Instructions: 1921COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F457BD7

Strings

a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs, xrefs: 00007FF70F457115
called `Result::unwrap()` on an `Err` valueErrorLayoutError, xrefs: 00007FF70F4571C7
capacity overflow, xrefs: 00007FF70F458B57

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs$called `Result::unwrap()` on an `Err` valueErrorLayoutError$capacity overflow
API String ID: 3510742995-2813165162
Opcode ID: a8a8414814159eb29f35f7f6856dd37f359b69ffc17b6343153644bb971e2634
Instruction ID: 60301b6693ecbb32c08f5417c9f7b259d103bc98450a64cc8567fe07517c31e1
Opcode Fuzzy Hash: a8a8414814159eb29f35f7f6856dd37f359b69ffc17b6343153644bb971e2634
Instruction Fuzzy Hash: 4CF2C252F18BD589FB01AB6888012FD6B60FF55BC8F844635EE5957B8ACF38D606C360

Function 00007FF70F45C640 Relevance: 26.9, APIs: 7, Strings: 10, Instructions: 1387COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F45DA62

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF70F45D85C, 00007FF70F45F0C3
assertion failed: d.minus > 0, xrefs: 00007FF70F45D7FC, 00007FF70F45E6EE, 00007FF70F45F063
assertion failed: d.plus > 0, xrefs: 00007FF70F45D814, 00007FF70F45E706, 00007FF70F45F07B
assertion failed: edelta >= 0core\src\num\diy_float.rs, xrefs: 00007FF70F45F0F3
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF70F45D82C, 00007FF70F45E71E, 00007FF70F45F093
assertion failed: d.mant > 0, xrefs: 00007FF70F45D7E4, 00007FF70F45E6D6, 00007FF70F45F04B
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF70F45E893, 00007FF70F45F121
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF70F45D77C, 00007FF70F45E78E
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF70F45D844, 00007FF70F45E736, 00007FF70F45F0AB
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF70F45F0DB

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0core\src\num\diy_float.rs$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 3510742995-884903055
Opcode ID: 963e1cbe38a7d6d7bfb3c349376860ab3ad222aca8f29285d2dfbcba7e0ce62e
Instruction ID: bec9f02d88c7d76c3e26fd9cd60b6daa8d76836158173f4e00fe056126eed5c4
Opcode Fuzzy Hash: 963e1cbe38a7d6d7bfb3c349376860ab3ad222aca8f29285d2dfbcba7e0ce62e
Instruction Fuzzy Hash: 54C2C162F1C6C68AEB20EF609D507F8A760EF55B88F805135EE1D17B96DF38A685C310

Function 00007FF70F430610 Relevance: 21.8, APIs: 14, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52cba2e40afaa811cd7068df69074949dc50906666ee749b35e70fea21804ed6
Instruction ID: 21ecbf9c894707b2519e9c0e181831eaabb2f53effb69a495b6df99db5b2c6ea
Opcode Fuzzy Hash: 52cba2e40afaa811cd7068df69074949dc50906666ee749b35e70fea21804ed6
Instruction Fuzzy Hash: 866204A2E0C6D244FB35AA699C407F9E691EF41BD8F948235EE5D177D1CF3CA5828320

Function 00007FF70F422EB0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 188COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42310D
CloseHandle.KERNEL32 ref: 00007FF70F423159
GetLastError.KERNEL32 ref: 00007FF70F423172

Strings

\\.\, xrefs: 00007FF70F423129
\\?\, xrefs: 00007FF70F422F5B
\??\:\\\.\\\path is not valid, xrefs: 00007FF70F422F9D, 00007FF70F4231B9, 00007FF70F4231DE
\??\UNC\`original` path is too long, xrefs: 00007FF70F42319B
\??\, xrefs: 00007FF70F422F63

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$ErrorLast
String ID: \??\$\??\:\\\.\\\path is not valid$\??\UNC\`original` path is too long$\\.\$\\?\
API String ID: 1798101686-1231689588
Opcode ID: e961e7a58aaf3d90792703a109b22cecd2206073e839d8f5746194df9f725678
Instruction ID: 3b2193e019ff5e5fc5c3ae61a1a0fac35cb0a85cfe1d33105f9d8c60ae980c3e
Opcode Fuzzy Hash: e961e7a58aaf3d90792703a109b22cecd2206073e839d8f5746194df9f725678
Instruction Fuzzy Hash: 7A910C62A0C6C284EBA0EF65DC443F9A261FF04788F848135EE4D4BB99EF7D9249C350

Function 00007FF70F420EA0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 304fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F420F07
memcpy.MSVCRT ref: 00007FF70F420F33
memset.MSVCRT ref: 00007FF70F42104E
FindFirstFileW.KERNEL32 ref: 00007FF70F421059
memcpy.MSVCRT ref: 00007FF70F4210BF
GetLastError.KERNEL32 ref: 00007FF70F421116
FindClose.KERNEL32 ref: 00007FF70F421264

Strings

*\\?\\??\:\\\.\\\path is not valid, xrefs: 00007FF70F420F48

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Find$CloseErrorFileFirstLastmemset
String ID: *\\?\\??\:\\\.\\\path is not valid
API String ID: 3412300865-1181881060
Opcode ID: cb9ac96185fd0c444c4f9cb3865ab23fab11a97b25199c48f37c8e6470b293e0
Instruction ID: be186d8592ec975a39e738235baa32579ed9b2661e56b2db68f38f1d785b97dc
Opcode Fuzzy Hash: cb9ac96185fd0c444c4f9cb3865ab23fab11a97b25199c48f37c8e6470b293e0
Instruction Fuzzy Hash: 76C17D62B086D244FB64AA61DC543FDA6A1EF85BD8F804135EE5C0BBCADF3DE5418360

Function 00007FF70F45E890 Relevance: 11.7, Strings: 9, Instructions: 442COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF70F45D85C, 00007FF70F45F0C3
assertion failed: d.minus > 0, xrefs: 00007FF70F45D7FC, 00007FF70F45E6EE, 00007FF70F45F063
assertion failed: d.plus > 0, xrefs: 00007FF70F45D814, 00007FF70F45E706, 00007FF70F45F07B
assertion failed: edelta >= 0core\src\num\diy_float.rs, xrefs: 00007FF70F45F0F3
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF70F45D82C, 00007FF70F45E71E, 00007FF70F45F093
assertion failed: d.mant > 0, xrefs: 00007FF70F45D7E4, 00007FF70F45E6D6, 00007FF70F45F04B
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF70F45E893, 00007FF70F45F121
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF70F45D844, 00007FF70F45E736, 00007FF70F45F0AB
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF70F45F0DB

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0core\src\num\diy_float.rs
API String ID: 0-1405585532
Opcode ID: e12ec7d70295af1960198811afce04fcde44f701f734f19d42e31d8000299132
Instruction ID: 634fbb7c0be1239d1688aa7d7070d7f193cc9f48d36810e8f5689a7d1f4f0268
Opcode Fuzzy Hash: e12ec7d70295af1960198811afce04fcde44f701f734f19d42e31d8000299132
Instruction Fuzzy Hash: 4BF101A2B08BC586EB14EFA4AC416E8A765FF44BD8F805036EE0D57B89CF38D945C350

Function 00007FF70F46FDD0 Relevance: 9.3, Strings: 7, Instructions: 563COMMON

Download Yara Rule

Strings

NAN, xrefs: 00007FF70F4702AD
-, xrefs: 00007FF70F47038A
-, xrefs: 00007FF70F47017E
-, xrefs: 00007FF70F4702FF
, xrefs: 00007FF70F47006B
+, xrefs: 00007FF70F470183
INFINITY, xrefs: 00007FF70F4701D3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $+$-$-$-$INFINITY$NAN
API String ID: 0-245197695
Opcode ID: add1dcb741625d1ada8ab56d6b5035de9c51b3bdf260fea690d63ee0f7534f27
Instruction ID: 0fee3498243bac4d1628803b552b6f544250abff25c87bfc4eba3f69b4724ffe
Opcode Fuzzy Hash: add1dcb741625d1ada8ab56d6b5035de9c51b3bdf260fea690d63ee0f7534f27
Instruction Fuzzy Hash: 6422E122B0E7C24AFB20EA69EC447F8A7A1EF45758FC84031ED4D56795DF2CE9858320

Function 00007FF70F44831A Relevance: 8.2, Strings: 6, Instructions: 702COMMON

Download Yara Rule

Strings

ft10, xrefs: 00007FF70F448DEB
zero, xrefs: 00007FF70F448DD3
21tf, xrefs: 00007FF70F448DF9
fs10, xrefs: 00007FF70F448DDB
11tf, xrefs: 00007FF70F448E01
fs11, xrefs: 00007FF70F448DE3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 11tf$21tf$fs10$fs11$ft10$zero
API String ID: 0-3297899624
Opcode ID: 4d0012f3ca83e8da86391348e9fd705460fb61bfff84e61581d137223063c8dc
Instruction ID: 936a51e6c4c6878a05ef2d90f069d2daab55d1868d040a97ce90a773d884a10e
Opcode Fuzzy Hash: 4d0012f3ca83e8da86391348e9fd705460fb61bfff84e61581d137223063c8dc
Instruction Fuzzy Hash: 2E52AA21A1D0F341F2353F388811ABAEAA3EF59B45EA99032FF44199C5E77F3541A231

Function 00007FF70F4262C0 Relevance: 7.9, APIs: 5, Instructions: 446COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF70F426320
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF70F42634C

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentPrng
String ID:
API String ID: 716580790-0
Opcode ID: 48505d29cadf61b442a691ef46f0850358945b65c0925643658045a632c3b598
Instruction ID: 7153dcb27a26b6523d736e7f1b39107f54e7aa98caf7c4188a62064d3e769a1a
Opcode Fuzzy Hash: 48505d29cadf61b442a691ef46f0850358945b65c0925643658045a632c3b598
Instruction Fuzzy Hash: D402BD32A08AD28AEB90AF25DC003F9AAA0FF44798F954235EE5E477D9DF7CD5418310

Function 00007FF70F423F70 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 336COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F4241B4

Strings

-pty, xrefs: 00007FF70F424493, 00007FF70F4244C8
win-, xrefs: 00007FF70F4244EF
msys, xrefs: 00007FF70F424479
cygw, xrefs: 00007FF70F4244E8

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: -pty$cygw$msys$win-
API String ID: 3510742995-1440016460
Opcode ID: 8d5a90feb98a6630309fbdfd4e35c81d7eac242735bce145a859c3383cf256e7
Instruction ID: 093c509ea1fbf62b7512b7cbe98c6781d90fcca047ad1d7d8816629149d48edf
Opcode Fuzzy Hash: 8d5a90feb98a6630309fbdfd4e35c81d7eac242735bce145a859c3383cf256e7
Instruction Fuzzy Hash: A8D1EE62A087C289FBA0EA61DC543F96790EF14798F844139EE494BBDADF3CD185C320

Function 00007FF70F47AF00 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF70F47B250
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF70F47B08D
Unknown pseudo relocation bit size %d., xrefs: 00007FF70F47B244

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 0-1286557213
Opcode ID: 79d3606074c03acd7ee10fa2614d67ca7db49e16cf856c305e6923568db78f53
Instruction ID: 0c87a244dbec95f195807c0b376af090ee60ffab6f7d81a12362cb467591df65
Opcode Fuzzy Hash: 79d3606074c03acd7ee10fa2614d67ca7db49e16cf856c305e6923568db78f53
Instruction Fuzzy Hash: 1991B222E0D7D642EA10EB209D442F9A391FF947A8F948231FD6C177D9DF2CE8428220

Function 00007FF70F46DED0 Relevance: 6.7, APIs: 3, Strings: 1, Instructions: 715COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F46DF4D

Strings

assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF70F46E926

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID: assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 2221118986-1476291318
Opcode ID: 01f88f0f444d7a12e2393370bf5e45000478049e4e76c63937c3a3c969915200
Instruction ID: a81b673615381be6a15b4b89a7315eb8da7d1819bbfe8f02d09afed910cafdbd
Opcode Fuzzy Hash: 01f88f0f444d7a12e2393370bf5e45000478049e4e76c63937c3a3c969915200
Instruction Fuzzy Hash: 0A52EEA6B1D6C196EB10DB64D8047E8A3A1FF95798FC49232EE1D03784EF38A596C311

Function 00007FF70F42CDB0 Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127d2e710b2fbb2dad025b4d010958ea53573c618a6973f67377dc73af12a754
Instruction ID: ddfe68610d2e425528c92d4302f3cdb421d9680a95a10e02f04f9ad23a7ab3dd
Opcode Fuzzy Hash: 127d2e710b2fbb2dad025b4d010958ea53573c618a6973f67377dc73af12a754
Instruction Fuzzy Hash: 8CA19C62B1D69281EA94BA16DC447FDA261FF45BE8FD48131EE1D17BD5DF3CA042C220

Function 00007FF70F432A06 Relevance: 6.1, APIs: 4, Instructions: 87networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF70F432ADE
listen.WS2_32 ref: 00007FF70F432AF0
WSAGetLastError.WS2_32 ref: 00007FF70F432B01
closesocket.WS2_32 ref: 00007FF70F432B13

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastbindclosesocketlisten
String ID:
API String ID: 2544828312-0
Opcode ID: 748ffb5efd0f39301a13475b86eb4fa1a00e22ed55c28eb2b7083ec44f07c07c
Instruction ID: c1dad1b036cc5571b6b8417f52260ff17f0b8339a8f1e4603c7bdd8d36c9f967
Opcode Fuzzy Hash: 748ffb5efd0f39301a13475b86eb4fa1a00e22ed55c28eb2b7083ec44f07c07c
Instruction Fuzzy Hash: 2B31C161B0C6C146FB14FA629A402FDE2A1EF45BD4F948130FE1C57BD5EB6CE6918360

Function 00007FF70F466AE0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F466FAC
memset.MSVCRT ref: 00007FF70F466FFD

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F466C31, 00007FF70F466D4E, 00007FF70F466DC2, 00007FF70F466E05, 00007FF70F466E29

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 2221118986-3825506207
Opcode ID: b5b5e6ecc296bc06ec531bcad0c542afbe8d725124bd8d6745cb255c98cb3089
Instruction ID: 00f1a8e2b76b5e4f750b3e6f10b4cac61a55e752547b6f6eb332b53284a59c04
Opcode Fuzzy Hash: b5b5e6ecc296bc06ec531bcad0c542afbe8d725124bd8d6745cb255c98cb3089
Instruction Fuzzy Hash: AFC1B0537086A545DB049F3A9D013B95A65FB88BE4F809232FE6E8BBE4EE3CD544C311

Function 00007FF70F44993A Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF70F449C1B
memcmp.MSVCRT ref: 00007FF70F449C35

Strings

fcwfswxmm16xmm17xmm18xmm19xmm20xmm21xmm22xmm23xmm24xmm25xmm26xmm27xmm28xmm29xmm30xmm31k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17, xrefs: 00007FF70F449C0E

