Edit tour

Windows Analysis Report
1PI1dOAtKY.exe

Overview

General Information

Sample name:	1PI1dOAtKY.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	3fe5fd377ea9bde5ca15723d214916b9a8e1b780bd49fab6e75412315c155b52
Analysis ID:	1539800
MD5:	65265a6752011edf039bdeafeb4e1551
SHA1:	7414c76369b2e5762c93936a22ba530d80488d10
SHA256:	3fe5fd377ea9bde5ca15723d214916b9a8e1b780bd49fab6e75412315c155b52
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

1PI1dOAtKY.exe (PID: 6404 cmdline: "C:\Users\user\Desktop\1PI1dOAtKY.exe" MD5: 65265A6752011EDF039BDEAFEB4E1551)

conhost.exe (PID: 1816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1PI1dOAtKY.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 1PI1dOAtKY.exe

Virustotal: Detection: 10%

Perma Link

Source: 1PI1dOAtKY.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746D7A740 InternetOpenA,InternetSetOptionA,InternetSetOptionA,InternetSetOptionA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,GetLastError,HttpQueryInfoA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF746D7A740

Source: 1PI1dOAtKY.exe

String found in binary or memory: https://http://Mozilla/5.0

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB2644	0_2_00007FF746DB2644
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DC6F64	0_2_00007FF746DC6F64
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D8E053	0_2_00007FF746D8E053
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB2020	0_2_00007FF746DB2020
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DBDA9C	0_2_00007FF746DBDA9C
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D847B0	0_2_00007FF746D847B0
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DAE764	0_2_00007FF746DAE764
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D7A740	0_2_00007FF746D7A740
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DCF8F8	0_2_00007FF746DCF8F8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DC48FC	0_2_00007FF746DC48FC
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D865D0	0_2_00007FF746D865D0
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DBB59C	0_2_00007FF746DBB59C
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D8A594	0_2_00007FF746D8A594
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D76590	0_2_00007FF746D76590
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DDB698	0_2_00007FF746DDB698
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB56AC	0_2_00007FF746DB56AC
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D77360	0_2_00007FF746D77360
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D82500	0_2_00007FF746D82500
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D754A0	0_2_00007FF746D754A0
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D7E480	0_2_00007FF746D7E480
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DD5474	0_2_00007FF746DD5474
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D83470	0_2_00007FF746D83470
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DC1450	0_2_00007FF746DC1450
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D75190	0_2_00007FF746D75190
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D84160	0_2_00007FF746D84160
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DA5124	0_2_00007FF746DA5124
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB52FC	0_2_00007FF746DB52FC
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DC42D8	0_2_00007FF746DC42D8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D8F298	0_2_00007FF746D8F298
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB1248	0_2_00007FF746DB1248
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB0010	0_2_00007FF746DB0010
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DD1FE4	0_2_00007FF746DD1FE4
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DA8F9C	0_2_00007FF746DA8F9C
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB0FB0	0_2_00007FF746DB0FB0
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D75F70	0_2_00007FF746D75F70
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D86F32	0_2_00007FF746D86F32
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D85050	0_2_00007FF746D85050
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DA1DC4	0_2_00007FF746DA1DC4
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D78DD0	0_2_00007FF746D78DD0
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DBCE74	0_2_00007FF746DBCE74
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D8BE20	0_2_00007FF746D8BE20
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DADBB4	0_2_00007FF746DADBB4
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D7CB60	0_2_00007FF746D7CB60
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D8CB40	0_2_00007FF746D8CB40
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DA1B38	0_2_00007FF746DA1B38
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D8FB3E	0_2_00007FF746D8FB3E
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DD5CC8	0_2_00007FF746DD5CC8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D81A00	0_2_00007FF746D81A00
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746D739F0	0_2_00007FF746D739F0

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: String function: 00007FF746DA0700 appears 63 times
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: String function: 00007FF746D94AE0 appears 36 times
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: String function: 00007FF746D9C040 appears 144 times

Source: classification engine

Classification label: mal56.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1816:120:WilError_03

Source: 1PI1dOAtKY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1PI1dOAtKY.exe

Virustotal: Detection: 10%

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

File read: C:\Users\user\Desktop\1PI1dOAtKY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1PI1dOAtKY.exe "C:\Users\user\Desktop\1PI1dOAtKY.exe"
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Section loaded: wininet.dll	Jump to behavior

Source: 1PI1dOAtKY.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 1PI1dOAtKY.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1PI1dOAtKY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1PI1dOAtKY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1PI1dOAtKY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1PI1dOAtKY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1PI1dOAtKY.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DCD8FC LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF746DCD8FC

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DA5124 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF746DA5124

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: malloc,GetAdaptersInfo,free,malloc,GetAdaptersInfo,free,sprintf,free,

0_2_00007FF746D74030

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Evaded block: after key decision	graph_0-43573
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Evaded block: after key decision	graph_0-43511
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Evaded block: after key decision	graph_0-43513

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-44460

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: 1PI1dOAtKY.exe, 00000000.00000002.2026520257.00000187C39D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	API call chain: ExitProcess graph end node			graph_0-43963
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	API call chain: ExitProcess graph end node			graph_0-43543

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DAD1DC __crtCaptureCurrentContext,IsDebuggerPresent,__crtUnhandledException,

0_2_00007FF746DAD1DC

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DC227C EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00007FF746DC227C

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DCD8FC LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF746DCD8FC

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DD466C _lseeki64_nolock,_lseeki64_nolock,GetProcessHeap,HeapAlloc,_errno,_errno,_setmode_nolock,__doserrno,_errno,_setmode_nolock,GetProcessHeap,HeapFree,_lseeki64_nolock,SetEndOfFile,_errno,__doserrno,GetLastError,_lseeki64_nolock,

0_2_00007FF746DD466C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DAC73C SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF746DAC73C
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DB3868 SetUnhandledExceptionFilter,		0_2_00007FF746DB3868

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DAF8B8 cpuid

0_2_00007FF746DAF8B8

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __crtGetLocaleInfoEx,	0_2_00007FF746DC47F8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	0_2_00007FF746DC4744
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	0_2_00007FF746DC48FC
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	0_2_00007FF746DC282C
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	0_2_00007FF746DC3540
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00007FF746DC2654
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	0_2_00007FF746DC24F8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,GetLocaleInfoW,	0_2_00007FF746DC51E8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF746DC5138
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00007FF746DC42D8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	0_2_00007FF746DC5290
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	0_2_00007FF746DB1248
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	0_2_00007FF746DACFE0
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	0_2_00007FF746DC4FEC
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: EnumSystemLocalesW,	0_2_00007FF746DACF9C
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	0_2_00007FF746DC2DB8
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	0_2_00007FF746DC4DBC
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_00007FF746DC4D28
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	0_2_00007FF746DA7EF4
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00007FF746DAEB88
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_00007FF746DC4C74

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746D754A0 SetFileAttributesA,std::ios_base::_Ios_base_dtor,_time64,Sleep,_time64,_time64,_time64,rand,rand,SetFileAttributesA,GetSystemTime,rand,SystemTimeToFileTime,CreateFileA,SetFileTime,CloseHandle,std::ios_base::_Ios_base_dtor,

0_2_00007FF746D754A0

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746D737C0 GetUserNameA,

0_2_00007FF746D737C0

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe

Code function: 0_2_00007FF746DBAD54 GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,std::bad_exception::bad_exception,_CxxThrowException,std::bad_exception::bad_exception,_CxxThrowException,

0_2_00007FF746DBAD54

Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DD0158 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::WorkItem::Bind,Concurrency::details::SchedulerBase::GetInternalContext,		0_2_00007FF746DD0158
Source: C:\Users\user\Desktop\1PI1dOAtKY.exe	Code function: 0_2_00007FF746DD10A0 Concurrency::details::VirtualProcessor::ThrowVirtualProcessorEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::WorkItem::Bind,		0_2_00007FF746DD10A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1PI1dOAtKY.exe	11%	Virustotal		Browse
1PI1dOAtKY.exe	100%	Avira	HEUR/AGEN.1319794