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID: fcwfswxmm16xmm17xmm18xmm19xmm20xmm21xmm22xmm23xmm24xmm25xmm26xmm27xmm28xmm29xmm30xmm31k0k1k2k3k4k5k6k7r0r1r2r3r4r5r6r7r16r17r18r19r20r21r22r23r24r25r26r27r28r29r30r31lrctrcr0cr1cr2cr3cr4cr5cr6cr7xervr0vr1vr2vr3vr4vr5vr6vr7vr8vr9vr10vr11vr12vr13vr14vr15vr16vr17
API String ID: 1475443563-1161499575
Opcode ID: 404598823229445b91c197691cf6f0d58f33ed23f8c97a38a336c48fdecb29d7
Instruction ID: 6e42d69fcce344803c6005373cb1fe9aa1c27d202c96a32f202c9a9eca8717ba
Opcode Fuzzy Hash: 404598823229445b91c197691cf6f0d58f33ed23f8c97a38a336c48fdecb29d7
Instruction Fuzzy Hash: 16A1009681C0E340E6287A2195610FBBAE1EF09781B954077FFD75E4D1EB5DBA70B230

Function 00007FF70F41AC00 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF70F41ABDF), ref: 00007FF70F41ADC0

Strings

overflow when subtracting durations, xrefs: 00007FF70F41ADA8
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70F41ADDD

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID: called `Result::unwrap()` on an `Err` value$overflow when subtracting durations
API String ID: 1452528299-1633623230
Opcode ID: f39864857b36628ae978ec1e9f3f7ac1062496f6c34ec12bab41879defdbffeb
Instruction ID: d55576330c8127e736d9f841519cd28921eb82653fb21cf85c63a08f946494ac
Opcode Fuzzy Hash: f39864857b36628ae978ec1e9f3f7ac1062496f6c34ec12bab41879defdbffeb
Instruction Fuzzy Hash: 38610022B2DBD646EB15EB64DD047FDA362FF84780FA58031ED0E06B95DF2CA9458360

Function 00007FF70F3E9AD0 Relevance: 4.7, APIs: 3, Instructions: 914COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F3EA583

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: e6a718c4cee61572bf9526c17145016adcc31a9d9e04b24d746ac6a2fda40ff2
Instruction ID: f97b99ba0deecee774a625baa9447188183c454830149ceefe78929920d8dd7f
Opcode Fuzzy Hash: e6a718c4cee61572bf9526c17145016adcc31a9d9e04b24d746ac6a2fda40ff2
Instruction Fuzzy Hash: AE82D462B04BD582EB10DF29D9046E8A721FB58BE8F819725DF6E57391EF38E194C300

Function 00007FF70F420020 Relevance: 4.6, APIs: 3, Instructions: 90filenativeCOMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL ref: 00007FF70F4200D3
NtOpenFile.NTDLL ref: 00007FF70F420122
RtlNtStatusToDosError.NTDLL ref: 00007FF70F42013A

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorStatus$FileOpen
String ID:
API String ID: 333864751-0
Opcode ID: 79e08d285390066f8c8e3106afc9c2b34007a1b195c426809136ab7f48f4070f
Instruction ID: 850b19f2d0fa39a32d14e6d5ba006d37483c74b5446f603952df801591a54331
Opcode Fuzzy Hash: 79e08d285390066f8c8e3106afc9c2b34007a1b195c426809136ab7f48f4070f
Instruction Fuzzy Hash: C6414C32A087C289F760AF68EC803FDB7B1EF44358F944539EE8856694DF3DA6858750

Function 00007FF70F432D7C Relevance: 4.6, APIs: 3, Instructions: 80networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF70F432E4E
WSAGetLastError.WS2_32 ref: 00007FF70F432E5F
closesocket.WS2_32 ref: 00007FF70F432E71

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastbindclosesocket
String ID:
API String ID: 698480664-0
Opcode ID: 4eb87b05c24c358b8626dbfb7c6a5281964d59a7c7398afb91b3523ab9e7afe7
Instruction ID: 20f30a0ba6dd1b14f51605147b7cfde0f05bb5907443527437f9f9a580eda980
Opcode Fuzzy Hash: 4eb87b05c24c358b8626dbfb7c6a5281964d59a7c7398afb91b3523ab9e7afe7
Instruction Fuzzy Hash: 0021C561B0C69145FB14FB66DA422FDB2A1EF05BD4F948034EE0C57B85EB6CE6918360

Function 00007FF70F454880 Relevance: 4.6, Strings: 3, Instructions: 816COMMON

Download Yara Rule

Strings

`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00007FF70F45544D
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 00007FF70F4548AE
__ZN, xrefs: 00007FF70F454C9B

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 1475443563-1033176386
Opcode ID: d9b1ffe04a2857da524a491a8c24a31dc07cf26e3baec5d469cab6f2d67a54a6
Instruction ID: c0b3bf3dda5c7b2c0a202ff2e67343ddfe806a91786466abba68f1f349d44a03
Opcode Fuzzy Hash: d9b1ffe04a2857da524a491a8c24a31dc07cf26e3baec5d469cab6f2d67a54a6
Instruction Fuzzy Hash: A9622762E1C5E141EB25FA109C242FDAB61EF45B98FC44235FE5E1B6D6DF2C9984C320

Function 00007FF70F3EA5A0 Relevance: 4.4, APIs: 3, Instructions: 637COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F3EAF6E

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4177bfc9d6aee29b3365455aa1a79694b85c08873566b2982cfa64938bb860b8
Instruction ID: deefc25d1819c21f6b52be696f353fa52189a1dd2714d2a1e042ce6b8ec33e05
Opcode Fuzzy Hash: 4177bfc9d6aee29b3365455aa1a79694b85c08873566b2982cfa64938bb860b8
Instruction Fuzzy Hash: D752D272A18B8582DB10DF28D9442ECB764FB58BA8F819326DF5D173A1EF38E195C310

Function 00007FF70F464FA0 Relevance: 4.4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= maxlen, xrefs: 00007FF70F465419, 00007FF70F465821
} }(((..), ..),{..}, ..}, xrefs: 00007FF70F464FC7
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF70F465148, 00007FF70F465550, 00007FF70F46593D

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= maxlen$} }(((..), ..),{..}, ..}
API String ID: 0-611632207
Opcode ID: a95f5e795a752806bb006088e8c75a84df668c3cf8ea78261bad8f061e2747fd
Instruction ID: b5b3aff10efa23118217d4ffc1db564fa22c55dfdd4724a7478731d43903571e
Opcode Fuzzy Hash: a95f5e795a752806bb006088e8c75a84df668c3cf8ea78261bad8f061e2747fd
Instruction Fuzzy Hash: 2752B1A2A0CBD189E7629F20DC407E863A5FF04758F944232EE5D5BB98DF789786C311

Function 00007FF70F3EDB40 Relevance: 4.3, APIs: 3, Instructions: 516COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF70F3EDBD8
memcmp.MSVCRT ref: 00007FF70F3EDC34
memcmp.MSVCRT ref: 00007FF70F3EDC62

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 286bc90ee59ca981c61e64eb35ccf527707d9c4d64979009f19894e2311f3597
Instruction ID: 3ae78cd908f3e1783d60a078e8a66d2460519995bf8c997750fe3fe0ba6af8b3
Opcode Fuzzy Hash: 286bc90ee59ca981c61e64eb35ccf527707d9c4d64979009f19894e2311f3597
Instruction Fuzzy Hash: F1220362E1CAD684EB11AA25C8017F8E750EF15BACFC5463AEE8D5A7C5EF38D185C310

Function 00007FF70F458E90 Relevance: 4.2, APIs: 3, Instructions: 461COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F459096

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9467a07c2e4e79de53cfda5677f9d92352b49f44b3222b16de0b6c455381fcd0
Instruction ID: 5917de56f6da6a3c10c365cf060c3159ad2ddae7f7583130a3aecd39aae1e0bb
Opcode Fuzzy Hash: 9467a07c2e4e79de53cfda5677f9d92352b49f44b3222b16de0b6c455381fcd0
Instruction Fuzzy Hash: 9902C422B09685D9FB10EA65C8413FD6B60EB14B98F848835EE5D0BBCADF3CD645D360

Function 00007FF70F45BDD0 Relevance: 4.1, Strings: 3, Instructions: 358COMMON

Download Yara Rule

Strings

cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0core\src\num\diy_float.rs, xrefs: 00007FF70F45C2D2
FFFFFFFF, xrefs: 00007FF70F45BF2D
FFFFFFFF, xrefs: 00007FF70F45BE06

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: FFFFFFFF$FFFFFFFF$cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0core\src\num\diy_float.rs
API String ID: 0-1479529582
Opcode ID: cece516c4bb1fc66bfef7aebd1b1c4d410285f2207c04884fc62a28fc6f0255b
Instruction ID: 69267e3ef66f97cf6a609ac3576b4c1d30f0254bf0435076761d3445ef154a43
Opcode Fuzzy Hash: cece516c4bb1fc66bfef7aebd1b1c4d410285f2207c04884fc62a28fc6f0255b
Instruction Fuzzy Hash: 27C11522F0C6E285EE50AA6599907F9AA90EF45FA4FC85231EF1E037D2EF3D9541C310

Function 00007FF70F4705F0 Relevance: 4.1, Strings: 3, Instructions: 332COMMON

Download Yara Rule

Strings

INFINITY, xrefs: 00007FF70F470667
<, xrefs: 00007FF70F470902
NAN, xrefs: 00007FF70F47074F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: <$INFINITY$NAN
API String ID: 0-2314501456
Opcode ID: 42da6c50dac8fdbce4bdf83be7182283cd0de835ba184da1de2ada460cdae8ae
Instruction ID: a045e120b45ce2ce35c7e797f361b88b0c198e7632df787d9ccb80bab6d6449d
Opcode Fuzzy Hash: 42da6c50dac8fdbce4bdf83be7182283cd0de835ba184da1de2ada460cdae8ae
Instruction Fuzzy Hash: 45C1FE62E0E3C645FB21EA2D8C543FAD692EF41794FC58531FD4D962C6EF3CA9818260

Function 00007FF70F450770 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 391COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F45079D

Strings

punycode{-}0, xrefs: 00007FF70F450CAC

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID: punycode{-}0
API String ID: 2221118986-2450133883
Opcode ID: 55c88d78dd559d2b3751cb4176c0c03d95d63bca0dcc866eb944bdc9e1dd44ad
Instruction ID: 9aa3d263e9e38e657f0357cfa6d54a91cca5010d1ebd77bb7a8d7932a0f062b4
Opcode Fuzzy Hash: 55c88d78dd559d2b3751cb4176c0c03d95d63bca0dcc866eb944bdc9e1dd44ad
Instruction Fuzzy Hash: 76E155AAF1C6C646FB65AB299C447F9A241FF45B98F848232ED1D0B7C2DF3CA5458310

Function 00007FF70F478080 Relevance: 3.2, Strings: 2, Instructions: 706COMMON

Download Yara Rule

Strings

0123456789abcdefEscapeDefaultLazyCell instance has previously been poisoned, xrefs: 00007FF70F478861
0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F4780F5

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0123456789abcdefEscapeDefaultLazyCell instance has previously been poisoned$0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-1307160271
Opcode ID: e49f2f05e857634f0e31339867097d2ab0c328b1dbfa6b8d098b07a09b5f540a
Instruction ID: 3a58220b29ee94946f5d6335a7228855a9e43956e00172da692f4de9e707a12c
Opcode Fuzzy Hash: e49f2f05e857634f0e31339867097d2ab0c328b1dbfa6b8d098b07a09b5f540a
Instruction Fuzzy Hash: 0B62F272A0C7E089D725DF3898146FC7FA1EB1A749F684265FE8A13B95CB38D402D720

Function 00007FF70F3F0AE0 Relevance: 3.1, APIs: 2, Instructions: 603COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F3F13B5
memcpy.MSVCRT ref: 00007FF70F3F13CE

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8d624f5cf7b3a4578a296b334f8aeb98214465192c4823afd33a0b26d140fbd7
Instruction ID: 4862cf154c2d75f11fb1963a11bd1351b7b211073d550afa69b89a6225c03f40
Opcode Fuzzy Hash: 8d624f5cf7b3a4578a296b334f8aeb98214465192c4823afd33a0b26d140fbd7
Instruction Fuzzy Hash: 0D328CA2A09BC581EF49AB15E8403F9E7A0FF44BA4F848139DE1D1B795DF38E5958320

Function 00007FF70F46E990 Relevance: 3.1, Strings: 2, Instructions: 590COMMON

Download Yara Rule

Strings

assertion failed: digits < 3, xrefs: 00007FF70F46F37E
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_, xrefs: 00007FF70F46F12E, 00007FF70F46FD49

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: assertion failed: digits < 3$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0assertion failed: !d.is_zero()_
API String ID: 0-2607668560
Opcode ID: 234f54d4ef5102649f96de95e8a69bcad46da16f8f107d66a42487a3d4cd151c
Instruction ID: a6a3e0f8b4e2c792a0f3c79028450ed505df3138854c32c8136dbdf132b3662d
Opcode Fuzzy Hash: 234f54d4ef5102649f96de95e8a69bcad46da16f8f107d66a42487a3d4cd151c
Instruction Fuzzy Hash: 7C3205A6B0D6C189FB15AB24E8107F8ABA0EF59758F884131EE9D037C1DF2CD596C325

Function 00007FF70F3F8B60 Relevance: 3.1, APIs: 1, Instructions: 1839COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce0bc29cf5e739e258735771deafe512687719eec9363d7cc4abb93e749d263
Instruction ID: fc9c3f44d9b6bf9c8e1a8db683b545a9b2f7eef89fb2bb35bcabb27f1fde5391
Opcode Fuzzy Hash: 2ce0bc29cf5e739e258735771deafe512687719eec9363d7cc4abb93e749d263
Instruction Fuzzy Hash: 53138162609BC589EB719F25DC403EDB7A4FB047A8F844229DB5D4FB99DF389289C310

Function 00007FF70F412FB0 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF70F412FE6
WSAGetLastError.WS2_32 ref: 00007FF70F41300C

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 37723feaeb49543a627be1f6b2d306876c2f30257b141eec5485334a585bcd12
Instruction ID: 764def488e0e27c5b995b36c82ce40cc10a182e54c1aa636f7320ea0862031f5
Opcode Fuzzy Hash: 37723feaeb49543a627be1f6b2d306876c2f30257b141eec5485334a585bcd12
Instruction Fuzzy Hash: BFF08B62B0CB8585EB309B669A40179D7D1EF187F0F644631DE6D43BD4DF1CD5914310

Function 00007FF70F3E7E10 Relevance: 2.9, APIs: 2, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9aeb3ac5b4834eec1a5c62577ec8008acf8b2bb9c9e40280a77e4e0a0d143c
Instruction ID: 20901532df628de82f714917c87abf8a480988f9663cd561176b2175204db25f
Opcode Fuzzy Hash: 0e9aeb3ac5b4834eec1a5c62577ec8008acf8b2bb9c9e40280a77e4e0a0d143c
Instruction Fuzzy Hash: 27029E62E08AC586EB709E25DC493E9A351FF54BE8F84463ADE2D1B7D5DF38D681C200