Name	Source	Malicious	Antivirus Detection	Reputation
https://http://Mozilla/5.0	1PI1dOAtKY.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539800
Start date and time:	2024-10-23 06:29:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1PI1dOAtKY.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	3fe5fd377ea9bde5ca15723d214916b9a8e1b780bd49fab6e75412315c155b52
Detection:	MAL
Classification:	mal56.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 86
Cookbook Comments:	Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information

Process:	C:\Users\user\Desktop\1PI1dOAtKY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	4.710273607729329
Encrypted:	false
SSDEEP:	24:w3GSdNffPmFMqFh4im3S1emA26uuMj4/4rku3MkHtXDe98vO++ly+Npy+tbDZAd1:9SdkJPAke5uuMqo3ltTI+Z+y+4W+t
MD5:	F028EC760D3B3F8A0B9DB4CF6ED0BD85
SHA1:	229C305A97F890BF2EB66D9B5A0FB60FE79A3258
SHA-256:	96EC03AE0A7A7233F01D904F60AACC43A748B32190B7232CAB74A4349236B8A9
SHA-512:	32883789EFAA3375782ED6D9699838F4587F6BBC952115AFDB74C7ED00F4DFE90E93FD402798AD013FABB8F0B56578C47828304BD3A1DD87C0AEC261A38DDCB3
Malicious:	false
Reputation:	low
Preview:	aescriptsLicTool_Verbose v4.1.43 (20241006) / AESCRIPTSLICLIB 4.1.3....usage: aescriptsLicTool_Verbose productName privNum [licString] [version]..'productName' is the name of the product to be validated or licensed (this is the filename of the license file without extension)..'privNum' is the private number of the product (can be set to - to ignore for certain actions)..'licString' is the license string of the product to be licensed..('licString' can be set to - to unlicense a product)..('licString' can be set to -content to retrieve the current content of the license file as a string)..('licString' can be set to PID@REMOTE to request a floating license - replace PID with the product ID on the server)..'version' is the optional version of the product to be licensed....The tool can also be run in 'licenser' or 'license checker' mode..Licenser mode call syntax:..aescriptsLicTool_Verbose productName - [licString] [version] -license..License checker mode call syntax:..aescriptsLicTool_Verb

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.129641582558878
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1PI1dOAtKY.exe
File size:	645'776 bytes
MD5:	65265a6752011edf039bdeafeb4e1551
SHA1:	7414c76369b2e5762c93936a22ba530d80488d10
SHA256:	3fe5fd377ea9bde5ca15723d214916b9a8e1b780bd49fab6e75412315c155b52
SHA512:	6356f085894624e61a8dc67b19fc27ebf4c17b75b4cda970f120edc80d63946527ca845224c8b71d2d65a12efe5bfff7d781c050c382a517a958c0d3959afe63
SSDEEP:	12288:y6UPqQaO4tv82UlCKIMBnD1pnS8nWy9i4elej:y6jOK8GKIM5bWy9zj
TLSH:	25D46B59B39440E5D067C279CA574516F3B278460B3A9BDB03A0876B1F37AE09F3EB21
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O};.!.;.!.;.!..\|..4.!..\|....!..\|....!.....6.!.;. ...!..U..:.!.]T..:.!.]T..:.!.Rich;.!.........PE..d......g.........."........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140037e30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67021889 [Sun Oct 6 04:56:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3ee642cb8c343ab97cf5b604d88a461f

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0B68C7C838h
dec eax
add esp, 28h
jmp 00007F0B68C705F7h
int3
int3
dec eax
sub esp, 28h
call 00007F0B68C79118h
dec eax
mov ecx, dword ptr [eax+000000C0h]
dec eax
cmp ecx, dword ptr [0005C965h]
je 00007F0B68C707C8h
mov eax, dword ptr [eax+000000C8h]
test dword ptr [0005CAD3h], eax
jne 00007F0B68C707BAh
call 00007F0B68C795CDh
dec eax
mov ecx, eax
mov eax, dword ptr [ecx+04h]
dec eax
add esp, 28h
ret
int3
dec eax
sub esp, 28h
call 00007F0B68C790E0h
dec eax
mov ecx, dword ptr [eax+000000C0h]
dec eax
cmp ecx, dword ptr [0005C92Dh]
je 00007F0B68C707C8h
mov eax, dword ptr [eax+000000C8h]
test dword ptr [0005CA9Bh], eax
jne 00007F0B68C707BAh
call 00007F0B68C79595h
dec eax
mov ecx, eax
dec eax
lea eax, dword ptr [ecx+00000128h]
dec eax
add esp, 28h
ret
int3
dec eax
sub esp, 28h
call 00007F0B68C790A4h
dec eax
mov ecx, dword ptr [eax+000000C0h]
dec eax
cmp ecx, dword ptr [0005C8F1h]
je 00007F0B68C707C8h
mov eax, dword ptr [eax+000000C8h]
test dword ptr [0005CA5Fh], eax
jne 00007F0B68C707BAh
call 00007F0B68C79559h
dec eax
mov ecx, eax
mov eax, dword ptr [ecx+000000D4h]
dec eax
add esp, 28h
ret
int3
int3
dec esp
mov ebx, esp

Rich Headers

Programming Language:

[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x91424	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x9a000	0x50c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa1000	0xfbc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x81290	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x71000	0x4d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6f789	0x6f800	8a8e32c0d99c274fc8002dc11f45bcaa	False	0.505165271160314	data	6.372737146819066	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x71000	0x213de	0x21400	f7ca2b641a4baf725e5feea0e55d4344	False	0.354984140037594	data	4.614733432030153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x93000	0x6a60	0x3a00	71fce75483d7bb8ef829447188123647	False	0.2231950431034483	data	3.9381026450080876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x9a000	0x50c4	0x5200	be34dba8af943daf4f72a01864fb08c0	False	0.4907583841463415	data	5.750850673396023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x1e0	0x200	584568d783300e149a02ddab2f14ce0f	False	0.525390625	data	4.692060940173397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa1000	0x3a92	0x3c00	fa960895ca86a7d9e8087af3dc53212f	False	0.1248046875	data	2.177846270977989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xa0060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	inet_ntop, ioctlsocket, gethostname, connect, WSAStartup, getaddrinfo, select, WSAGetLastError, setsockopt, WSACleanup, recv, socket, freeaddrinfo, __WSAFDIsSet, closesocket, send
IPHLPAPI.DLL	GetAdaptersInfo
KERNEL32.dll	GetThreadPriority, CreateFileW, SetEnvironmentVariableA, WriteConsoleW, SetStdHandle, ReadConsoleW, CreateTimerQueue, RegisterWaitForSingleObject, GetNumaHighestNodeNumber, ChangeTimerQueueTimer, SetEndOfFile, QueryDepthSList, LoadLibraryW, UnregisterWait, CreateFileA, SystemTimeToFileTime, FormatMessageA, SetFileTime, Sleep, CreateDirectoryA, GetLastError, SetFileAttributesA, CloseHandle, GetSystemTime, UnregisterWaitEx, GetStartupInfoW, InterlockedFlushSList, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, ReleaseSemaphore, DuplicateHandle, VirtualProtect, VirtualFree, VirtualAlloc, GetVersionExW, WideCharToMultiByte, GetCurrentThreadId, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, GetSystemTimeAsFileTime, MultiByteToWideChar, GetStringTypeW, ExitProcess, GetModuleHandleExW, GetProcAddress, AreFileApisANSI, HeapFree, HeapAlloc, IsDebuggerPresent, IsProcessorFeaturePresent, GetCommandLineA, GetCPInfo, RtlPcToFileHeader, RaiseException, RtlLookupFunctionEntry, RtlUnwindEx, InitializeCriticalSectionAndSpinCount, TlsGetValue, CreateTimerQueueTimer, RtlCaptureContext, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsSetValue, TlsFree, SignalObjectAndWait, GetModuleHandleW, CreateSemaphoreW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, GetFileType, WriteFile, GetModuleFileNameW, FreeLibrary, LoadLibraryExW, IsValidCodePage, GetACP, GetOEMCP, GetProcessHeap, GetCurrentThread, ReadFile, SetFilePointerEx, FlushFileBuffers, GetConsoleCP, GetConsoleMode, HeapSize, CreateDirectoryW, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetFilePointer, HeapReAlloc, DeleteTimerQueueTimer, GetProcessAffinityMask, SetThreadAffinityMask, OutputDebugStringW, SwitchToThread, CreateThread, GetThreadTimes, FreeLibraryAndExitThread, GetModuleHandleA, SetEvent, WaitForSingleObject, CreateEventW, SetThreadPriority, GetTickCount
ADVAPI32.dll	GetUserNameA
SHELL32.dll	SHGetFolderPathA
WININET.dll	HttpSendRequestA, HttpOpenRequestA, InternetCloseHandle, InternetReadFile, InternetConnectA, HttpQueryInfoA, InternetSetOptionA, InternetOpenA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	00:30:21
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\1PI1dOAtKY.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1PI1dOAtKY.exe"
Imagebase:	0x7ff746d70000
File size:	645'776 bytes
MD5 hash:	65265A6752011EDF039BDEAFEB4E1551
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:30:21
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.9%
Total number of Nodes:	1198
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF746D8E053 Relevance: 85.0, APIs: 2, Strings: 54, Instructions: 1009COMMON

Download Yara Rule

APIs

memchr.LIBCMT ref: 00007FF746D8E1C6
memchr.LIBCMT ref: 00007FF746D8E3D7

Part of subcall function 00007FF746D95450: memchr.LIBCMT ref: 00007FF746D954CF

Part of subcall function 00007FF746D8D640: _Mtx_unlock.LIBCPMT ref: 00007FF746D8D677

Strings

6;, xrefs: 00007FF746D8E2F5
Setting online activation check interval to , xrefs: 00007FF746D8E703
'productName' is the name of the product to be validated or licensed (this is the filename of the license file without extension), xrefs: 00007FF746D8EE83
AESCRIPTSLICLIB 4.1.3, xrefs: 00007FF746D8E2DB
-timeout, xrefs: 00007FF746D8E7DD
-auth_check_days, xrefs: 00007FF746D8E6CE
Online check active, xrefs: 00007FF746D8E536
%, xrefs: 00007FF746D8E2A6
aescriptsLicTool_Verbose, xrefs: 00007FF746D8E27A
.43 (, xrefs: 00007FF746D8E2AE
Forced online activation active, xrefs: 00007FF746D8E7A9
The following additional flags can be appended to the command line to enable specific features:, xrefs: 00007FF746D8F07B
days, xrefs: 00007FF746D8E774
The tool can also be run in 'licenser' or 'license checker' mode, xrefs: 00007FF746D8EFA5
Support for multi-licenses active, xrefs: 00007FF746D8E482
('licString' can be set to - to unlicense a product), xrefs: 00007FF746D8EEF5
-online, xrefs: 00007FF746D8E515
2000, xrefs: 00007FF746D8EAC2
-unauth_check_days, xrefs: 00007FF746D8E715
-unauth_check_days [numDays] sets the online activation grace period in days, xrefs: 00007FF746D8F139
-web, xrefs: 00007FF746D8E1D6, 00007FF746D8E3E7
-force_online, xrefs: 00007FF746D8E786
-url, xrefs: 00007FF746D8E581
-offline_support, xrefs: 00007FF746D8E54B
License checker mode call syntax:, xrefs: 00007FF746D8F017
('licString' can be set to PID@REMOTE to request a floating license - replace PID with the product ID on the server), xrefs: 00007FF746D8EF41
) / , xrefs: 00007FF746D8E2CC
('licString' can be set to -content to retrieve the current content of the license file as a string), xrefs: 00007FF746D8EF1B
'privNum' is the private number of the product (can be set to - to ignore for certain actions), xrefs: 00007FF746D8EEA9
Offline licensing support active, xrefs: 00007FF746D8E56C
Using online check URL , xrefs: 00007FF746D8E681
Online check inactive, xrefs: 00007FF746D8E66C
seconds, xrefs: 00007FF746D8E84F
Setting online activation grace period to , xrefs: 00007FF746D8E74A
-force_online enables forced online activation, xrefs: 00007FF746D8F15F
-auth_check_days [numDays] sets the online activation check interval in days, xrefs: 00007FF746D8F113
-license, xrefs: 00007FF746D8E4E4
20241006, xrefs: 00007FF746D8E2BD
|||||||||, xrefs: 00007FF746D8E9C7
-url [URL] sets the online check URL to use, xrefs: 00007FF746D8F0ED
-check, xrefs: 00007FF746D8E4B8
t, xrefs: 00007FF746D8EC60
Licenser mode call syntax:, xrefs: 00007FF746D8EFCB
'version' is the optional version of the product to be licensed, xrefs: 00007FF746D8EF67
usage: aescriptsLicTool_Verbose productName privNum [licString] [version], xrefs: 00007FF746D8EE5D
aescriptsLicTool_Verbose productName - [licString] [version] -license, xrefs: 00007FF746D8EFF1
-multi, xrefs: 00007FF746D8E45E
aescriptsLicTool_Verbose productName - [licString] [version] -check, xrefs: 00007FF746D8F03D
&;, xrefs: 00007FF746D8E305
-multi enables support for multi-licenses, xrefs: 00007FF746D8F0A1
'licString' is the license string of the product to be licensed, xrefs: 00007FF746D8EECF
-online enables online checks, xrefs: 00007FF746D8F0C7
Setting online activation timeout to , xrefs: 00007FF746D8E82F
-timeout [timeout] sets the online activation timeout in milliseconds, xrefs: 00007FF746D8F185

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: memchr$Mtx_unlock
String ID: days$ seconds$'licString' is the license string of the product to be licensed$'privNum' is the private number of the product (can be set to - to ignore for certain actions)$'productName' is the name of the product to be validated or licensed (this is the filename of the license file without extension)$'version' is the optional version of the product to be licensed$('licString' can be set to - to unlicense a product)$('licString' can be set to -content to retrieve the current content of the license file as a string)$('licString' can be set to PID@REMOTE to request a floating license - replace PID with the product ID on the server)$) / $-auth_check_days$-auth_check_days [numDays] sets the online activation check interval in days$-check$-force_online$-force_online enables forced online activation$-license$-multi$-multi enables support for multi-licenses$-offline_support$-online$-online enables online checks$-timeout$-timeout [timeout] sets the online activation timeout in milliseconds$-unauth_check_days$-unauth_check_days [numDays] sets the online activation grace period in days$-url$-url [URL] sets the online check URL to use$-web$.43 ($2000$20241006$AESCRIPTSLICLIB 4.1.3$Forced online activation active$License checker mode call syntax:$Licenser mode call syntax:$Offline licensing support active$Online check active$Online check inactive$Setting online activation check interval to $Setting online activation grace period to $Setting online activation timeout to $Support for multi-licenses active$The following additional flags can be appended to the command line to enable specific features:$The tool can also be run in 'licenser' or 'license checker' mode$Using online check URL $aescriptsLicTool_Verbose$aescriptsLicTool_Verbose productName - [licString] [version] -check$aescriptsLicTool_Verbose productName - [licString] [version] -license$t$usage: aescriptsLicTool_Verbose productName privNum [licString] [version]$|||||||||$%$&;$6;
API String ID: 3101769438-276666048
Opcode ID: 2a67cadb1012ae0152ac74b0451cecdfbdab6efe015fe0c4970de11ac9beb21d
Instruction ID: dc47c7cfea6932e1c2aeac163dd6fca7fbc13e681658dd384db8bf6c161f075d
Opcode Fuzzy Hash: 2a67cadb1012ae0152ac74b0451cecdfbdab6efe015fe0c4970de11ac9beb21d
Instruction Fuzzy Hash: 96A25C61A1C696C5EF24BB25DC543FBE391FF46B88FC40031D50E4B696EE6CE5098B60