Function 00007FF70F3E8C90 Relevance: 2.9, APIs: 2, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84797cc675818f550877eeecae54e8f534d1e48d0723e448f86228a99731e84d
Instruction ID: a8df46c2cb7c4010f6c7029a37163585e2bf6dfb3b64806e594fc37841d3ab8d
Opcode Fuzzy Hash: 84797cc675818f550877eeecae54e8f534d1e48d0723e448f86228a99731e84d
Instruction Fuzzy Hash: E302BB62A0DAC585EB709E25D8483F9A361FF54BECF84463ACA1D0B7D9DF38D2858310

Function 00007FF70F3E85A0 Relevance: 2.9, APIs: 2, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82acfd88291b5821926cdb5c4cfc2129d530ca397419fd48c371596d1f3627ef
Instruction ID: f4675c30d2e2a32b07f58559d80117b4a5ea6ce4853e987fa65f3d3cca984103
Opcode Fuzzy Hash: 82acfd88291b5821926cdb5c4cfc2129d530ca397419fd48c371596d1f3627ef
Instruction Fuzzy Hash: B2F1AC62F09AC585EB209F25DC483E9A361FF54BE8F85862ADE1D4B7D4DF389681C310

Function 00007FF70F457F58 Relevance: 2.8, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F45873E
memcpy.MSVCRT ref: 00007FF70F458974

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 327f23ea2f05464bd68356f248c7e4806b3c4cbab9bc4b8947fe54eed0b77a85
Instruction ID: 6ba56a22b08e5e78305ad6e300c158e226ebbd24bc6c89a9a6567cca4d233a88
Opcode Fuzzy Hash: 327f23ea2f05464bd68356f248c7e4806b3c4cbab9bc4b8947fe54eed0b77a85
Instruction Fuzzy Hash: DCD1DA22F18FE549F702AB799C021F8A760FF9A7C8F405734FE9962A56DF3896018354

Function 00007FF70F457F5A Relevance: 2.8, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F45873E
memcpy.MSVCRT ref: 00007FF70F458974

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d63e2c6c4bd987930c7f2735ca1f476bba04b1bfe663a17e11dc7d94e9945412
Instruction ID: 6ba56a22b08e5e78305ad6e300c158e226ebbd24bc6c89a9a6567cca4d233a88
Opcode Fuzzy Hash: d63e2c6c4bd987930c7f2735ca1f476bba04b1bfe663a17e11dc7d94e9945412
Instruction Fuzzy Hash: DCD1DA22F18FE549F702AB799C021F8A760FF9A7C8F405734FE9962A56DF3896018354

Function 00007FF70F476EC0 Relevance: 2.8, Strings: 2, Instructions: 307COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F476FE0, 00007FF70F477154, 00007FF70F477188, 00007FF70F477200
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00007FF70F4772D4

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-1873708790
Opcode ID: 8f74c05aaac738c5bdefc392a06a2f50d47008105790e540e7a2689866cda052
Instruction ID: 7228e6e0f5a6ff6d399df3e73907de6abe8384668ee716b91e7ef4e6b2ad4ad6
Opcode Fuzzy Hash: 8f74c05aaac738c5bdefc392a06a2f50d47008105790e540e7a2689866cda052
Instruction Fuzzy Hash: 2CB17662B2C7D54AEB04DB259D143F86692EF44BD8FC49131EE1E87794DB3CA845C311

Function 00007FF70F473A20 Relevance: 2.0, Strings: 1, Instructions: 757COMMON

Download Yara Rule

Strings

0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F473D61, 00007FF70F473EFD, 00007FF70F4740C6, 00007FF70F4742D6, 00007FF70F474540

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-3431789093
Opcode ID: 1881a504289315ffb13c972132de102001f5e043c4a5ae88cc2a44939891e47f
Instruction ID: 91481cee0ed18b62a9636ec654d636c1f2ca691935a40dc216e4fad3593ea6b8
Opcode Fuzzy Hash: 1881a504289315ffb13c972132de102001f5e043c4a5ae88cc2a44939891e47f
Instruction Fuzzy Hash: 74622232B2C6A58AE725DB20E814BF8A760FB55754FC05235EE8A13BE0DF3D9654C710

Function 00007FF70F43ED08 Relevance: 1.9, Strings: 1, Instructions: 608COMMON

Download Yara Rule

Strings

internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs, xrefs: 00007FF70F43ED08

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs
API String ID: 0-3329622625
Opcode ID: 40e8f9cd6eb60217cbb72b895b7345b624204c706ccea98d1906e4dc4417be82
Instruction ID: 62c6096472cf24333cb72b7414bc95f10faeb6811eac07df58de6c5865068570
Opcode Fuzzy Hash: 40e8f9cd6eb60217cbb72b895b7345b624204c706ccea98d1906e4dc4417be82
Instruction Fuzzy Hash: 50322466F1DAE285EB149B6498016FDAB61EF14BE8FC44332EE1D23BC5DF3894498310

Function 00007FF70F46C6B0 Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

00000000, xrefs: 00007FF70F46C700

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 00000000
API String ID: 0-3221785859
Opcode ID: 01899b1e69208b89c92c19d03e337e695f8234d996e0454985cab701b08d741e
Instruction ID: 90951c3202bf6fbb1a60a48768d26641505e1f7a93c56c0ebf4e0ffdb2f90a3d
Opcode Fuzzy Hash: 01899b1e69208b89c92c19d03e337e695f8234d996e0454985cab701b08d741e
Instruction Fuzzy Hash: 86026B92F1D39245F7239A3698403F4BA51EF52785F80C337FE8D66A95EB28D5828311

Function 00007FF70F43FA6A Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs, xrefs: 00007FF70F43FA6A

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: internal error: entered unreachable code/rust/deps\memchr-2.5.0\src\memmem\x86\avx.rs
API String ID: 0-3329622625
Opcode ID: 7b1be332530027b3d491f82b91697526199e0a5893335e1f47a0ec02240d8e18
Instruction ID: 940488c6a063286c08628f2860acf1b531dfa6ee48703cc458f65e5a87ca9638
Opcode Fuzzy Hash: 7b1be332530027b3d491f82b91697526199e0a5893335e1f47a0ec02240d8e18
Instruction Fuzzy Hash: 40027322E0C2E185E7159F2598047FDABA1FF057E8FD44132EE5E133A0DB79A95AD320

Function 00007FF70F46AA00 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

falsetrue, xrefs: 00007FF70F46AA08

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: falsetrue
API String ID: 0-2583396087
Opcode ID: f5d780dadac42003589aff20ea593d70d6ca5f1a2035f518f882332a056b38ec
Instruction ID: 5919331ab18a91daccaa133b2b02a7d0781841b80160996f6b733fe90d5e6f41
Opcode Fuzzy Hash: f5d780dadac42003589aff20ea593d70d6ca5f1a2035f518f882332a056b38ec
Instruction Fuzzy Hash: FAE1ABD6F2DFD601F723533958022F4A600AFA77E4A40D337FDA931BD1DB29A2829214

Function 00007FF70F474840 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F474A15, 00007FF70F474C05

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-3431789093
Opcode ID: 55976a15a6a5d5dca10d46b7314da59d531f4f0a19aa53f139a2ee588ddea7ee
Instruction ID: 9c336e867da891ba760afdc46020da686f5987a7f91bdcc737a5de2367485b79
Opcode Fuzzy Hash: 55976a15a6a5d5dca10d46b7314da59d531f4f0a19aa53f139a2ee588ddea7ee
Instruction Fuzzy Hash: 0FB15663B183A687EB61DA61D4017F9A655EB007E0FC0C231EE5A177C1DF2CA94AD361

Function 00007FF70F3E25C0 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F4755B5, 00007FF70F475665, 00007FF70F475830

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-3431789093
Opcode ID: 929d2994bfa36e0280e11b2dfbb1f690a107037d88d8ccb040e33ffbb92eb94d
Instruction ID: 76728bb8def5b723d4c9d5b2a119978366189364021096fb2242ea194c6f7358
Opcode Fuzzy Hash: 929d2994bfa36e0280e11b2dfbb1f690a107037d88d8ccb040e33ffbb92eb94d
Instruction Fuzzy Hash: 64B12062A1C69185E769EB24E814BF8A364FB54748FC4A135EE8E07BD0CF2DD295C360

Function 00007FF70F414C60 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

Iter, xrefs: 00007FF70F41522F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Iter
API String ID: 0-841058261
Opcode ID: 104a2f744cbffacca76a80d87cf1ea0cc5611d3f7ed4a3e0422ffe90291e6ace
Instruction ID: 18eb208bdd80d07999ce840ebcd35f91d6323bf8de5a6e4ae18e5fbd21b59fd1
Opcode Fuzzy Hash: 104a2f744cbffacca76a80d87cf1ea0cc5611d3f7ed4a3e0422ffe90291e6ace
Instruction Fuzzy Hash: 7DA12862E0CAD545FB22AB60AD007FCA7A0FF52784FA84031FE4D03B95DF6C95928310

Function 00007FF70F475FF0 Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F4761A0, 00007FF70F4763D1

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-3431789093
Opcode ID: 7929c06b32f4b752e15479dcaa6cf89bdff1a6c0c49cc1e1e4264d383b70bf79
Instruction ID: 517d1a31ab5281eb49aa1e1096171b292a8d0241e904fe126e1e379bf0b410b4
Opcode Fuzzy Hash: 7929c06b32f4b752e15479dcaa6cf89bdff1a6c0c49cc1e1e4264d383b70bf79
Instruction Fuzzy Hash: B8B17863A0C6E185E764DB28C8047F9A762FF467A4F825235EE9E17BD0DB2C8604C310

Function 00007FF70F3E24C0 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19, xrefs: 00007FF70F475830, 00007FF70F4758E0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0x0o0b00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899assertion failed: *curr > 19
API String ID: 0-3431789093
Opcode ID: 9b4a31df2f04560e23aa48829bfeb223358c97f14953ebdccbfc135dc595a8b9
Instruction ID: 8c20b3a518a1a402acda347fbce1293e880ccc0a334849ed3d41f068303c899b
Opcode Fuzzy Hash: 9b4a31df2f04560e23aa48829bfeb223358c97f14953ebdccbfc135dc595a8b9
Instruction Fuzzy Hash: BFA16572B1C69485E761EB24E804BF9A365FF95798F849230EE8E07BD0DF2D9244C710

Function 00007FF70F41C420 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00007FF70F41C42A

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: cf75c0701d8c260c657b1e56a6b0707c8d967c953aea0b40d83ec687e36a79fd
Instruction ID: 021953a461cba49976f136897a02dd8d4bdf7a876bf3201e98f28e47910006b3
Opcode Fuzzy Hash: cf75c0701d8c260c657b1e56a6b0707c8d967c953aea0b40d83ec687e36a79fd
Instruction Fuzzy Hash: 56C08C01A6C886C9F23471314C820F48218AF88304FE82030EA5C005928A0CE9E78520

Function 00007FF70F478B10 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

0123456789abcdefEscapeDefaultLazyCell instance has previously been poisoned, xrefs: 00007FF70F478D60

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0123456789abcdefEscapeDefaultLazyCell instance has previously been poisoned
API String ID: 0-1662314993
Opcode ID: 42a1e0f8f50e5f0d24601ecff1b8d0e35f7123689bdef4e13dbbe675a06e44a6
Instruction ID: fa7b14ac5daf290b36df6643e212d627f43af496ed672e071b0d2e922d9435e8
Opcode Fuzzy Hash: 42a1e0f8f50e5f0d24601ecff1b8d0e35f7123689bdef4e13dbbe675a06e44a6
Instruction Fuzzy Hash: A2A10423B0D3E09DE721DB754C145FD6FA2EB56748B688165FE8A17B89CB388112E320

Function 00007FF70F459E1B Relevance: 1.5, APIs: 1, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6326bd680c808afe0b876303e1fbd6e06e57fb461c43988b74292c15b8ac6b
Instruction ID: 6697b3a8e3bd78f89af624ae2ed252c3f5f775f3aaf123cddd33da3ada4105be
Opcode Fuzzy Hash: 2a6326bd680c808afe0b876303e1fbd6e06e57fb461c43988b74292c15b8ac6b
Instruction Fuzzy Hash: 6591C163A1869189FB11AB65D8413FDABA0FF04B98F849535EE4E57BCADB3CD144C320

Function 00007FF70F3FEE80 Relevance: 1.5, Instructions: 1466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260e99790875a3a6d0222eff38f845ec93f97fc36e25a8e6096e2201381829fb
Instruction ID: 08d598c22562ed8b0775d8d3d6cb79254f60699e375d6e465182c81932fd96a6
Opcode Fuzzy Hash: 260e99790875a3a6d0222eff38f845ec93f97fc36e25a8e6096e2201381829fb
Instruction Fuzzy Hash: B5F27D72A09AC589EB709F25DC847EDA7A0FB04798F804239DE5D4BB99DF39D684C310

Function 00007FF70F45A720 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cef72b22e4d19156e561759b4d10000aa1cc968812c31fbe5988ad80f94c8d1
Instruction ID: c2eaf040e86e17d4858a8df0aafe998de95b92907972e546470ffdb1094acd25
Opcode Fuzzy Hash: 4cef72b22e4d19156e561759b4d10000aa1cc968812c31fbe5988ad80f94c8d1
Instruction Fuzzy Hash: 9B71E452F0C69289FB14AE65C8513FD6AA0FB00B98F848635FE4A5B7C6DB3CD584D360

Function 00007FF70F460A60 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

0123456789abcdefEscapeDefaultLazyCell instance has previously been poisoned, xrefs: 00007FF70F460AE8, 00007FF70F460BF9

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0123456789abcdefEscapeDefaultLazyCell instance has previously been poisoned
API String ID: 0-1662314993
Opcode ID: ce129eea82a5773546ab9bb1bb95a6a4ab5bb87c964788a9a2a8996caa8f998f
Instruction ID: 31d3d69699102d4aa00f7af511d9975c75a7bd3ebc60cf7a836f805820ba9e81
Opcode Fuzzy Hash: ce129eea82a5773546ab9bb1bb95a6a4ab5bb87c964788a9a2a8996caa8f998f
Instruction Fuzzy Hash: F551FDA3B1D6E09EE3219B785800EAC7F61DF25B48F458094DFD81BF86C71AC125E762

Function 00007FF70F471DE0 Relevance: .9, Instructions: 902COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79eea7e14952c435f9e48caf5a4592601fe8f200401c404bcf0d96280b45300
Instruction ID: a9fffcad6114cd950049dab8ee4ed19c00231c73bd78a48bfa1115a4ffd749aa
Opcode Fuzzy Hash: e79eea7e14952c435f9e48caf5a4592601fe8f200401c404bcf0d96280b45300
Instruction Fuzzy Hash: 8E525662E1D3E205FA35E5385C407F8D642EF52390FD95232FD6E527D0EBAD6B824A20