Function 00007FF746DB2644 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 00007FF746DB269A
_errno.LIBCMT ref: 00007FF746DB26A1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DB26AC

Strings

U, xrefs: 00007FF746DB2C0E

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 310e5d689b6c9005fc2c29a6e7927e47ab9f9910382af6568becb401648d8fdb
Instruction ID: 14881e2b5f23db94d2a7757a4a5ab4c467df392053c665a17ee5e1823ca8b1b2
Opcode Fuzzy Hash: 310e5d689b6c9005fc2c29a6e7927e47ab9f9910382af6568becb401648d8fdb
Instruction Fuzzy Hash: 59127C63A1C642D6EF20BF25E84437BE7A1FB89B44F940136DA4D42A98DF3DE545CB20

Function 00007FF746DC5644 Relevance: 48.6, APIs: 32, Instructions: 573COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF746DC5685

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DC567E

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

__doserrno.LIBCMT ref: 00007FF746DC56DE
_errno.LIBCMT ref: 00007FF746DC56E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC5E8E

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: b1aebb7bc750ed6bd965db0952ebf2d304918c80961731e59570ffc347a6a6d3
Instruction ID: 626d4cc90850efa0d5a0c85a657f71b5dca1af69ec5a582d155817a3df6d9109
Opcode Fuzzy Hash: b1aebb7bc750ed6bd965db0952ebf2d304918c80961731e59570ffc347a6a6d3
Instruction Fuzzy Hash: DD320122A1C68AC5EF10BF298C802BEEB90EB51754FD48635CA1E43795DF2DE8118B71

Function 00007FF746DA7C18 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.LIBCMT ref: 00007FF746DA7C26
malloc.LIBCMT ref: 00007FF746DA7C32

Part of subcall function 00007FF746DA5C2C: _FF_MSGBANNER.LIBCMT ref: 00007FF746DA5C5C
Part of subcall function 00007FF746DA5C2C: _NMSG_WRITE.LIBCMT ref: 00007FF746DA5C66
Part of subcall function 00007FF746DA5C2C: HeapAlloc.KERNEL32(?,?,00000000,00007FF746DAAE48,?,?,?,00007FF746DA93C0,?,?,?,00007FF746DA92BF), ref: 00007FF746DA5C81
Part of subcall function 00007FF746DA5C2C: _callnewh.LIBCMT ref: 00007FF746DA5C9A
Part of subcall function 00007FF746DA5C2C: _errno.LIBCMT ref: 00007FF746DA5CA5
Part of subcall function 00007FF746DA5C2C: _errno.LIBCMT ref: 00007FF746DA5CB0

Strings

bad allocation, xrefs: 00007FF746DA7C42

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _callnewh_errno$AllocHeapmalloc
String ID: bad allocation
API String ID: 3727741168-2104205924
Opcode ID: 7dfc25d6364a89fa24b2a1d03c71c712614c6b3cfffbc134d47ee1c094b8417a
Instruction ID: 8a53563cb8eb15b85c5711ef5fbd8b67dfea423dd1f30d97d3296e9df4387463
Opcode Fuzzy Hash: 7dfc25d6364a89fa24b2a1d03c71c712614c6b3cfffbc134d47ee1c094b8417a
Instruction Fuzzy Hash: 2F311228E0CA17D1FE20BB61AC412BBE3A4AF90744FD40835D94D86796EE7CE401CF21

Function 00007FF746DA7CC5 Relevance: 21.1, APIs: 14, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_heap_init.LIBCMT ref: 00007FF746DA7CE8
_FF_MSGBANNER.LIBCMT ref: 00007FF746DA7CFA

Part of subcall function 00007FF746DAE6F0: _set_error_mode.LIBCMT ref: 00007FF746DAE6F9
Part of subcall function 00007FF746DAE6F0: _set_error_mode.LIBCMT ref: 00007FF746DAE708
Part of subcall function 00007FF746DAE6F0: _NMSG_WRITE.LIBCMT ref: 00007FF746DAE71F
Part of subcall function 00007FF746DAE6F0: _NMSG_WRITE.LIBCMT ref: 00007FF746DAE729

_NMSG_WRITE.LIBCMT ref: 00007FF746DA7D04
_mtinit.LIBCMT ref: 00007FF746DA7D13
_FF_MSGBANNER.LIBCMT ref: 00007FF746DA7D25
_NMSG_WRITE.LIBCMT ref: 00007FF746DA7D2F
_RTC_Initialize.LIBCMT ref: 00007FF746DA7D3E
_ioinit.LIBCMT ref: 00007FF746DA7D44
fast_error_exit.LIBCMT ref: 00007FF746DA7D52
GetCommandLineA.KERNEL32 ref: 00007FF746DA7D57
__crtGetEnvironmentStringsA.LIBCMT ref: 00007FF746DA7D64
__setargv.LIBCMT ref: 00007FF746DA7D70
_setenvp.LIBCMT ref: 00007FF746DA7D83
_cinit.LIBCMT ref: 00007FF746DA7D98

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _set_error_mode$CommandEnvironmentInitializeLineStrings__crt__setargv_cinit_heap_init_ioinit_mtinit_setenvpfast_error_exit
String ID:
API String ID: 3166661917-0
Opcode ID: b0981de98021ddb0104c549e5ebe9159d348e26bf22f0a2f6efc72fa0723fe93
Instruction ID: e7c53db8a992061449bfbcef0b6c8baac1d71ca7c570a79dd4977a935448bd83
Opcode Fuzzy Hash: b0981de98021ddb0104c549e5ebe9159d348e26bf22f0a2f6efc72fa0723fe93
Instruction Fuzzy Hash: DD31E724E0C253C6FF9477659D612BBE295AF81748FD40439EA0D463D3EE2CE840DA71

Function 00007FF746DC5528 Relevance: 16.6, APIs: 11, Instructions: 81
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF746DC555A

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DC5551

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

__doserrno.LIBCMT ref: 00007FF746DC55B7
_errno.LIBCMT ref: 00007FF746DC55BE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC5622

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 45f8a82ceec06cf673c7f0369de7f0b233dfce2b3635af425e81092c052b3ba0
Instruction ID: ae99ca02ec986b3217bffa7a1f399d82e764672531c93e65f790db298c211859
Opcode Fuzzy Hash: 45f8a82ceec06cf673c7f0369de7f0b233dfce2b3635af425e81092c052b3ba0
Instruction Fuzzy Hash: DC31AF21B1C69AC6EF127F659C4113FEA50AF80760FD94538E929177D2CF7CE8418BA0

Function 00007FF746DB2314 Relevance: 15.1, APIs: 10, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF746DB233F

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DB2337

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

__lock_fhandle.LIBCMT ref: 00007FF746DB2383
_lseeki64_nolock.LIBCMT ref: 00007FF746DB239C
_unlock_fhandle.LIBCMT ref: 00007FF746DB23BF

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: dd8faada70b3f1f2db14f4a0876ca9cda89bb6854984bafce4abb2666d957345
Instruction ID: 15d1e92bbbbd22aabac28a1c5a1ad3bf9dd6ac1a348b88ef479c91397ea9bb04
Opcode Fuzzy Hash: dd8faada70b3f1f2db14f4a0876ca9cda89bb6854984bafce4abb2666d957345
Instruction Fuzzy Hash: B1217A22B1D691D5EE153F15AC4537EE9506F80BB0FD94638EA3D063DACE3CA4418B30

Function 00007FF746DB4E1C Relevance: 15.1, APIs: 10, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF746DB4E47

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DB4E3F

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

__lock_fhandle.LIBCMT ref: 00007FF746DB4E8B
_lseek_nolock.LIBCMT ref: 00007FF746DB4EA4
_unlock_fhandle.LIBCMT ref: 00007FF746DB4EC5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 72afa058709bb828e96d3415c19377e2bbb9911eed6dfa1a6824f421d2ce3fe8
Instruction ID: bc743914bf6835afe65daf0a3b6886d6a9a80b94110e34e50b160ef6093427b6
Opcode Fuzzy Hash: 72afa058709bb828e96d3415c19377e2bbb9911eed6dfa1a6824f421d2ce3fe8
Instruction Fuzzy Hash: CD219022B1C692D5EF11BB259C4537EE5506F80B60FD94538EA1D463DACF7CA8418B30

Function 00007FF746DB2564 Relevance: 13.6, APIs: 9, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF746DB258F

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DB2587

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

__lock_fhandle.LIBCMT ref: 00007FF746DB25D3
_unlock_fhandle.LIBCMT ref: 00007FF746DB260D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: 5fcd879006f93b5fe29c795d0880f50e6eebd262978a8f42948adc3209e56eb7
Instruction ID: b2d44d6dd8fc1221502c7d2598d7d19e8932ade5a98d0954f0483c2c4c959656
Opcode Fuzzy Hash: 5fcd879006f93b5fe29c795d0880f50e6eebd262978a8f42948adc3209e56eb7
Instruction Fuzzy Hash: FF21A922B0C592D5EF113F249C4637EE9506F80BA1F894538EA29073DACE7CA8418BB4

Function 00007FF746DB36E8 Relevance: 13.6, APIs: 9, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00007FF746DB3709

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DB3701

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

__lock_fhandle.LIBCMT ref: 00007FF746DB374D
_close_nolock.LIBCMT ref: 00007FF746DB3760
_unlock_fhandle.LIBCMT ref: 00007FF746DB3779

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: f87f21952b45cb965ec34267ab40e2fd4b9299d68018c2f6f6fc69f248886a23
Instruction ID: 9c0b2f43d1afe07e431a18794ed0d82d8e09d7d12773f4fce1d64a7029fbc059
Opcode Fuzzy Hash: f87f21952b45cb965ec34267ab40e2fd4b9299d68018c2f6f6fc69f248886a23
Instruction Fuzzy Hash: 8311CD72E0C682D6EF157B25AC4527EEA50AF80B61FDA0638D91D073D6CEBCE4414B70

Function 00007FF746D93A00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fgetc.LIBCMT ref: 00007FF746D93ABB

Strings

string too long, xrefs: 00007FF746D93C9E, 00007FF746D93CAB

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: fgetc
String ID: string too long
API String ID: 2807381905-2556327735
Opcode ID: 1a938cfd65599276fb3aadb580e9b2d1027a9da448c82545d8171305ed1fd370
Instruction ID: 66ad48ddaf68b3e5ede9a7520432916ac168ba9d4bd2974c6a299cc6de7638e0
Opcode Fuzzy Hash: 1a938cfd65599276fb3aadb580e9b2d1027a9da448c82545d8171305ed1fd370
Instruction Fuzzy Hash: 15914D32709A41D9EF14EF25C8502ADB3A0FB45768F854632DA2D43BE9EF38D568C720

Function 00007FF746D7DF90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSACleanup.WS2_32 ref: 00007FF746D7E0D8
_Mtx_destroy.LIBCPMT ref: 00007FF746D7E119
_Mtx_destroy.LIBCPMT ref: 00007FF746D7E126
_Mtx_destroy.LIBCPMT ref: 00007FF746D7E133

Part of subcall function 00007FF746D815D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF746D8171B

Strings

1.0.0, xrefs: 00007FF746D7E014

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Mtx_destroy$CleanupIos_base_dtorstd::ios_base::_
String ID: 1.0.0
API String ID: 4003963943-322658870
Opcode ID: e2633af78b420bc41f454823a79be59aadfea9a2133544200fed54a12148376b
Instruction ID: 354f5c427b3958fa8b73b87c4165fb157a7820758c0f0b3f2f742aa96c9e1cc6
Opcode Fuzzy Hash: e2633af78b420bc41f454823a79be59aadfea9a2133544200fed54a12148376b
Instruction Fuzzy Hash: 56512621A1DAA2D5FF10BB21EC5436BE3A9BB81794FC00135D99D436E6CF7CE4468B20

Function 00007FF746D935E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

string too long, xrefs: 00007FF746D93863, 00007FF746D93870

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID: string too long
API String ID: 0-2556327735
Opcode ID: 70e423f66ee6790fe538ff7c039c66202f1dfd9db47b5ea2ea59a5846aeafa6a
Instruction ID: 49ba877b21b0da16cb56a305ecc66eaccf5d86e99e6b16767b0572ca5e4f7ac1
Opcode Fuzzy Hash: 70e423f66ee6790fe538ff7c039c66202f1dfd9db47b5ea2ea59a5846aeafa6a
Instruction Fuzzy Hash: 4791AF32B08A81D9EF14AF25C8402EDB761F705768F814632DA2D97BE4EF38D568C760

Function 00007FF746DA0974 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fsopen.LIBCMT ref: 00007FF746DA0909
fclose.LIBCMT ref: 00007FF746DA0916
_fsopen.LIBCMT ref: 00007FF746DA092B
fseek.LIBCMT ref: 00007FF746DA0945

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _fsopen$fclosefseek
String ID:
API String ID: 410343947-0
Opcode ID: 264fa5cf69113298d8e32d3fe2f0c6501ea07c7103afaa3aed354072517c642a
Instruction ID: 5a4f212fea8ba6a79881648c5edb4f4e456727f2b21b900cfb219e77eb403bfc
Opcode Fuzzy Hash: 264fa5cf69113298d8e32d3fe2f0c6501ea07c7103afaa3aed354072517c642a
Instruction Fuzzy Hash: 7621CE21F1D602C4FEA8FA16995167BE690EF48B88F988134CE4D837D1DE2DE8018B50

Function 00007FF746DB741C Relevance: 4.6, APIs: 3, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_SpinWait.LIBCMT ref: 00007FF746DB74DE
Concurrency::details::ResourceManager::ResourceManager.LIBCMT ref: 00007FF746DB7512
Concurrency::details::ResourceManager::ResourceManager.LIBCMT ref: 00007FF746DB7552

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Resource$Concurrency::details::ManagerManager::$SpinWait
String ID:
API String ID: 2068395708-0
Opcode ID: 207cf36d981dac8a2c53e82cc65969d2a1ecd1de745d3672c8d56939984ecf0e
Instruction ID: 7a6f5014f14dbbc94a91b5c0a90a3dbfb3f0ea5f3f174bd596b9a7fcd53ef6ab
Opcode Fuzzy Hash: 207cf36d981dac8a2c53e82cc65969d2a1ecd1de745d3672c8d56939984ecf0e
Instruction Fuzzy Hash: F6217E21A0EB43D6EF50BB55AC5027BE2D0AF44B50F984138D94E473D9EE2CE4448F74

Function 00007FF746D7DE90 Relevance: 4.5, APIs: 3, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Mtx_init.LIBCPMT ref: 00007FF746D7DEBA

Part of subcall function 00007FF746DA0FF0: calloc.LIBCMT ref: 00007FF746DA1010

_Mtx_init.LIBCPMT ref: 00007FF746D7DED6
_Mtx_init.LIBCPMT ref: 00007FF746D7DEF2

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Mtx_init$calloc
String ID:
API String ID: 2545118020-0
Opcode ID: f828f983e790094a28bbb2a708ea9e09a06a1c05030c6f23811644e6675f23a9
Instruction ID: 889db77c624f4ab8116005ca9047ab29a8631724783c8073018c7230fcb841ee
Opcode Fuzzy Hash: f828f983e790094a28bbb2a708ea9e09a06a1c05030c6f23811644e6675f23a9
Instruction Fuzzy Hash: 5921622090D672E5FF50BB60AC5527BE698BF14308FC40539C48D872A2DF7CA4479635