Function 00007FF70F4400F0 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c23c50ce23e3f427833cf16a1b5d3efd5c251715c2f7443491d3bb8936a71eb
Instruction ID: e1962c10668659d23cee3b2006379f3f0c26b1e9c7e54a1d912a2cf325332a3b
Opcode Fuzzy Hash: 9c23c50ce23e3f427833cf16a1b5d3efd5c251715c2f7443491d3bb8936a71eb
Instruction Fuzzy Hash: EC62C162B0D6D585EB00EB6598046FCAB61EF04B98FC44636EE1E23784DFBCE561C320

Function 00007FF70F402F70 Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088d01ea7b818e82ae0e465cb05098dbad57e0dfda04c8d218ac0d531cb9ed1c
Instruction ID: 9c0cd2153a0c59968c8a9fc6201a44a02595ca0c9d34927d7efcac1b9ad635a1
Opcode Fuzzy Hash: 088d01ea7b818e82ae0e465cb05098dbad57e0dfda04c8d218ac0d531cb9ed1c
Instruction Fuzzy Hash: 46627872A08BD589E770DF25D8847E97BA0FB48B98F404126EE4D4BB98DF39D694C310

Function 00007FF70F44A201 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ba6b2ee9432dbcb582c866eeb92629a4739c523624d79952bf43c2ea0c2cf4
Instruction ID: a9c09bf38aa3ec246e4f495f10d95b88e8ee848a1e839d336029c78c3ce34990
Opcode Fuzzy Hash: b2ba6b2ee9432dbcb582c866eeb92629a4739c523624d79952bf43c2ea0c2cf4
Instruction Fuzzy Hash: F012ADA169D0F382F3343E74B921FBAEE52CB09B4AEA56036DF841AD84D75F61116730

Function 00007FF70F407C90 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac1644be994b2008b9507c2a112c6d1cca9c5905923dfa80e38dae0321dd185
Instruction ID: 1093279fadb3c598beaefcb44b16a3bd830c1c886b6b43897000ddc6b6f18832
Opcode Fuzzy Hash: 1ac1644be994b2008b9507c2a112c6d1cca9c5905923dfa80e38dae0321dd185
Instruction Fuzzy Hash: 2502B122A0CA9185EB20AF21D9453FDA7A0FF14798F859535EE5D97785DF3CE880C3A0

Function 00007FF70F414B00 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bd6cb28c9cf921f82a9385d27c6c107906c4dc51212d9218a1969212ac48b9
Instruction ID: 8fa55dfccc2ab743a5834e798fb7229edfad07c48209dc27b89daccb70f89b00
Opcode Fuzzy Hash: c9bd6cb28c9cf921f82a9385d27c6c107906c4dc51212d9218a1969212ac48b9
Instruction Fuzzy Hash: A6D11666E0CAD649FB65DB3199007FCA7A1FF52784FA84032EE4C027A5DF2D9696C310

Function 00007FF70F41FA40 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276af54ac35376f355405623fda501c5a95cd9834a0011fe8c04c80267c5d4ee
Instruction ID: 27621794b5b41f8766d6ec5cd5c29d8fe7d759e610da2d7e023b939d04d5e00d
Opcode Fuzzy Hash: 276af54ac35376f355405623fda501c5a95cd9834a0011fe8c04c80267c5d4ee
Instruction Fuzzy Hash: F4C13462A1CEC241FB219B21E9103BAD661FF507A8FA45131EE5F077E1DF3CE54A8220

Function 00007FF70F43DDE0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2391fcff58295486b5c77dacc39d25c59dd47d580bbfa1c560fcdb2b1b503f3f
Instruction ID: ff09abbad0c88471242b294ebec40bfe8ed429d0afcb769a0fb38a7ae3cd1476
Opcode Fuzzy Hash: 2391fcff58295486b5c77dacc39d25c59dd47d580bbfa1c560fcdb2b1b503f3f
Instruction Fuzzy Hash: D8A11363E1E5E146DA55AB209C04BFDAE61FF117E8F848730EF6A027C1DB289515C320

Function 00007FF70F3E6D40 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7191586639faf1472745bd02a8886c22bcfddd707bdc4bce52a4501d4da04029
Instruction ID: a6f2cd7830ce2b873a4acf3b2467b1de76bb7611ee47373d6d9cc5237bc6b1a9
Opcode Fuzzy Hash: 7191586639faf1472745bd02a8886c22bcfddd707bdc4bce52a4501d4da04029
Instruction Fuzzy Hash: 9891C263F04DE493E751CF29D6006986320F368BD8B865322DF6E63661EB35E6DAC301

Function 00007FF70F3F8560 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59002f19bbe7329ee2683b23cb79ae257e9f334858e3aca97105888bf1c9d62
Instruction ID: fb77b937058cccc43c19c07aeacaee3a726ae620942a34c6d0df2eea5049a815
Opcode Fuzzy Hash: b59002f19bbe7329ee2683b23cb79ae257e9f334858e3aca97105888bf1c9d62
Instruction Fuzzy Hash: 55A14863B187D181FB148B248D007ADFFA0FB01B98FA15529CE5E2B790DB75C95AC320

Function 00007FF70F41D0B0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72bde67c17ac2c503c243f66f270e746bb435663731e1d3efa0356253e4338fc
Instruction ID: c8ddce04d462e49d88d898afbd26a7437dc0cbd6ff41bc0b9290ca91c6fe5bcc
Opcode Fuzzy Hash: 72bde67c17ac2c503c243f66f270e746bb435663731e1d3efa0356253e4338fc
Instruction Fuzzy Hash: D561E292E0DAE248F3519A684C002FEAFB2FF55744FA88171ED6A263D5CB7DD506D220

Function 00007FF70F3FE0E0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56a457bf8a6bf748509232b8b5f8dcd167b2be65c2dda2d57c16cdca08a8318
Instruction ID: bd5b0003903c549051e33f65e307f6e47a37022c9952d9f09b14ddedb9340be9
Opcode Fuzzy Hash: f56a457bf8a6bf748509232b8b5f8dcd167b2be65c2dda2d57c16cdca08a8318
Instruction Fuzzy Hash: F371D162F0869186EF24AB6699043FDA3A1FF047B8F548335DE7D1BBE5DB3C91858210

Function 00007FF70F3E2EF4 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a344495589f072a6ac212e1747d588018d1b9a133686b270a88e5cd7764f9b44
Instruction ID: 6d8d99595b0558aa99a579fa97181a861b68cb61a8516e7f24f7219bfc075f27
Opcode Fuzzy Hash: a344495589f072a6ac212e1747d588018d1b9a133686b270a88e5cd7764f9b44
Instruction Fuzzy Hash: 65518D1371E6C59DEB119A34C8013E99F11EF163A8F44C638EA590FBCACB2CD656D361

Function 00007FF70F43BF20 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4b5aaaee95637960a634f8f5c0b021c11b7ab42145f193b07c717f66579e7b
Instruction ID: 7845894eae2eaf1a6bcb30dda0f1ad1cdc95d3341da96e1279c69f87fad27713
Opcode Fuzzy Hash: 2a4b5aaaee95637960a634f8f5c0b021c11b7ab42145f193b07c717f66579e7b
Instruction Fuzzy Hash: CB118CF2E384A409FA60833C6C01F68AC85CFA23BCB989774E579C09D6E61DE1039650

Function 00007FF70F418FE0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 272synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F419062
CloseHandle.KERNEL32 ref: 00007FF70F419144
WaitForSingleObject.KERNEL32 ref: 00007FF70F419151
GetLastError.KERNEL32 ref: 00007FF70F41915A
CloseHandle.KERNEL32 ref: 00007FF70F4191D9
CloseHandle.KERNEL32 ref: 00007FF70F4191E2
CloseHandle.KERNEL32 ref: 00007FF70F4192D9
CloseHandle.KERNEL32 ref: 00007FF70F41931F
CloseHandle.KERNEL32 ref: 00007FF70F419328

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70F4190E5, 00007FF70F41923E, 00007FF70F41926C

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1454876536-2333694755
Opcode ID: 8d72f280f28c7bcd1a6a19a771e24cadde8face6f91cd2850add88366a434be2
Instruction ID: 142e77b37411ba1f3c4b5e7eeb24d91035be9689d51d2197fc94ac4b35ea2ef1
Opcode Fuzzy Hash: 8d72f280f28c7bcd1a6a19a771e24cadde8face6f91cd2850add88366a434be2
Instruction Fuzzy Hash: ECC10232A08B8299FB15AF61D8503ECA7A0FF44B98F944035EE4D16B99DF3DE585C360

Function 00007FF70F42EA90 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 278libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F42EB99
GetFullPathNameW.KERNEL32 ref: 00007FF70F42EBAE
GetLastError.KERNEL32 ref: 00007FF70F42EBB9
GetLastError.KERNEL32 ref: 00007FF70F42EBD2
memcmp.MSVCRT ref: 00007FF70F42EC57
GetLastError.KERNEL32 ref: 00007FF70F42EC91
memcpy.MSVCRT ref: 00007FF70F42ED50
GetModuleHandleA.KERNEL32 ref: 00007FF70F42EEE9
GetProcAddress.KERNEL32 ref: 00007FF70F42EEFD

Strings

kernel32, xrefs: 00007FF70F42EEE2
SetThreadDescription, xrefs: 00007FF70F42EEF3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$AddressFullHandleModuleNamePathProcmemcmpmemcpy
String ID: SetThreadDescription$kernel32
API String ID: 1783792165-1950310818
Opcode ID: cd4d371d6e41d6b67d9901ec7c1097834a0f6306f72e300efe921d0761ca8f85
Instruction ID: 3699cf5b8bafbbfc1385b6363e8a42c4c78083db7ca0106274a51eacb1163433
Opcode Fuzzy Hash: cd4d371d6e41d6b67d9901ec7c1097834a0f6306f72e300efe921d0761ca8f85
Instruction Fuzzy Hash: 1FB17B62A0CBC285EAA5AB52DC443F9A655FF44BD8FC48036EE0D1B799DF7CD2418320

Function 00007FF70F406800 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 416COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F4068F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF70F406903
GetLastError.KERNEL32 ref: 00007FF70F40690F
GetLastError.KERNEL32 ref: 00007FF70F406928
GetLastError.KERNEL32 ref: 00007FF70F4069C6
GetEnvironmentStringsW.KERNEL32 ref: 00007FF70F406A6B
GetLastError.KERNEL32 ref: 00007FF70F406A7F

Part of subcall function 00007FF70F47A710: RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
Part of subcall function 00007FF70F47A710: RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7B2
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7D0

Strings

innerVarsOs, xrefs: 00007FF70F406E5C
Vars, xrefs: 00007FF70F406E2F
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70F406D4A, 00007FF70F406D93

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$abort$CaptureContextCurrentDirectoryEnvironmentStringsUnwind
String ID: Vars$called `Result::unwrap()` on an `Err` value$innerVarsOs
API String ID: 3881678180-2235028769
Opcode ID: 96b1335f5b32f101478d561b800188ba29d55fe3156f7b97aa49703dc8248d7f
Instruction ID: b86e17026c4c6bd8d3b3abc6020fa73169f07d8d14fdfa2a5e4802a6856b5035
Opcode Fuzzy Hash: 96b1335f5b32f101478d561b800188ba29d55fe3156f7b97aa49703dc8248d7f
Instruction Fuzzy Hash: 4AF1AD62B0CBD295EB20AF61AC007EDA764EF04798F854135EE5E57789DF3CA2958320

Function 00007FF70F47A4B0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF70F47A57E
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F42F82B), ref: 00007FF70F47A584
RtlUnwindEx.KERNEL32 ref: 00007FF70F47A69D

Strings

CCG", xrefs: 00007FF70F47A50C
CCG , xrefs: 00007FF70F47A517
CCG!, xrefs: 00007FF70F47A571
CCG!, xrefs: 00007FF70F47A4DA

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: d7458593ed016e15f108b0752e0878859867d2482da7015a35ba818092dafa03
Instruction ID: 11a8b6b3655e25e20051ce53f329cfeaac652fc680d4e14383c2f5694986143b
Opcode Fuzzy Hash: d7458593ed016e15f108b0752e0878859867d2482da7015a35ba818092dafa03
Instruction Fuzzy Hash: 72518D72A08B8186E760DB15E8446EEB360FB89B98F945235FE8D13768DF3DD581C710

Function 00007FF70F430AA0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 373COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F430C64
GetFullPathNameW.KERNEL32 ref: 00007FF70F430C80
GetLastError.KERNEL32 ref: 00007FF70F430C8B
GetLastError.KERNEL32 ref: 00007FF70F430CA4

Strings

\\?\, xrefs: 00007FF70F430DC6
\\?\UNC\, xrefs: 00007FF70F430E18

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 574c90cc17c4e5e0089f6e35e100d8dcf8653053bf5093b5489737decace2362
Instruction ID: e02f55d319ce751c60c2171035fb0ae444ff569212bb1db0c1d9a831450fd332
Opcode Fuzzy Hash: 574c90cc17c4e5e0089f6e35e100d8dcf8653053bf5093b5489737decace2362
Instruction Fuzzy Hash: A1F18362A0C6D585EB70AB59D8443FDA295FF04BDCF904236EE1D4B6C4DF78E6818321

Function 00007FF70F42C502 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF70F42C519
DuplicateHandle.KERNEL32 ref: 00007FF70F42C543
GetLastError.KERNEL32 ref: 00007FF70F42C673
CloseHandle.KERNEL32 ref: 00007FF70F42C6AD
CloseHandle.KERNEL32 ref: 00007FF70F42C8FE

Strings

failed to spawn thread, xrefs: 00007FF70F42C99D
cannot access a Thread Local Storage value during or after destructionstd\src\thread\local.rs, xrefs: 00007FF70F42C9CA
RUST_MIN_STACK, xrefs: 00007FF70F42C6EC

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Handle$Close$CurrentDuplicateErrorLastProcess
String ID: RUST_MIN_STACK$cannot access a Thread Local Storage value during or after destructionstd\src\thread\local.rs$failed to spawn thread
API String ID: 1869159801-1031612558
Opcode ID: 52ceb6003914d7c4914798aef6aaaf87333fc5939290e0dad8a70ac64554a24e
Instruction ID: 15f1e41a43c1ed20f710b8f0836cf3644a9de4c9a3d6a27accfcfc4c57169072
Opcode Fuzzy Hash: 52ceb6003914d7c4914798aef6aaaf87333fc5939290e0dad8a70ac64554a24e
Instruction Fuzzy Hash: 71B15B62A0DA8285E751AB20DC413FDB7A0EF547A8FC04536EE4D1779ADF3CE58583A0