Function 00007FF746D93D00 Relevance: 3.1, APIs: 2, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fseeki64.LIBCMT ref: 00007FF746D93D68
fgetpos.LIBCMT ref: 00007FF746D93D7D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: 2d07afbde344102b07baddbf295aeba4b69dc366d2f8b588f6cf9893c080d52c
Instruction ID: 84d1dec1430a8524a3072c8ce8aa64aee5441a8709c1971fe8cce29ebe3c9b38
Opcode Fuzzy Hash: 2d07afbde344102b07baddbf295aeba4b69dc366d2f8b588f6cf9893c080d52c
Instruction Fuzzy Hash: A1212B32A08B45C6EF54AF2AE9503AAE3A4F785B94F454031DB4C87765EF38D8668710

Function 00007FF746D74980 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF746D74C14

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: 9b44925c02c2e88953423d10a3ad63bf04538ca92b4ab34bcf1bfa73036b6fc8
Instruction ID: f2131d67cb7fd2d7ba700b03b903662808983b6acc16dd9561934f3f484a31d4
Opcode Fuzzy Hash: 9b44925c02c2e88953423d10a3ad63bf04538ca92b4ab34bcf1bfa73036b6fc8
Instruction Fuzzy Hash: D9915C32618B81C5EB20EF25D8907AEB7A1F781798F904035EA4D47B99DF39E485C750

Function 00007FF746D98510 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xbad_alloc.LIBCPMT ref: 00007FF746D9859D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Xbad_allocstd::_
String ID:
API String ID: 3176948561-0
Opcode ID: 65db9a40eaa5fbbba215111751e52e9e89efcc606b35c70aad929287497c0950
Instruction ID: e43708cae908247e1446e386cfc78af946e33f83b83c5341bfafd5636ff76b06
Opcode Fuzzy Hash: 65db9a40eaa5fbbba215111751e52e9e89efcc606b35c70aad929287497c0950
Instruction Fuzzy Hash: D0219161A0D742C1FF64BA29990017AE2909B52FF4F908B34DE3E077D9EE38D44A8A50

Function 00007FF746D95E90 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

fclose.LIBCMT ref: 00007FF746D95EC9

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: fclose
String ID:
API String ID: 3125558077-0
Opcode ID: 5a875a415c49c9c20a898516846b72c16f7ad0147206709a1b9ba25a693ae870
Instruction ID: f081e655891f616a97681084821a6b09607821911054eaaa23ebe0c322b8bb70
Opcode Fuzzy Hash: 5a875a415c49c9c20a898516846b72c16f7ad0147206709a1b9ba25a693ae870
Instruction Fuzzy Hash: F4210332609B80C5DB019F39E490399B7A8FB98F88F544136CA8D87758EF35C896C790

Function 00007FF746D73730 Relevance: 1.5, APIs: 1, Instructions: 28networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF746D73785

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d796a6bf9521cb0195dfca69093e4acaf78ed48d890644789f0a43a6fc02fca1
Instruction ID: d9284b85f2404e6d3add619ac03c9c3e126551ff2e83c9e9b65550ab66c03fe0
Opcode Fuzzy Hash: d796a6bf9521cb0195dfca69093e4acaf78ed48d890644789f0a43a6fc02fca1
Instruction Fuzzy Hash: CD011D34E1D652C6FF90B714EC613B7E394BBA9344FC01035C90D46345EE2CE4028E50

Function 00007FF746D8D640 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF746D8D677

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: d06215beca06562395e28bd098bf8e419738607fef14e18969a7b4fe457cafd1
Instruction ID: 6eb344356625ebfb453731a27235bbc6819852aef130e49fd4ca3f5340d65286
Opcode Fuzzy Hash: d06215beca06562395e28bd098bf8e419738607fef14e18969a7b4fe457cafd1
Instruction Fuzzy Hash: 45F08511F0C242C2EF143726AC820BFE1926F88744FC44035E65E873C3EE2CE84A8B20

Function 00007FF746DA7C2F Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF746DA7C26
malloc.LIBCMT ref: 00007FF746DA7C32

Part of subcall function 00007FF746DA5C2C: _FF_MSGBANNER.LIBCMT ref: 00007FF746DA5C5C
Part of subcall function 00007FF746DA5C2C: _NMSG_WRITE.LIBCMT ref: 00007FF746DA5C66
Part of subcall function 00007FF746DA5C2C: HeapAlloc.KERNEL32(?,?,00000000,00007FF746DAAE48,?,?,?,00007FF746DA93C0,?,?,?,00007FF746DA92BF), ref: 00007FF746DA5C81
Part of subcall function 00007FF746DA5C2C: _callnewh.LIBCMT ref: 00007FF746DA5C9A
Part of subcall function 00007FF746DA5C2C: _errno.LIBCMT ref: 00007FF746DA5CA5
Part of subcall function 00007FF746DA5C2C: _errno.LIBCMT ref: 00007FF746DA5CB0

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _callnewh_errno$AllocHeapmalloc
String ID:
API String ID: 3727741168-0
Opcode ID: 6e648e51d8c46801f16917810c9e2fad3662a4875bcee400e5c3c3c9bf6f3398
Instruction ID: 0e1a2b18d924fba6f4240b6caa4f5bde27cf2b7756818406ba508faf351a6a91
Opcode Fuzzy Hash: 6e648e51d8c46801f16917810c9e2fad3662a4875bcee400e5c3c3c9bf6f3398
Instruction Fuzzy Hash: FBB01281E0E303D1FD0532111801139C1400F40341C8C08308C0E003C75D2CE8914832

Non-executed Functions

Function 00007FF746D7E480 Relevance: 180.7, APIs: 2, Strings: 100, Instructions: 2243COMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 00007FF746D7EC5A

Part of subcall function 00007FF746DA7BB8: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF746DA7BC6

rand.LIBCMT ref: 00007FF746D80C56

Part of subcall function 00007FF746D7E1B0: _time64.LIBCMT ref: 00007FF746D7E1BB

Strings

error:, xrefs: 00007FF746D802DC, 00007FF746D80455
&p=, xrefs: 00007FF746D7F9AB
activate, xrefs: 00007FF746D7E52B, 00007FF746D7F6E0
Server says license is expired (L, xrefs: 00007FF746D806C4
doOnlineCheck: license type not suited for online check (FLT/FSU/BTA/#OFF), skipping online check, xrefs: 00007FF746D7E8FC
Invalidating local license, xrefs: 00007FF746D80EFD
days ago, so starting new grace period of , xrefs: 00007FF746D7F0F7
Updating local license (lastActivationTryTimestamp) with , xrefs: 00007FF746D80A2E
days, xrefs: 00007FF746D7F15C, 00007FF746D7F198
com/api/, xrefs: 00007FF746D7F36C
Trigger for , xrefs: 00007FF746D7EF38
result:, xrefs: 00007FF746D803F0
error_code:, xrefs: 00007FF746D802F3
license, xrefs: 00007FF746D7F619
aescripts-license-fw/, xrefs: 00007FF746D7FDF0
days) - activation step #, xrefs: 00007FF746D7F029
Product has been successfully activated more than 4 times - skipping online check in future, xrefs: 00007FF746D7ECAB
Online check return code of web request: , xrefs: 00007FF746D7FEDD
Online check disabled - return, xrefs: 00007FF746D8108E
Server response: , xrefs: 00007FF746D800CF
days, enforcing activation, xrefs: 00007FF746D7F26F
v1/, xrefs: 00007FF746D7F39C
Server did not respond or came back with an invalid response, but activation is enforced, so invalidating local license, xrefs: 00007FF746D80642
(e: , xrefs: 00007FF746D7FC02
Product has been successfully activated within the last , xrefs: 00007FF746D7F0B3
doOnlineCheck: invalid license (trial license), skipping online check, xrefs: 00007FF746D7E5C9
Server sent device_id , xrefs: 00007FF746D80986
Server says license is invalid (E, xrefs: 00007FF746D8060E
Server says subscription is invalid (L, xrefs: 00007FF746D80781
doOnlineCheck start, mode , xrefs: 00007FF746D7E55D
BTA, xrefs: 00007FF746D7E78F
days, so no further online check is necessary at the moment, xrefs: 00007FF746D7F0CB
ps:, xrefs: 00007FF746D7F56A
|o:, xrefs: 00007FF746D80AA2, 00007FF746D80D36
Server says payload is invalid (E, xrefs: 00007FF746D805AA
code:, xrefs: 00007FF746D804B3
Server says license is valid, xrefs: 00007FF746D8081A
Product has not been activated, doing online check, xrefs: 00007FF746D7F1F5
(permanent activation!), xrefs: 00007FF746D80CA0
1.0.0, xrefs: 00007FF746D80F58
&lic=, xrefs: 00007FF746D7FCC4
|d:, xrefs: 00007FF746D7F80D, 00007FF746D80B4D, 00007FF746D80E3C
TLC, xrefs: 00007FF746D7FA5F
Online check end, xrefs: 00007FF746D81063
Server says record not found (E, xrefs: 00007FF746D805CD
, 'license_status' = , xrefs: 00007FF746D80691
Server says license is over activation limit (L, xrefs: 00007FF746D80703
, 'error_code' = , xrefs: 00007FF746D80572
Product has not been activated, but online check already done today, xrefs: 00007FF746D7F20B
SUB, xrefs: 00007FF746D7EE2F, 00007FF746D80C1F
aescripts, xrefs: 00007FF746D7F409
sending device ID , xrefs: 00007FF746D7FBE4
days is over, so successfuly online check is immediately necessary, xrefs: 00007FF746D7F13B
ESB, xrefs: 00007FF746D7EE85, 00007FF746D80C37
|a:, xrefs: 00007FF746D80AB7, 00007FF746D80D4B
t, xrefs: 00007FF746D80F2D
': , xrefs: 00007FF746D7FEA4
Updating local license (lastActivationTryTimestamp and lastActivationTimestamp) with , xrefs: 00007FF746D80C80, 00007FF746D80CAE
Server says deactivation successful, xrefs: 00007FF746D807C7
Online check start: lastActivation: , xrefs: 00007FF746D7EECB
Received a valid response from the server, 'status' = 'ok', 'code' = , xrefs: 00007FF746D8064E, 00007FF746D80671
Server says missing device ID (E, xrefs: 00007FF746D805F0
Using online check URL: , xrefs: 00007FF746D7F772
&device_id=, xrefs: 00007FF746D7FB9F
Product is over the initial grace period of , xrefs: 00007FF746D7F24F
//ipa, xrefs: 00007FF746D7F57E
id:, xrefs: 00007FF746D80836
WARNING: Server response is not encrypted - tolerated for now, but should be changed to an ecrypted text!, xrefs: 00007FF746D80093
Product has been successfully activated before, but more than , xrefs: 00007FF746D7F0DC, 00007FF746D7F10B
WARNING: no local device ID found to send to server for deactivation!, xrefs: 00007FF746D7FC59
1.0.0|||||, xrefs: 00007FF746D7FA74
#OFF, xrefs: 00007FF746D7E85A
deactivate, xrefs: 00007FF746D7E549
bytes received, xrefs: 00007FF746D7FF24
and initializing lastActivationTimestamp, xrefs: 00007FF746D80A47
Online check send data for ', xrefs: 00007FF746D7FE81
Invalid response from server for deactivation, xrefs: 00007FF746D807EF
days ago, grace period of , xrefs: 00007FF746D7F125
FLT, xrefs: 00007FF746D7E6DB
Next required successful online activation check in , xrefs: 00007FF746D7F173
20241006, xrefs: 00007FF746D7FDDB
Product requires an immediate successful online activation!, xrefs: 00007FF746D7EF7B
Server says license is invalid (L, xrefs: 00007FF746D80742, 00007FF746D809BD
&mode=, xrefs: 00007FF746D7FC7C
days (currently , xrefs: 00007FF746D7F010
activation of this product, xrefs: 00007FF746D7EF59
|a:1, xrefs: 00007FF746D80F95
Server did not respond or came back with an invalid response, xrefs: 00007FF746D80536
p, xrefs: 00007FF746D7FE67
doOnlineCheck: invalid license, skipping online check, xrefs: 00007FF746D7EB89
FSU, xrefs: 00007FF746D7E735
Updating local license (lastActivationTryTimestamp only) with , xrefs: 00007FF746D80A55
, lastActivationTry: , xrefs: 00007FF746D7EEF0
doOnlineCheck: product is permanently activated - skipping online check, xrefs: 00007FF746D7EBAD
Product has been successfully activated before and is still in allowed period of , xrefs: 00007FF746D7F144
Product needs activation, as it it over the activation interval of , xrefs: 00007FF746D7EFEF
), so invalidating local license, xrefs: 00007FF746D806E2, 00007FF746D80721, 00007FF746D80760, 00007FF746D8079F
c, xrefs: 00007FF746D803C1
Received a valid response from the server, 'status' = 'error', 'code' = , xrefs: 00007FF746D80552
_status:, xrefs: 00007FF746D803D5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Time_time64$FileSystemrand
String ID: (e: $ (permanent activation!)$ and initializing lastActivationTimestamp$ bytes received$ days$ days (currently $ days ago, grace period of $ days ago, so starting new grace period of $ days is over, so successfuly online check is immediately necessary$ days) - activation step #$ days, enforcing activation$ days, so no further online check is necessary at the moment$#OFF$&device_id=$&lic=$&mode=$&p=$': $), so invalidating local license$, 'error_code' = $, 'license_status' = $, lastActivationTry: $//ipa$1.0.0$1.0.0|||||$20241006$BTA$ESB$FLT$FSU$Invalid response from server for deactivation$Invalidating local license$Next required successful online activation check in $Online check disabled - return$Online check end$Online check return code of web request: $Online check send data for '$Online check start: lastActivation: $Product has been successfully activated before and is still in allowed period of $Product has been successfully activated before, but more than $Product has been successfully activated more than 4 times - skipping online check in future$Product has been successfully activated within the last $Product has not been activated, but online check already done today$Product has not been activated, doing online check$Product is over the initial grace period of $Product needs activation, as it it over the activation interval of $Product requires an immediate successful online activation!$Received a valid response from the server, 'status' = 'error', 'code' = $Received a valid response from the server, 'status' = 'ok', 'code' = $SUB$Server did not respond or came back with an invalid response$Server did not respond or came back with an invalid response, but activation is enforced, so invalidating local license$Server response: $Server says deactivation successful$Server says license is expired (L$Server says license is invalid (E$Server says license is invalid (L$Server says license is over activation limit (L$Server says license is valid$Server says missing device ID (E$Server says payload is invalid (E$Server says record not found (E$Server says subscription is invalid (L$Server sent device_id $TLC$Trigger for $Updating local license (lastActivationTryTimestamp and lastActivationTimestamp) with $Updating local license (lastActivationTryTimestamp only) with $Updating local license (lastActivationTryTimestamp) with $Using online check URL: $WARNING: Server response is not encrypted - tolerated for now, but should be changed to an ecrypted text!$WARNING: no local device ID found to send to server for deactivation!$_status:$activate$activation of this product$aescripts$aescripts-license-fw/$c$code:$com/api/$deactivate$doOnlineCheck start, mode $doOnlineCheck: invalid license (trial license), skipping online check$doOnlineCheck: invalid license, skipping online check$doOnlineCheck: license type not suited for online check (FLT/FSU/BTA/#OFF), skipping online check$doOnlineCheck: product is permanently activated - skipping online check$error:$error_code:$id:$license$p$ps:$result:$sending device ID $t$v1/$|a:$|a:1$|d:$|o:
API String ID: 2872900303-3171066617
Opcode ID: 76b10ab93aa04b2c8b0ad846a928d2e8ce072a53fd178dbdec2aac89510018cd
Instruction ID: ab8fb81be110ecc22c8540cef0649b45ff5bdc226581e81629115f6b3d122513
Opcode Fuzzy Hash: 76b10ab93aa04b2c8b0ad846a928d2e8ce072a53fd178dbdec2aac89510018cd
Instruction Fuzzy Hash: 5D335B61A0CA82D0EE60FB15EC553FBE361EB86784FC00136D59D466EAEF2CD549CB60