Function 00007FF70F431F90 Relevance: 12.7, APIs: 10, Instructions: 161COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF70F431FE0
TlsSetValue.KERNEL32 ref: 00007FF70F431FF1
TlsGetValue.KERNEL32 ref: 00007FF70F432040
TlsSetValue.KERNEL32 ref: 00007FF70F432051
TlsGetValue.KERNEL32 ref: 00007FF70F4320A0
TlsSetValue.KERNEL32 ref: 00007FF70F4320B1
TlsGetValue.KERNEL32 ref: 00007FF70F432100
TlsSetValue.KERNEL32 ref: 00007FF70F432111
TlsGetValue.KERNEL32 ref: 00007FF70F43214C
TlsSetValue.KERNEL32 ref: 00007FF70F43215D

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 56c0f6e2aee182e61da4df6a185e34a4d52c54897c76fcda9e3af97f166bb8d8
Instruction ID: 41bd9f30085b94866a2cc433861a4162592b43eb1498efda067ba4f3b9593ccc
Opcode Fuzzy Hash: 56c0f6e2aee182e61da4df6a185e34a4d52c54897c76fcda9e3af97f166bb8d8
Instruction Fuzzy Hash: 55516D21F0E6D256FA56BB114E103F9E7A1EF95BC0F8C8035EE0C57786DF6CA9418264

Function 00007FF70F47AD20 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF70F47AE3B

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF70F47AEAE
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF70F47AED1
Mingw-w64 runtime failure:, xrefs: 00007FF70F47AD57
Address %p has no image-section, xrefs: 00007FF70F47AD92, 00007FF70F47AEE5

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 6b5c3ae77c03273f21c1cb82adcd5cdeef0e6daab64777e011a6f5b602d1a484
Instruction ID: ca21ca32607c99be0e18e0b955e8884ffabed1cc5f87fd8da5c63d59603dd2e6
Opcode Fuzzy Hash: 6b5c3ae77c03273f21c1cb82adcd5cdeef0e6daab64777e011a6f5b602d1a484
Instruction Fuzzy Hash: 9B517B62A0CB8682EA10EB51EC406E9F760FF98B94F844131EE4C177A9DF3CE446C760

Function 00007FF70F41C000 Relevance: 12.1, APIs: 8, Instructions: 144fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F41C04F

Part of subcall function 00007FF70F426A00: ReadFileEx.KERNEL32 ref: 00007FF70F426A48
Part of subcall function 00007FF70F426A00: SleepEx.KERNEL32 ref: 00007FF70F426A6A

WriteFileEx.KERNEL32 ref: 00007FF70F41C0F8
SleepEx.KERNEL32 ref: 00007FF70F41C11A
GetLastError.KERNEL32 ref: 00007FF70F41C148
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F3E3625,?,?,?,?,?), ref: 00007FF70F41C154
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F3E3625,?,?,?,?,?), ref: 00007FF70F41C15C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F3E3625,?,?,?,?,?), ref: 00007FF70F41C244
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F3E3625,?,?,?,?,?), ref: 00007FF70F41C24C

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$FileSleep$ErrorLastReadWritememset
String ID:
API String ID: 3673338832-0
Opcode ID: e52f2a1764aa238fb1dbfc6f9750715354cb54e67f274e2a414de41ba221774f
Instruction ID: 9e63391db540e302daeba1209bfab14ce6002b7f3438275dcdc781a114d9cd44
Opcode Fuzzy Hash: e52f2a1764aa238fb1dbfc6f9750715354cb54e67f274e2a414de41ba221774f
Instruction Fuzzy Hash: 17515A22A4CAC285EA35AB25DC417FDA760FF457C8F948032EE1D1BB89CF3DA5429750

Function 00007FF70F414470 Relevance: 12.1, APIs: 8, Instructions: 70networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F414494
WSASocketW.WS2_32 ref: 00007FF70F4144D5
WSAGetLastError.WS2_32 ref: 00007FF70F4144E7
WSASocketW.WS2_32 ref: 00007FF70F41451A
SetHandleInformation.KERNEL32 ref: 00007FF70F414533
GetLastError.KERNEL32 ref: 00007FF70F41453C
closesocket.WS2_32 ref: 00007FF70F414546
WSAGetLastError.WS2_32 ref: 00007FF70F41454F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocketmemset
String ID:
API String ID: 3407399761-0
Opcode ID: 140b85e330145a5fbd53759121481a4a4443c71e07aa3ac1224e103824d8c2c0
Instruction ID: ef125031fb9b8e408e18239c63001b967a4fcab7203b1bf3202ee7ff5d92e489
Opcode Fuzzy Hash: 140b85e330145a5fbd53759121481a4a4443c71e07aa3ac1224e103824d8c2c0
Instruction Fuzzy Hash: 4F219121A0C5D18AF720FA65C9043ED6650EF453B4FA44330FE2C57BE9DF2CA9468760

Function 00007FF70F41A2F0 Relevance: 10.9, APIs: 7, Instructions: 445COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,00007FF70F3E34EA), ref: 00007FF70F41A412

Part of subcall function 00007FF70F455A75: memcpy.MSVCRT ref: 00007FF70F455BFF

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F41A5B1
memset.MSVCRT ref: 00007FF70F41A7B3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressSingleWake$memcpymemset
String ID:
API String ID: 1221183280-0
Opcode ID: c98d944e47c1db278127765e89b4a58d2ef7c878acf41f52b467c5e436d244b6
Instruction ID: 59cdaff7c3d6a63baf45f1666ec71e8339ea567662500237229251af4b70a1d5
Opcode Fuzzy Hash: c98d944e47c1db278127765e89b4a58d2ef7c878acf41f52b467c5e436d244b6
Instruction Fuzzy Hash: DD127B22E0CAC685FB11EB64EC413F9A7A0EF94758F948135EE4D467A2DF3CA585C360

Function 00007FF70F407060 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F4071E9
GetEnvironmentVariableW.KERNEL32 ref: 00007FF70F4071FB
GetLastError.KERNEL32 ref: 00007FF70F407207
GetLastError.KERNEL32 ref: 00007FF70F407220

Strings

environment variable not foundenvironment variable was not valid unicode: , xrefs: 00007FF70F4074AD

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: environment variable not foundenvironment variable was not valid unicode:
API String ID: 2691138088-3632183283
Opcode ID: 757dab13e25a7c8ddd6506cf2420c1fe1d395597a0a294d95c5351c0eeb6cab5
Instruction ID: bb7158503f1361b670dca489f4a1310f9c05c74afb954875b5d516f157b90503
Opcode Fuzzy Hash: 757dab13e25a7c8ddd6506cf2420c1fe1d395597a0a294d95c5351c0eeb6cab5
Instruction Fuzzy Hash: EAB17162B08BC285EB24AB25DC443EDA364FF45B98F844139EE1C5B789DF3DE2818351

Function 00007FF70F42E660 Relevance: 10.7, APIs: 7, Instructions: 249COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F42E769
GetFullPathNameW.KERNEL32 ref: 00007FF70F42E77E
GetLastError.KERNEL32 ref: 00007FF70F42E789
GetLastError.KERNEL32 ref: 00007FF70F42E7A2
memcmp.MSVCRT ref: 00007FF70F42E820
GetLastError.KERNEL32 ref: 00007FF70F42E85A
memcpy.MSVCRT ref: 00007FF70F42E919

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcmpmemcpy
String ID:
API String ID: 2015650653-0
Opcode ID: 6ec72101eed3a8b9d1e05b762d31c4b4c24d2468d9e7dbc6369698527e32f3da
Instruction ID: 2fb0166b65f989cd32695b06c293d5fe5c891279cdf498c1ea321e770af42261
Opcode Fuzzy Hash: 6ec72101eed3a8b9d1e05b762d31c4b4c24d2468d9e7dbc6369698527e32f3da
Instruction Fuzzy Hash: C5A15D62A0C7D245EAA5AB11DC443F9A255FF44BD8FD48036EE4D5B79ADF3CD2418320

Function 00007FF70F412370 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32 ref: 00007FF70F4123E3
freeaddrinfo.WS2_32 ref: 00007FF70F4125D7
freeaddrinfo.WS2_32 ref: 00007FF70F41269F

Strings

, xrefs: 00007FF70F4125A4
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70F4124AB, 00007FF70F41265D
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70F41262C, 00007FF70F412672

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: freeaddrinfo
String ID: $assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 2731292433-2757504381
Opcode ID: b2126607e93d647e9f91e76f4849ef41876095a8296fa520854c0728ff80945c
Instruction ID: 2c74b1c24be5979ec6b21028073a32a417f78b7813b79e9d2788f4cb7d2d2739
Opcode Fuzzy Hash: b2126607e93d647e9f91e76f4849ef41876095a8296fa520854c0728ff80945c
Instruction Fuzzy Hash: DDA19F72A08A918AE714EF51E8406EDBBB0FB88B54FA58039EE0D53794DF78D941C750

Function 00007FF70F432730 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 188networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF70F4327B9

Strings

addr, xrefs: 00007FF70F432911
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70F432820
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70F432838
peerTcpListenerUdpSocket.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF70F4329AB
TcpStream, xrefs: 00007FF70F432878

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID: TcpStream$addr$assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs$peerTcpListenerUdpSocket.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs
API String ID: 1452528299-1411357719
Opcode ID: 5a2e41fcac08ccb2f5ed9207fd46638074952570b4c48c36a9c3ef2ce86c36f3
Instruction ID: aff5815fe821ab5f8a37ce4c7037fe08aeb3a3b97cd2f1f328aa7db3d59236b8
Opcode Fuzzy Hash: 5a2e41fcac08ccb2f5ed9207fd46638074952570b4c48c36a9c3ef2ce86c36f3
Instruction Fuzzy Hash: 3F915E21A1C69284FB25AF64E8412FCA370FF45798F849136EE4D17795EF3CA286C360

Function 00007FF70F425E10 Relevance: 10.7, APIs: 7, Instructions: 185COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F425F08
GetModuleFileNameW.KERNEL32 ref: 00007FF70F425F15
GetLastError.KERNEL32 ref: 00007FF70F425F21
GetLastError.KERNEL32 ref: 00007FF70F425F3A
GetLastError.KERNEL32 ref: 00007FF70F425FD6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF70F4260BA
GetLastError.KERNEL32 ref: 00007FF70F4260EA

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CurrentDirectoryFileModuleName
String ID:
API String ID: 1505103792-0
Opcode ID: 4813931b110c6182fb8258efcf567a37ceb1165433f20795709e4602d9828197
Instruction ID: 3d18c3d00f1c401da96375d943189d48b014d8177b4770012305c21d7fab8e76
Opcode Fuzzy Hash: 4813931b110c6182fb8258efcf567a37ceb1165433f20795709e4602d9828197
Instruction Fuzzy Hash: 7B719C62B0C6D245EB61AB25DC043FDA265FF14BD8F848135EE0C5B689DF2CA2818310

Function 00007FF70F419DD0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F419E50
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F419E74
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F419EDA
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F419EF5
GetLastError.KERNEL32 ref: 00007FF70F419EFF

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70F419F2C, 00007FF70F419FC6

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Address$Wake$Single$ErrorLastWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 798958160-2333694755
Opcode ID: e2c6ed504ba8107884ec7595559c41f4a93c5bc78c5009b79800c88f58580a1a
Instruction ID: 0e3c69435e457a45feade90fcadf0eb7905485f8c344b73c267567bab24bbc74
Opcode Fuzzy Hash: e2c6ed504ba8107884ec7595559c41f4a93c5bc78c5009b79800c88f58580a1a
Instruction Fuzzy Hash: C9516222A0CAD255FA21AF61AC502FAA7A0FF05754F944536FEAD077D2DF2CE145C360

Function 00007FF70F405CF0 Relevance: 9.2, APIs: 6, Instructions: 184COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F405D73
RtlCaptureContext.KERNEL32 ref: 00007FF70F405D7B
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF70F405D9F
RtlVirtualUnwind.KERNEL32 ref: 00007FF70F405F26
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F40600E

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressCaptureContextEntryFunctionLookupSingleUnwindVirtualWakememset
String ID:
API String ID: 2014759167-0
Opcode ID: 8fecb2d7b38c102e24f7d548581241a1708a972fe1595f8de14360d101d8d413
Instruction ID: d37f73e4888a732ab5be561d03351bd6da88edfa9875fe158039e13be61a5e3c
Opcode Fuzzy Hash: 8fecb2d7b38c102e24f7d548581241a1708a972fe1595f8de14360d101d8d413
Instruction Fuzzy Hash: 1B912C62A09BC188EB70EF24DD403E973A4FF44798F844139EE8D5BB99EF3895848754

Function 00007FF70F4229B0 Relevance: 9.2, APIs: 6, Instructions: 178COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F422AA9
GetFinalPathNameByHandleW.KERNEL32 ref: 00007FF70F422ABE
GetLastError.KERNEL32 ref: 00007FF70F422AC9
GetLastError.KERNEL32 ref: 00007FF70F422AE2
GetLastError.KERNEL32 ref: 00007FF70F422B7E
CloseHandle.KERNEL32 ref: 00007FF70F422C92

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$Handle$CloseFinalNamePath
String ID:
API String ID: 3328380333-0
Opcode ID: cce2e92626dcaf6cbdcd668c325d07161b7a85dd1c0f94e95153eae62401de72
Instruction ID: a4f110de9cc54e82fb104eb6378eb967117cfb7d1c7c02cd1e6e3502a603379f
Opcode Fuzzy Hash: cce2e92626dcaf6cbdcd668c325d07161b7a85dd1c0f94e95153eae62401de72
Instruction Fuzzy Hash: 19717C62A0CBC249FB65AF25DC443EDA664EF44BD8F808131EE4C5BB96DF7C93858210

Function 00007FF70F426BF0 Relevance: 9.2, APIs: 6, Instructions: 162COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F426C2D
GetOverlappedResult.KERNEL32 ref: 00007FF70F426CFD

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandleOverlappedResult
String ID:
API String ID: 1555921936-0
Opcode ID: dfbb019512cb01cfff0d376b161d343788e31632958b41f29bd11ca82096159d
Instruction ID: 15c40e04739cd8c0d5d3c776d6ab4bca294e8e70c846c286aac90f8c5bb8dd90
Opcode Fuzzy Hash: dfbb019512cb01cfff0d376b161d343788e31632958b41f29bd11ca82096159d
Instruction Fuzzy Hash: D3617E32E0C6C589FB90AA65CC413FCABA0EF14798FD50435EE0D56B99DF28E59583A0

Function 00007FF70F42BC01 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42BCA4
CloseHandle.KERNEL32 ref: 00007FF70F42BCEB
CloseHandle.KERNEL32 ref: 00007FF70F42BD52
CloseHandle.KERNEL32 ref: 00007FF70F42BD67
CloseHandle.KERNEL32 ref: 00007FF70F42C224

Strings

program path has no file name, xrefs: 00007FF70F42C290

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name
API String ID: 2962429428-697003637
Opcode ID: b645622684179f8fa3b2ecf66bb67c7c8431540330c75a7dd647d430661c3de5
Instruction ID: 3b7b9e6d1bf8889a3f93749d66be34549e34b8bb5fb95b3c7e169cda8d784750
Opcode Fuzzy Hash: b645622684179f8fa3b2ecf66bb67c7c8431540330c75a7dd647d430661c3de5
Instruction Fuzzy Hash: 72516E62A0D6C285EAA0BA62DC417FDA360FF55B98FC00436EE0D47795CF3DE5418261

Function 00007FF70F424550 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF70F4245A0
WSASocketW.WS2_32 ref: 00007FF70F4245D0
SetHandleInformation.KERNEL32 ref: 00007FF70F4245EB
GetLastError.KERNEL32 ref: 00007FF70F4245F4
closesocket.WS2_32 ref: 00007FF70F424606
WSAGetLastError.WS2_32 ref: 00007FF70F424615

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$HandleInformationSocketclosesocket
String ID:
API String ID: 1159780279-0
Opcode ID: b938f4549eabdc51a0458d546100953ac200c90f34d34bb03aece01258d68e6c
Instruction ID: b2e5a409f7801fc9a278169ecaced5f7f38fe8fbece04473b092c0ee076d9bd8
Opcode Fuzzy Hash: b938f4549eabdc51a0458d546100953ac200c90f34d34bb03aece01258d68e6c
Instruction Fuzzy Hash: 7D119D21F0C1E146F760A9799805BAA9580EF843B8F984730FE6C47BE6DF7D98864A10

Function 00007FF70F404D60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70F438780: TlsGetValue.KERNEL32 ref: 00007FF70F4387A2
Part of subcall function 00007FF70F438780: TlsGetValue.KERNEL32 ref: 00007FF70F438803
Part of subcall function 00007FF70F438780: TlsSetValue.KERNEL32 ref: 00007FF70F438813

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F404E5E
GetLastError.KERNEL32 ref: 00007FF70F404E68
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF70F404F81
GetLastError.KERNEL32 ref: 00007FF70F404F8B

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 00007FF70F404E6F, 00007FF70F404FB1

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Value$AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1881407604-459553403
Opcode ID: fbf02877470affe050ffdbb8edb95464c21b913d93ddea9765e51dac9e51792e
Instruction ID: c50a2724b3f84e817999b6b02fa831d3b2481d3ec298cb5e652a98130d7e2247
Opcode Fuzzy Hash: fbf02877470affe050ffdbb8edb95464c21b913d93ddea9765e51dac9e51792e
Instruction Fuzzy Hash: E4519E22F0CA8299EB15BB609C012FDA664EF90754F888136FF0D57BE5DF3CA5428360

Function 00007FF70F432B40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 148networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF70F432BC9

Strings

TcpListenerUdpSocket.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF70F432C88
addr, xrefs: 00007FF70F432D21
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70F432C30
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70F432C48

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID: TcpListenerUdpSocket.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs$addr$assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 1452528299-1398425720
Opcode ID: c9fb1dc49f0c6a3f39c471d5885720b195e0b6d05b32bbbf8232a37ce6ef8813
Instruction ID: de66ece0223fc17364dc6ab3a6bc26693146b4eec3c5ef0856c546f2d1a73384
Opcode Fuzzy Hash: c9fb1dc49f0c6a3f39c471d5885720b195e0b6d05b32bbbf8232a37ce6ef8813
Instruction Fuzzy Hash: F9616D22A186D289F721AF64E8412FDB370EF44758F848136EE4D17795EF3CA686C361

Function 00007FF70F41C4D0 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F41C540
memcpy.MSVCRT ref: 00007FF70F41C5EF

Strings

PATHstd\src\sys_common\process.rs, xrefs: 00007FF70F41C58D, 00007FF70F41C78A
assertion failed: self.height > 0, xrefs: 00007FF70F41CC8F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: PATHstd\src\sys_common\process.rs$assertion failed: self.height > 0
API String ID: 3510742995-122754119
Opcode ID: 954c6353572963fa527ae682fe59735aeb8cddd5bd717976e8cd1ae11293ecb5
Instruction ID: 0204258b8508f7aa08527099c5baee8323eddc890a16b3d11f13dc79a2db87ae
Opcode Fuzzy Hash: 954c6353572963fa527ae682fe59735aeb8cddd5bd717976e8cd1ae11293ecb5
Instruction Fuzzy Hash: 89229122A08AD184E722AF25DC413F9B7A0FF54B98F544135EF4D1BB96EF389295C350

Function 00007FF70F4205B0 Relevance: 7.7, APIs: 5, Instructions: 180COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70F4207DB
GetLastError.KERNEL32 ref: 00007FF70F4207F7

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d2ba8f167fe8e9c4f7cfaa7e353470eb4328f6a9ab1888e480ecfba10196ba5c
Instruction ID: 9af91e95a29785feba6832661dc0f3de91235145933d643a4a0f51a72dc0ef75
Opcode Fuzzy Hash: d2ba8f167fe8e9c4f7cfaa7e353470eb4328f6a9ab1888e480ecfba10196ba5c
Instruction Fuzzy Hash: 4961B191E0C2D245FBA1AA29CD043F99AE0EF85BD8FD44531ED4D07BD9DB2DE8468720

Function 00007FF70F428CA7 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F428BF0
SetLastError.KERNEL32 ref: 00007FF70F429FF6
GetSystemDirectoryW.KERNEL32 ref: 00007FF70F42A001
GetLastError.KERNEL32 ref: 00007FF70F42A00C
GetLastError.KERNEL32 ref: 00007FF70F42A020
CloseHandle.KERNEL32 ref: 00007FF70F42BCA4
CloseHandle.KERNEL32 ref: 00007FF70F42BCEB
CloseHandle.KERNEL32 ref: 00007FF70F42BD52
CloseHandle.KERNEL32 ref: 00007FF70F42BD67

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$ErrorLast$DirectorySystem
String ID:
API String ID: 768002510-0
Opcode ID: 0a4ca29d2f8a300a0a0d543ad49635f68eddb652e0a2c4f9f13c6ad2c7ec1f2c
Instruction ID: daf257e4a43c2308686cb5eb2d2250999e110ef90cf45f7d46bbb90b86a5fd15
Opcode Fuzzy Hash: 0a4ca29d2f8a300a0a0d543ad49635f68eddb652e0a2c4f9f13c6ad2c7ec1f2c
Instruction Fuzzy Hash: B0814D22608ED185EBB0AE25DC543EE6390FF04799F801136EE1D9BBD9EF399645C710

Function 00007FF70F3F2940 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F3F29CE
memcpy.MSVCRT ref: 00007FF70F3F2A05

Strings

assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF70F3F32D3
assertion failed: old_left_len + count <= CAPACITY, xrefs: 00007FF70F3F24F2
assertion failed: new_left_len <= CAPACITY, xrefs: 00007FF70F3F2907, 00007FF70F3F2D03

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY$assertion failed: old_left_len + count <= CAPACITY
API String ID: 3510742995-3535459961
Opcode ID: 4f9eca0a564fd9a118a8043acdcfae24573531f22f77b14d8c68785833c78f72
Instruction ID: 3fa98a36a06381a630d7a2d8a483d536444ddf5abfa8a77e35cc373f90f40a76
Opcode Fuzzy Hash: 4f9eca0a564fd9a118a8043acdcfae24573531f22f77b14d8c68785833c78f72
Instruction Fuzzy Hash: 14815D32A08BC585E7119F29DC403E973A5FF58798F508225DE8C1B769EF39D296C310

Function 00007FF70F42BCE5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42BCEB
CloseHandle.KERNEL32 ref: 00007FF70F42BD52
CloseHandle.KERNEL32 ref: 00007FF70F42BD67
CloseHandle.KERNEL32 ref: 00007FF70F42C224

Strings

program path has no file name, xrefs: 00007FF70F42C290

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name
API String ID: 2962429428-697003637
Opcode ID: 535f240628111b7be1e2573215e3df11fe582b422e1dfdffbf04f894117b0853
Instruction ID: f8ac87067edb4ff779008304f87b191255bc57fc212395682a72412a5586d78d
Opcode Fuzzy Hash: 535f240628111b7be1e2573215e3df11fe582b422e1dfdffbf04f894117b0853
Instruction Fuzzy Hash: 84518062A0C6D284EAA0BA62DC847FDA360FF55B98FC40436EE0D47795CF3DE541C260

Function 00007FF70F4246D0 Relevance: 7.6, APIs: 5, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF70F42473B
connect.WS2_32 ref: 00007FF70F424794
WSAGetLastError.WS2_32 ref: 00007FF70F4247A2
ioctlsocket.WS2_32 ref: 00007FF70F4247D1

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$connectioctlsocket
String ID:
API String ID: 1971785428-0
Opcode ID: 91752de680eb7810e5663d0e633616ae3bc0b1b21d747f07152cb76fdf5c0dff
Instruction ID: 0d30fae1e426f58f2361e0d332b0cf51bdb390bd794d999b6fc133a1dc15eb53
Opcode Fuzzy Hash: 91752de680eb7810e5663d0e633616ae3bc0b1b21d747f07152cb76fdf5c0dff
Instruction Fuzzy Hash: 7141CF22A0C6D281E7B1EA21DC403ECA290EF45B94FD44136EE5D577A6EF3DE586C360

Function 00007FF70F42CB70 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF70F42CB7F
GetLastError.KERNEL32 ref: 00007FF70F42CB8F
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF70F42C5F1), ref: 00007FF70F42CC12
DuplicateHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F42C5F1), ref: 00007FF70F42CC3C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F42C5F1), ref: 00007FF70F42CC4D

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: a703a5d9bf1d374bf201233f2e3415584f43e3240198f924f84827e9e5f8ce52
Instruction ID: 8ecebf30660ce35b74b5415d5f34e9b407416e9f6bfa2ae404240501141d1f46
Opcode Fuzzy Hash: a703a5d9bf1d374bf201233f2e3415584f43e3240198f924f84827e9e5f8ce52
Instruction Fuzzy Hash: 4221AE61B1C28241FA64AA26DD453FDA651EF85BE4F948135EE1D077C5CF3DE4418320

Function 00007FF70F420190 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32 ref: 00007FF70F4201EA
GetLastError.KERNEL32 ref: 00007FF70F4201F3
SetFileInformationByHandle.KERNEL32 ref: 00007FF70F420222
CloseHandle.KERNEL32 ref: 00007FF70F420230
GetLastError.KERNEL32 ref: 00007FF70F420250

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Handle$ErrorFileInformationLast$Close
String ID:
API String ID: 3114385310-0
Opcode ID: dcc3e9db81ffaae64ca45b346fab4df8695325788677632439c8d9e62b369b85
Instruction ID: 92e499f6d06a00f0184f73088382034b75632aad8b5ef807592837ab88cac1bb
Opcode Fuzzy Hash: dcc3e9db81ffaae64ca45b346fab4df8695325788677632439c8d9e62b369b85
Instruction Fuzzy Hash: 00213071B0C2C299F7A0AAA9DC007E99991DF85798FD44432FE0C57786DF6DED818231

Function 00007FF70F432190 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00007FF70F438445,?,?,?), ref: 00007FF70F4321D3
InitOnceComplete.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00007FF70F438445,?,?,?), ref: 00007FF70F43221E

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70F4323C0
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70F4323D8

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AllocCompleteInitOnce
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 622421136-3544120690
Opcode ID: 8f7ae1cc7c3d373884c9017de4c86b9173f1b479400807a83c12ee046cfc920e
Instruction ID: 4258a764dd44943fdc919b1afddc13efc22ffaed0cc24f35746832c1c44abbfc
Opcode Fuzzy Hash: 8f7ae1cc7c3d373884c9017de4c86b9173f1b479400807a83c12ee046cfc920e
Instruction Fuzzy Hash: 0F718C22A087928AE710EF65EC407ECB760EF45798FA48135EE4D53691DF7CA986C360

Function 00007FF70F42E019 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF70F42E064
GetLastError.KERNEL32 ref: 00007FF70F42E07D
CloseHandle.KERNEL32 ref: 00007FF70F42E0ED

Part of subcall function 00007FF70F47A710: RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
Part of subcall function 00007FF70F47A710: RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7B2
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7D0

Strings

SystemTime, xrefs: 00007FF70F42E10F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: abort$CaptureCloseContextErrorHandleLastObjectSingleUnwindWait
String ID: SystemTime
API String ID: 2659168121-2656138
Opcode ID: 05cc99c28346786777d0b7d17e9c6535537345cd89bd38ba16040cca04a3ed61
Instruction ID: f1a843e33f809a53bdcf23a346af2298730000193e341332462f5f910a5f09dd
Opcode Fuzzy Hash: 05cc99c28346786777d0b7d17e9c6535537345cd89bd38ba16040cca04a3ed61
Instruction Fuzzy Hash: 3F314A62B08B8299FB00FB61E8413FCA764EF45798F904136EE5C17B95DF3C91868360

Function 00007FF70F42EE3D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF70F42EEE9
GetProcAddress.KERNEL32 ref: 00007FF70F42EEFD

Strings

kernel32, xrefs: 00007FF70F42EEE2
SetThreadDescription, xrefs: 00007FF70F42EEF3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: b72f721979762e52428eef455a9ef1fe81a4105e4d188751f34c40cc1a778e0e
Instruction ID: e6e5e460898b03621208ade7c867eb1e2d1354461feb0610171cfec4e5f0ad31
Opcode Fuzzy Hash: b72f721979762e52428eef455a9ef1fe81a4105e4d188751f34c40cc1a778e0e
Instruction Fuzzy Hash: F5113D61B0D6C291EA69FB56DD443F8E691EF44BC4FD48436EE0D0B799EF2CE5018260

Function 00007FF70F420376 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00007FF70F420386
memcpy.MSVCRT ref: 00007FF70F4203C4
GetLastError.KERNEL32 ref: 00007FF70F4203DF

Strings

., xrefs: 00007FF70F42038F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileFindLastNextmemcpy
String ID: .
API String ID: 3684451505-248832578
Opcode ID: 580e65c2dd758ab042774f7925780f802f0f93bb7f22ddb108d2331cd8d9f64f
Instruction ID: 675529e654d0bf6a212cb0bd3c90cad48247c8a78d0b00b9ad84ca9b25c0befc
Opcode Fuzzy Hash: 580e65c2dd758ab042774f7925780f802f0f93bb7f22ddb108d2331cd8d9f64f
Instruction Fuzzy Hash: 57114216A1C69286FBB1A669EC443FDA6A0EF44754FC48031EE89462D1DF7CE4C59360

Function 00007FF70F42EE61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF70F42EEE9
GetProcAddress.KERNEL32 ref: 00007FF70F42EEFD

Strings

kernel32, xrefs: 00007FF70F42EEE2
SetThreadDescription, xrefs: 00007FF70F42EEF3

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 9d98af57cb7f6c7cd1ed0284d0bea0d51cbf6c989ff939cb8e803f8eba04e7de
Instruction ID: fbcebb116d1cae6adfb3638ca68f4330e92f9b351e4e8b9d995856fa01a847c3
Opcode Fuzzy Hash: 9d98af57cb7f6c7cd1ed0284d0bea0d51cbf6c989ff939cb8e803f8eba04e7de
Instruction Fuzzy Hash: 83115161B0D6C295EA65FB55DD443F8E691EF44BC4FD48436EE0D0B799EF2CE1018260

Function 00007FF70F42EF50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF70F42EF68
GetProcAddress.KERNEL32 ref: 00007FF70F42EF7C

Strings

GetTempPath2W, xrefs: 00007FF70F42EF72
kernel32, xrefs: 00007FF70F42EF61

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32
API String ID: 1646373207-407914046
Opcode ID: 692419809c08872f70c7ab20a927c7a81e82b9fdef07110db430cab33fcee5b3
Instruction ID: fc64f792bb4bd24216be104d731c14779718ad92f519fc384b17a4f0c0a438c5
Opcode Fuzzy Hash: 692419809c08872f70c7ab20a927c7a81e82b9fdef07110db430cab33fcee5b3
Instruction Fuzzy Hash: CAF05811A0DBC2E5FA55FB51EC401F8E690EF48380ED54436EE4D027A5EF2CAA468260

Function 00007FF70F4181A0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F418202
memcpy.MSVCRT ref: 00007FF70F4182E1
memcpy.MSVCRT ref: 00007FF70F4184CD

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF70F418327

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: is_code_point_boundary(self, new_len)
API String ID: 3510742995-9383156
Opcode ID: 865f7bd252a8e5ea9300757f2581f44efe6acb517dea27171c525fc87d244e35
Instruction ID: f9228a17f4de3325a0e99ac503148aaf14d3e0d378b7d256102425a44173d35a
Opcode Fuzzy Hash: 865f7bd252a8e5ea9300757f2581f44efe6acb517dea27171c525fc87d244e35
Instruction Fuzzy Hash: 89B18F62B0CAD545FB11AA629C002FDA761FF55BC8F988431EE4D17B96DF3CE1828260

Function 00007FF70F42CA4A Relevance: 6.3, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42CB5A
CloseHandle.KERNEL32 ref: 00007FF70F42CA50

Part of subcall function 00007FF70F47A710: RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
Part of subcall function 00007FF70F47A710: RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7B2
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7D0

Part of subcall function 00007FF70F3E4940: CloseHandle.KERNEL32 ref: 00007FF70F3E4980
Part of subcall function 00007FF70F3E4940: CloseHandle.KERNEL32 ref: 00007FF70F3E4988

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$abort$CaptureContextUnwind
String ID:
API String ID: 2434310364-0
Opcode ID: e6e4b6c425bf33ef89f3fbf5109c147b163b7af8cfe7a1939f6f4eb98d6596d1
Instruction ID: 0a0705020be2a8aa298bc923abbc189cfc3bbe683f29915ddc2f7ad663a299a1
Opcode Fuzzy Hash: e6e4b6c425bf33ef89f3fbf5109c147b163b7af8cfe7a1939f6f4eb98d6596d1
Instruction Fuzzy Hash: B4113021A0C5D341FA45FA21DC512FDA760FF81B94FD04831FE0E066D6DF2DA905D265

Function 00007FF70F42C9F9 Relevance: 6.3, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42CB2F
CloseHandle.KERNEL32 ref: 00007FF70F42CB37
CloseHandle.KERNEL32 ref: 00007FF70F42CB3F
CloseHandle.KERNEL32 ref: 00007FF70F42CA16

Part of subcall function 00007FF70F47A710: RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
Part of subcall function 00007FF70F47A710: RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7B2
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7D0

CloseHandle.KERNEL32 ref: 00007FF70F42CB5A

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$abort$CaptureContextUnwind
String ID:
API String ID: 2434310364-0
Opcode ID: dd6a2ee4e16ff2eddf31d770df4b0bc98426b889c6779ed1a36cb6aa39b7d2e5
Instruction ID: 68488a98f21142646cb22a6ae297b621081e907d0157ebfab03a96fcfc375a96
Opcode Fuzzy Hash: dd6a2ee4e16ff2eddf31d770df4b0bc98426b889c6779ed1a36cb6aa39b7d2e5
Instruction Fuzzy Hash: 76F0C921B0C6D301E949FA229C152FD9A90EF81FD1FD04830FD0E0B793CF2EA5029269

Function 00007FF70F430090 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F4301D1
memcpy.MSVCRT ref: 00007FF70F430360
memcpy.MSVCRT ref: 00007FF70F430417

Part of subcall function 00007FF70F455A75: memcpy.MSVCRT ref: 00007FF70F455BFF

Strings

program path has no file name, xrefs: 00007FF70F43009B

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: program path has no file name
API String ID: 3510742995-697003637
Opcode ID: a68755110dcd1bfccc73a3eed03bb660f4e085dde23da3dd5d5d09b39b40e36c
Instruction ID: ce9aacb3165d9b2779e753f9aee02ce627b0e2b5b3645f7e9e9eca47659b1f64
Opcode Fuzzy Hash: a68755110dcd1bfccc73a3eed03bb660f4e085dde23da3dd5d5d09b39b40e36c
Instruction Fuzzy Hash: 07A1A062B0C79186FF10AB299C007EDA661FF15BD8F848631EE5C17B99DB7DE1828310

Function 00007FF70F411F70 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F411FBF

Part of subcall function 00007FF70F42D8B0: GetStdHandle.KERNEL32(?,?,?,?,?,00000000,?,?), ref: 00007FF70F42D8DF
Part of subcall function 00007FF70F42D8B0: GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?), ref: 00007FF70F42D8EF

memcpy.MSVCRT ref: 00007FF70F4120A3

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF70F412235

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorHandleLastmemcpymemset
String ID: assertion failed: filled <= self.buf.init
API String ID: 3211292799-906094691
Opcode ID: 049283549ca690784369705e02f6b546d2a81ea62e0b8237ba077bf55714be05
Instruction ID: 4176c2134c8711b3b25319bda1b823d98968320b15d29ba2f10c73f3e78f9eaa
Opcode Fuzzy Hash: 049283549ca690784369705e02f6b546d2a81ea62e0b8237ba077bf55714be05
Instruction Fuzzy Hash: 6871A062B0CBC182EA04EB2299003BAA7A1FF45BD8F948935EE1D47785DF7CE155D360

Function 00007FF70F40AAC0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70F40AAE6
memset.MSVCRT ref: 00007FF70F40AB93

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF70F40ACA1

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memcpymemset
String ID: assertion failed: filled <= self.buf.init
API String ID: 1297977491-906094691
Opcode ID: 020880ebbf3e5536c508f2b93f5e9482472d10ce66a5751a697a7e61c8158c60
Instruction ID: 37f2d295a314b5cc641cd04528a66611635c6de5f3d4ed7a882e1eca18d26011
Opcode Fuzzy Hash: 020880ebbf3e5536c508f2b93f5e9482472d10ce66a5751a697a7e61c8158c60
Instruction Fuzzy Hash: CE510492B0CBC552EA15EB26D9043FAA352EF44BD4F988131EE0C47796DF3DD1868310

Function 00007FF70F40ACC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70F40AD22

Part of subcall function 00007FF70F42D8B0: GetStdHandle.KERNEL32(?,?,?,?,?,00000000,?,?), ref: 00007FF70F42D8DF
Part of subcall function 00007FF70F42D8B0: GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?), ref: 00007FF70F42D8EF

memset.MSVCRT ref: 00007FF70F40ADA1
memcpy.MSVCRT ref: 00007FF70F40AE26

Strings

assertion failed: filled <= self.buf.init, xrefs: 00007FF70F40AE65

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: memset$ErrorHandleLastmemcpy
String ID: assertion failed: filled <= self.buf.init
API String ID: 4037564346-906094691
Opcode ID: a4d6739ca7e60efa2ccbbf7675f3c40d8c078b6be79a0496134661200a6b8338
Instruction ID: c7d4d94fbc083e12225e8fc9c3ef74e7c486bfc3aa9b2c1a2fea5d3b17588c4c
Opcode Fuzzy Hash: a4d6739ca7e60efa2ccbbf7675f3c40d8c078b6be79a0496134661200a6b8338
Instruction Fuzzy Hash: C141D862B09B8192DE14EB22ED103B9A761FF597D0F844935EF5E83B51EF3CE1918250

Function 00007FF70F42BD48 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42BD52
CloseHandle.KERNEL32 ref: 00007FF70F42BD67
CloseHandle.KERNEL32 ref: 00007FF70F42C224

Strings

program path has no file name, xrefs: 00007FF70F42C290

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID: program path has no file name
API String ID: 2962429428-697003637
Opcode ID: 53e9b4ad406de20670141078e0d472c3f5fc7f28f65801387bdc58cd776c8606
Instruction ID: 13a44aa0e559f8fd8f1be10afcd70da792227acb40a7ce3d6cad1c7bdcb11fb8
Opcode Fuzzy Hash: 53e9b4ad406de20670141078e0d472c3f5fc7f28f65801387bdc58cd776c8606
Instruction Fuzzy Hash: 8D416D62A0D6D284EAA0BA62DC847FDA360FF45BA8FC40436EE0D47795DF3DE541C660

Function 00007FF70F429E83 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70F429FF6
GetSystemDirectoryW.KERNEL32 ref: 00007FF70F42A001
GetLastError.KERNEL32 ref: 00007FF70F42A00C
GetLastError.KERNEL32 ref: 00007FF70F42A020

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID:
API String ID: 860285823-0
Opcode ID: 91017c7d2519a45b9b1f236946f03773d418f02b60e1f79754b2fad199aa389c
Instruction ID: 34b8b85556164ca6f281eab0dcdf9286790174e30276473d816bce73bd921a75
Opcode Fuzzy Hash: 91017c7d2519a45b9b1f236946f03773d418f02b60e1f79754b2fad199aa389c
Instruction Fuzzy Hash: 26419121A08AD245E7B0AE25CC553FAA290FF04769FC04535ED5D9BBC9EF2DA6419310

Function 00007FF70F404BE0 Relevance: 6.1, APIs: 4, Instructions: 94sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF70F404CAB
CloseHandle.KERNEL32 ref: 00007FF70F404CB6
CloseHandle.KERNEL32 ref: 00007FF70F404CC6
Sleep.KERNEL32 ref: 00007FF70F404D0F

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepWait
String ID:
API String ID: 2593906732-0
Opcode ID: 0b830fd4423ef8efd6f3cb6563c7a5198bdecd6a9065a39ced86b85448b3e9b9
Instruction ID: 133301de8c244e8464925b2396db216f4cfb3e3e130bd945c0affc6c62d6e8d9
Opcode Fuzzy Hash: 0b830fd4423ef8efd6f3cb6563c7a5198bdecd6a9065a39ced86b85448b3e9b9
Instruction Fuzzy Hash: 13210322F1D68216FF6CE6657D127B885468FC53A0E989236FE1E877F9DF3CA4414210

Function 00007FF70F47A710 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
abort.MSVCRT ref: 00007FF70F47A7B2
abort.MSVCRT ref: 00007FF70F47A7D0

Part of subcall function 00007FF70F47A6D0: RaiseException.KERNEL32 ref: 00007FF70F47A6FB

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: abort$CaptureContextExceptionRaiseUnwind
String ID:
API String ID: 4122134289-0
Opcode ID: d58e9ce648b1a0319dfa7293510e667b9568abe884a28bd8b7690c907cebcaab
Instruction ID: 4f596af8c73262fa7b5630c57cde3cb244cade9f26b6a2458ca20cc186960778
Opcode Fuzzy Hash: d58e9ce648b1a0319dfa7293510e667b9568abe884a28bd8b7690c907cebcaab
Instruction Fuzzy Hash: 63116A2291CBC582EB20AF61E9003EDB771FB98B98F545235FE8D13A59CF6CD1918B10

Function 00007FF70F424C50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF70F424D04

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70F424E1E
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70F424E36

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 1452528299-3544120690
Opcode ID: c3911f9b81918587c0b4cb388ab499344e0613332c6cfb78e9a4b96b604dde71
Instruction ID: e59c2eeeb400ad145cf0d9c7597e56d6a7fb778b05412bf16ebac9a4f82c2d7c
Opcode Fuzzy Hash: c3911f9b81918587c0b4cb388ab499344e0613332c6cfb78e9a4b96b604dde71
Instruction Fuzzy Hash: 0751BC32A085D18AF7B0EF65E8412FDB7B0EF44354F908139EE9943AA5EB3CA591C710

Function 00007FF70F42C15B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF70F42C198
CloseHandle.KERNEL32 ref: 00007FF70F42C224

Strings

program path has no file name, xrefs: 00007FF70F42C290

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseEnvironmentFreeHandleStrings
String ID: program path has no file name
API String ID: 2431795302-697003637
Opcode ID: bb33e71a8487094f8f3af150614d1764cca13a237b3b36ed40153029343f014f
Instruction ID: 663febd2bdf7ae421e945a7105853d5326ef307cc4bfb3d812156196f498b6a4
Opcode Fuzzy Hash: bb33e71a8487094f8f3af150614d1764cca13a237b3b36ed40153029343f014f
Instruction Fuzzy Hash: 7D314C62B0C69281EA60BA52DC856FDA764EF45BE8FC40836EE0D47795CF3DE541C260

Function 00007FF70F42C18C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsW.KERNEL32 ref: 00007FF70F42C198
CloseHandle.KERNEL32 ref: 00007FF70F42C224

Strings

program path has no file name, xrefs: 00007FF70F42C290

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseEnvironmentFreeHandleStrings
String ID: program path has no file name
API String ID: 2431795302-697003637
Opcode ID: 26d9d0ab86754a4c96a9833d086fb707cbd07cccffc104ef706268925d4f66c9
Instruction ID: 02b33ee3e2158a11d145070401e861aa99395e079c1c4027e13c2accd5c8dd70
Opcode Fuzzy Hash: 26d9d0ab86754a4c96a9833d086fb707cbd07cccffc104ef706268925d4f66c9
Instruction Fuzzy Hash: EA315B62A0C6D191EA60AA66DC846FDA364FF49BE4FC40836EE0E47795CF3DD541C260

Function 00007FF70F42E170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00007FF70F41AB68,?,?,?,?,?,?,00007FF70F404D36), ref: 00007FF70F42E195
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF70F41AB68,?,?,?,?,?,?,00007FF70F404D36), ref: 00007FF70F42E230

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70F42E24D

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3362413890-2333694755
Opcode ID: d989155210a2c77213bae5babb0edb5687693b73d0462da1ae5999daa73c0dd9
Instruction ID: f4353e78bf05fe41ec9a94b5423a8d7a883f80b3866cb1bb9e2daa96bc173aed
Opcode Fuzzy Hash: d989155210a2c77213bae5babb0edb5687693b73d0462da1ae5999daa73c0dd9
Instruction Fuzzy Hash: 7F31B151B0C7C642EB48FBA69C152F9A755DF84B80F848036ED0E477A6DF2CA5468260

Function 00007FF70F431CD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,?,?,00007FF70F41DB02), ref: 00007FF70F431D4C
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F41DB02), ref: 00007FF70F431DA9

Strings

assertion failed: is_unlocked(state), xrefs: 00007FF70F431D74

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: AddressSingleValueWake
String ID: assertion failed: is_unlocked(state)
API String ID: 741412973-3502192491
Opcode ID: 23bfee41d53f48bfe86db273fd7076ee8176e7753bdf13d3cd2adad824054417
Instruction ID: 9fb086a516fee752e130c3b57155c99fd734a1295f220ea3ae9a7d8e71aa8432
Opcode Fuzzy Hash: 23bfee41d53f48bfe86db273fd7076ee8176e7753bdf13d3cd2adad824054417
Instruction Fuzzy Hash: 9C218322F0D5928AF766A6199C003F9A151DFD9799FA8C034FE0D47794DF3CA9838790

Function 00007FF70F424A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF70F424AB0

Part of subcall function 00007FF70F414470: memset.MSVCRT ref: 00007FF70F414494
Part of subcall function 00007FF70F414470: WSASocketW.WS2_32 ref: 00007FF70F4144D5

Strings

assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketstd\src\os\windows\io\socket.rs, xrefs: 00007FF70F424A77

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Socketmemsetrecv
String ID: assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketstd\src\os\windows\io\socket.rs
API String ID: 1952720251-765684447
Opcode ID: c87d3782ade94329c49124aaa88e3021b04a82a06ab70fd5b34bbb251caef58b
Instruction ID: 9edb28b37234b50ec7de9f6fdacd47eeb29e1cd5cd93327ee0c799323ba097dc
Opcode Fuzzy Hash: c87d3782ade94329c49124aaa88e3021b04a82a06ab70fd5b34bbb251caef58b
Instruction Fuzzy Hash: B901C022B0CAC289FB64A674D8412F99251DF84334FE44331FD3D467E1DF2CA6828220

Function 00007FF70F47AC10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77
Unknown error, xrefs: 00007FF70F47ACFC

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 9f23c45abf64fbacbe6a0a0f21fe03d62fd103c67be2481a929507254058cce8
Instruction ID: 2d68e7e4b092bab04bef75ba9d61a7e76f2c1831cf75d9621ade7656fa2a2805
Opcode Fuzzy Hash: 9f23c45abf64fbacbe6a0a0f21fe03d62fd103c67be2481a929507254058cce8
Instruction Fuzzy Hash: EE012A63D0CFC886E601DF189C401EAB320FF9A789F659325EE8D26529DF2CE5928710

Function 00007FF70F47ACF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77
Total loss of significance (TLOSS), xrefs: 00007FF70F47ACF0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 654fe18368314048296bdca04a1506cf58bf7ededbd10768bb3a05801da12397
Instruction ID: 2d22ca79171bfbea6712dec658f1ac3153d6eb14647e4a5f52061334ecad3b0c
Opcode Fuzzy Hash: 654fe18368314048296bdca04a1506cf58bf7ededbd10768bb3a05801da12397
Instruction Fuzzy Hash: 77F06263D0CF8886D202EF1CA8000EBB330FF8D789F545326EE8D26519DF28E5828710

Function 00007FF70F47ACE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF70F47ACE0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: d47faca273fee3eb08652286ba7156c53cd7e91152ecfc3982f4c63b94e46008
Instruction ID: 79b8f98b496beda833df14ac563ed7bc0cd4dab1ffb5a35eb9b989b951b4d6ae
Opcode Fuzzy Hash: d47faca273fee3eb08652286ba7156c53cd7e91152ecfc3982f4c63b94e46008
Instruction Fuzzy Hash: 65F04F62D0CF8882D202EF18A8000EBB320FF8D788F545325EE8D26559DF28E5828710

Function 00007FF70F47ACB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77
Argument domain error (DOMAIN), xrefs: 00007FF70F47ACB0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 9d7587cdb4e71efc7c1c888ce97e11677cfee7c1fcdc9252f9f345f0b25ff5e1
Instruction ID: 87779e21217f5debbfa0ef228179c64dbc31a72caeb3edb82a9829ea44b94a69
Opcode Fuzzy Hash: 9d7587cdb4e71efc7c1c888ce97e11677cfee7c1fcdc9252f9f345f0b25ff5e1
Instruction Fuzzy Hash: AFF04F62D0CF8882D202EF18A8000EBB320FF8D788F545325EE8D2A559DF28E5828710

Function 00007FF70F47ACD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF70F47ACD0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: a3a07cbde992090d7d7b51d2974cdc157ef3de1d13c1c5e643ec34ef39ebd05a
Instruction ID: fb1981114653bf4a8e1a13c3e6cb02a12c1d175902d2fee2bd45f776503c5ccb
Opcode Fuzzy Hash: a3a07cbde992090d7d7b51d2974cdc157ef3de1d13c1c5e643ec34ef39ebd05a
Instruction Fuzzy Hash: 6DF04F62D0CF8882D202EF18A8000EBB320FF8D788F545325EE8D26559DF28E5828710

Function 00007FF70F47ACC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77
Partial loss of significance (PLOSS), xrefs: 00007FF70F47ACC0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: cc15266162407a88aa47b9f831956226476d6312fc5f7b2ab81cfc402f8cf8eb
Instruction ID: 9f9986c0b37d2ca9b9f1910b9d90420dbd871a41eb03dc989d50451fe7f5c1b4
Opcode Fuzzy Hash: cc15266162407a88aa47b9f831956226476d6312fc5f7b2ab81cfc402f8cf8eb
Instruction Fuzzy Hash: E9F04F62D0CF8882D202EF18A8000EBB320FF9D788F545325EE8D26559DF28E5828710

Function 00007FF70F47AC48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70F47AC90

Strings

Argument singularity (SIGN), xrefs: 00007FF70F47AC48
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70F47AC77

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 214d4933b2e71066d62eb04ac44e51b8fbdefb7d7834033a0a8b7dae9f3bc6b3
Instruction ID: 91f201e08238a1e195e8f6bead89a9b14aac5c5d59bfe32566352a586525fe63
Opcode Fuzzy Hash: 214d4933b2e71066d62eb04ac44e51b8fbdefb7d7834033a0a8b7dae9f3bc6b3
Instruction Fuzzy Hash: ACF01262D0DF8882D602DF18A8011EBB321FF9D799F545325EE8D2A519DF28E5828710

Function 00007FF70F438560 Relevance: 5.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F41E14E), ref: 00007FF70F438582
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F41E14E), ref: 00007FF70F4385E3
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F41E14E), ref: 00007FF70F4385F3
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70F41E14E), ref: 00007FF70F438642

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f17577e6f870213ef3aa3de7ce3b1ecbdfc094bf71b1c554ff7e80671c820440
Instruction ID: dd23332133989b15ddd90d94d19781529c17306b1ef7319c4542ee3ce4694e5b
Opcode Fuzzy Hash: f17577e6f870213ef3aa3de7ce3b1ecbdfc094bf71b1c554ff7e80671c820440
Instruction Fuzzy Hash: 1C313A22E0D6E245FA567A119D403F9E2A0EF84BD0FC84435FE0D477D6DF6CA85183A0

Function 00007FF70F438780 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF70F4387A2
TlsGetValue.KERNEL32 ref: 00007FF70F438803
TlsSetValue.KERNEL32 ref: 00007FF70F438813
TlsGetValue.KERNEL32 ref: 00007FF70F438862

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4f9c0e8cf95e065e47eaac6043f039f9923d9f226e81e56263bbb65d041ed7a4
Instruction ID: 94b12d5ed7cd0a1d152ba590417dde256bbb6a516c1dfb97537ada258703d441
Opcode Fuzzy Hash: 4f9c0e8cf95e065e47eaac6043f039f9923d9f226e81e56263bbb65d041ed7a4
Instruction Fuzzy Hash: 1F316822F0D69245FA59BA159D403F9E2A1EF84BD0FD84435FE0D477D6EF6CA84283A0

Function 00007FF70F438470 Relevance: 5.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F41E14E,?,?,?,?,?,?,00007FF70F41E7E9), ref: 00007FF70F438492
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F41E14E,?,?,?,?,?,?,00007FF70F41E7E9), ref: 00007FF70F4384B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F41E14E,?,?,?,?,?,?,00007FF70F41E7E9), ref: 00007FF70F438509
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF70F41E14E,?,?,?,?,?,?,00007FF70F41E7E9), ref: 00007FF70F438516

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d2c9f6836f61cd172c0b7c231a5a6352162b93bc84975687d09b25aa2e3d189c
Instruction ID: e1a291f9b7ac1117e845e909af51755732a2e50447b5ce5a44332d27dcc64113
Opcode Fuzzy Hash: d2c9f6836f61cd172c0b7c231a5a6352162b93bc84975687d09b25aa2e3d189c
Instruction Fuzzy Hash: C0215C22B0D6E245FA56BA215D003FDD991EF45BD4F984034FE0D57782EF2CA8424360

Function 00007FF70F438690 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF70F4386B2
TlsGetValue.KERNEL32 ref: 00007FF70F438708
TlsSetValue.KERNEL32 ref: 00007FF70F438718
TlsGetValue.KERNEL32 ref: 00007FF70F438751

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 34d87e71e1d26ee6304a37aee2e64596fe59a58b1bbfbbbe2566885a5bd73867
Instruction ID: 8bcd86d64633e4120ee461cf087a63761bb89a8d4d8343a5304a78950c5290b5
Opcode Fuzzy Hash: 34d87e71e1d26ee6304a37aee2e64596fe59a58b1bbfbbbe2566885a5bd73867
Instruction Fuzzy Hash: CE215722B0D6E246FA957A159D403F9E292EF88BD0F984434FE4D477C2DF6CA84543A0

Function 00007FF70F3E4F00 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F3E4F17
CloseHandle.KERNEL32 ref: 00007FF70F3E4F1F
CloseHandle.KERNEL32 ref: 00007FF70F3E4F2E
CloseHandle.KERNEL32 ref: 00007FF70F3E4F3E

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: defbf50bacf0bd71fc855c0fe0aae662a69bb2d39f6492e28cdf4ead743cc2a7
Instruction ID: 8aefb41c587f90b00de679cb5943f395f2458e4767c78a2ff16c13068fde5b3f
Opcode Fuzzy Hash: defbf50bacf0bd71fc855c0fe0aae662a69bb2d39f6492e28cdf4ead743cc2a7
Instruction Fuzzy Hash: 43F0FF26A0C58182E635FA56E8453FDD260EF88B94F444031EF5E466E18F6CE8C2D360

Function 00007FF70F414640 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F414662
CloseHandle.KERNEL32 ref: 00007FF70F414672
CloseHandle.KERNEL32 ref: 00007FF70F414682
CloseHandle.KERNEL32 ref: 00007FF70F41468A

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 58c5dfcd8be37af0757fe94257b284d1559d3cc6d61e1888325f7b31be4c0e03
Instruction ID: ba204aada093a096f4071a5d55fd2f0d2aa835bde7ffab6707e2e163f73d5fb5
Opcode Fuzzy Hash: 58c5dfcd8be37af0757fe94257b284d1559d3cc6d61e1888325f7b31be4c0e03
Instruction Fuzzy Hash: E4F01D22608A8185EA65EB2ADC417FC5360EF85F9CF980131EE0C467A5CF3DEC82C350

Function 00007FF70F42CB24 Relevance: 5.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42CB2F
CloseHandle.KERNEL32 ref: 00007FF70F42CB37
CloseHandle.KERNEL32 ref: 00007FF70F42CB5A
CloseHandle.KERNEL32 ref: 00007FF70F42CB3F

Part of subcall function 00007FF70F47A710: RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
Part of subcall function 00007FF70F47A710: RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7B2
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7D0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$abort$CaptureContextUnwind
String ID:
API String ID: 2434310364-0
Opcode ID: f533ec74d414918267225ba9c748fb77645763afc5ea37744425af6202ba7a08
Instruction ID: 1384d6f53e8c61032927f37e6c3f020087dc0cf37321a0e26f194783dfe468ec
Opcode Fuzzy Hash: f533ec74d414918267225ba9c748fb77645763afc5ea37744425af6202ba7a08
Instruction Fuzzy Hash: 00E02621A0C2D306E808FA624C162FC8650AF86F80FD54830FD1E17793DF2D69026269

Function 00007FF70F42CA45 Relevance: 5.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF70F42CB2F
CloseHandle.KERNEL32 ref: 00007FF70F42CB37
CloseHandle.KERNEL32 ref: 00007FF70F42CB5A
CloseHandle.KERNEL32 ref: 00007FF70F42CB3F

Part of subcall function 00007FF70F47A710: RtlCaptureContext.KERNEL32 ref: 00007FF70F47A78E
Part of subcall function 00007FF70F47A710: RtlUnwindEx.KERNEL32 ref: 00007FF70F47A7AC
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7B2
Part of subcall function 00007FF70F47A710: abort.MSVCRT ref: 00007FF70F47A7D0

Memory Dump Source

Source File: 00000000.00000002.2710685135.00007FF70F3E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF70F3E0000, based on PE: true

Associated: 00000000.00000002.2710672734.00007FF70F3E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710729464.00007FF70F47C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710741739.00007FF70F47D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710765990.00007FF70F4B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710781025.00007FF70F4B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2710795757.00007FF70F4B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70f3e0000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$abort$CaptureContextUnwind
String ID:
API String ID: 2434310364-0
Opcode ID: 35518d0840023c7934166721ae7b16f5a9fb2bcdc1a3a5e3fbe5953f01b984ae
Instruction ID: 93865cf2e5eb286aa826a73a70500dad2f7964fa70d52dd5a63f6b0678c90ad9
Opcode Fuzzy Hash: 35518d0840023c7934166721ae7b16f5a9fb2bcdc1a3a5e3fbe5953f01b984ae
Instruction Fuzzy Hash: 5AE04C21A0C2D346EC48FA625C162FC9650EF86F80FD55830FD1E17793DF2D6902A269

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Metasploit

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.15798.11018.exe

Function 0000023F4C407D70 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 467
COMMON

Function 00007FF70F3E1180 Relevance: 10.6, APIs: 7, Instructions: 146
sleepstringCOMMON

Function 0000023F4C40D510 Relevance: 1.6, APIs: 1, Instructions: 143
libraryloaderCOMMON

Function 0000023F4C40B740 Relevance: .6, Instructions: 582
COMMON

Function 0000023F4C4136F0 Relevance: .1, Instructions: 114
COMMON

Function 0000023F4C413830 Relevance: .1, Instructions: 72
COMMON

Function 0000023F4C414310 Relevance: .1, Instructions: 65
COMMON

Function 0000023F4C413EF0 Relevance: .1, Instructions: 63
COMMON

Function 0000023F4C414050 Relevance: .1, Instructions: 63
COMMON

Function 0000023F4C0F044E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128
networkmemoryfileCOMMON

Function 0000023F4C0F03B2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160
networkmemoryfileCOMMON

Function 0000023F4C0F0366 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
librarynetworkCOMMON

Function 00007FF70F404520 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
threadCOMMON

Function 0000023F4C411ED0 Relevance: 3.1, APIs: 2, Instructions: 110
COMMON

Function 00007FF70F3E14A0 Relevance: 1.9, APIs: 1, Instructions: 382
synchronizationCOMMON