Function 00007FF746D8FB3E Relevance: 55.9, Strings: 44, Instructions: 905COMMON

Download Yara Rule

Strings

status: floating licenses can only be used with the floating license server, xrefs: 00007FF746D902D8
number of user licenses: , xrefs: 00007FF746D90ABB
writing new license to file, xrefs: 00007FF746D9030D
S, xrefs: 00007FF746D904C8
SUB, xrefs: 00007FF746D90683
to , xrefs: 00007FF746D90775
-, xrefs: 00007FF746D8FE3B
result: , xrefs: 00007FF746D90080, 00007FF746D902A9, 00007FF746D905B5
license start: ', xrefs: 00007FF746D9016A, 00007FF746D90C33
ESB, xrefs: 00007FF746D9069A
a_succ: , xrefs: 00007FF746D9061D
FLT, xrefs: 00007FF746D8FD14, 00007FF746D9023C
product ID: ', xrefs: 00007FF746D90B16
DATA*, xrefs: 00007FF746D903FB
J, xrefs: 00007FF746D90671
content, xrefs: 00007FF746D8FB75
valid, xrefs: 00007FF746D90701
last name: ', xrefs: 00007FF746D90A8D
:, xrefs: 00007FF746D904A1
local license deactivated, xrefs: 00007FF746D8FEF9
l, xrefs: 00007FF746D9070F
WARNING: invalid machine ID - there was a problem reading your network adapter data!, xrefs: 00007FF746D90CE3
license end: ', xrefs: 00007FF746D9019B, 00007FF746D90C64
FILE*, xrefs: 00007FF746D903BE
, xrefs: 00007FF746D904BB
FSU, xrefs: 00007FF746D8FCE7, 00007FF746D90283
loading license directly (*, xrefs: 00007FF746D90461
license type: ', xrefs: 00007FF746D90AE8
D, xrefs: 00007FF746D904D7
remote license lease dropped, xrefs: 00007FF746D8FE14
t, xrefs: 00007FF746D8FE2F
1.0.0, xrefs: 00007FF746D8FDD0, 00007FF746D8FF61
product version: ', xrefs: 00007FF746D90B44
first name: ', xrefs: 00007FF746D90A5F
-content, xrefs: 00007FF746D8FB5A, 00007FF746D8FC1E
a_next: , xrefs: 00007FF746D906BF
, xrefs: 00007FF746D903B8
status: , xrefs: 00007FF746D900B6, 00007FF746D90A26
invalid, xrefs: 00007FF746D906E5
a_try: , xrefs: 00007FF746D905E1
_RENDER_ONLY, xrefs: 00007FF746D8FFF8, 00007FF746D9000E
(limited license period from , xrefs: 00007FF746D90761
-, xrefs: 00007FF746D904AE
serial: ', xrefs: 00007FF746D90B75

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: AttributesFile
String ID: (limited license period from $ to $-$-content$1.0.0$DATA*$ESB$FILE*$FLT$FSU$SUB$WARNING: invalid machine ID - there was a problem reading your network adapter data!$_RENDER_ONLY$a_next: $a_succ: $a_try: $content$first name: '$invalid$last name: '$license end: '$license start: '$license type: '$loading license directly (*$local license deactivated$number of user licenses: $product ID: '$product version: '$remote license lease dropped$result: $serial: '$status: $status: floating licenses can only be used with the floating license server$t$valid$writing new license to file$ $-$:$D$J$S$l$
API String ID: 3188754299-916615497
Opcode ID: e002cb56796556247d3cc60f55a90bf9c91938eb4366fbb0ff23aed608770551
Instruction ID: f15b90c417f185d652bdcbeb51d878fde69c32bc19709f4b28a34d8825044389
Opcode Fuzzy Hash: e002cb56796556247d3cc60f55a90bf9c91938eb4366fbb0ff23aed608770551
Instruction Fuzzy Hash: FF920F61A1D982D4EF24FB25DC512FBE361AF56388FC05436D50D4B6AAFE2CD608CB60

Function 00007FF746D7A740 Relevance: 39.3, APIs: 14, Strings: 8, Instructions: 764networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF746D7AF02
InternetSetOptionA.WININET ref: 00007FF746D7AF2C
InternetSetOptionA.WININET ref: 00007FF746D7AF44
InternetSetOptionA.WININET ref: 00007FF746D7AF5C
InternetConnectA.WININET ref: 00007FF746D7B0AA
HttpOpenRequestA.WININET ref: 00007FF746D7B113
HttpSendRequestA.WININET ref: 00007FF746D7B4D3
HttpQueryInfoA.WININET ref: 00007FF746D7B4FC
InternetReadFile.WININET ref: 00007FF746D7B534
GetLastError.KERNEL32 ref: 00007FF746D7B5C0
HttpQueryInfoA.WININET ref: 00007FF746D7B5E3
InternetCloseHandle.WININET ref: 00007FF746D7B686
InternetCloseHandle.WININET ref: 00007FF746D7B694
InternetCloseHandle.WININET ref: 00007FF746D7B6A2

Strings

POST, xrefs: 00007FF746D7B0E3
https://, xrefs: 00007FF746D7AA8D, 00007FF746D7AB0F
GET, xrefs: 00007FF746D7B0EA
http://, xrefs: 00007FF746D7AC4B
Content-Type, xrefs: 00007FF746D7B182
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF746D7B146
t, xrefs: 00007FF746D7AA44
Mozilla/5.0 (Compatible), xrefs: 00007FF746D7AEC4

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Internet$Http$CloseHandleOption$InfoOpenQueryRequest$ConnectErrorFileLastReadSend
String ID: Content-Type$Content-Type: application/x-www-form-urlencoded$GET$Mozilla/5.0 (Compatible)$POST$http://$https://$t
API String ID: 1486255883-1336110008
Opcode ID: ba58e2f75b416f112594b53a6ae6878838e6ba7699d92f3cd6147f220f0cb922
Instruction ID: f4a031d15c024ae24db8fa32f3fd4cb25fa779760674b1a2ec2161e7481762b4
Opcode Fuzzy Hash: ba58e2f75b416f112594b53a6ae6878838e6ba7699d92f3cd6147f220f0cb922
Instruction Fuzzy Hash: 4982033661CAC2C1EB31AB14E8547EBE3A1FB89784F804136D68D47A9ADF7DD148CB11

Function 00007FF746DC1450 Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF746DC14B1

Part of subcall function 00007FF746DA5D80: _getptd.LIBCMT ref: 00007FF746DA5D96
Part of subcall function 00007FF746DA5D80: __updatetlocinfo.LIBCMT ref: 00007FF746DA5DCB
Part of subcall function 00007FF746DA5D80: __updatetmbcinfo.LIBCMT ref: 00007FF746DA5DF2

_errno.LIBCMT ref: 00007FF746DC14B6

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

_fileno.LIBCMT ref: 00007FF746DC14E3

Part of subcall function 00007FF746DAD528: _errno.LIBCMT ref: 00007FF746DAD531
Part of subcall function 00007FF746DAD528: _invalid_parameter_noinfo.LIBCMT ref: 00007FF746DAD53C

write_multi_char.LIBCMT ref: 00007FF746DC1B1F
write_string.LIBCMT ref: 00007FF746DC1B3C
write_multi_char.LIBCMT ref: 00007FF746DC1B59
write_string.LIBCMT ref: 00007FF746DC1BB8
write_string.LIBCMT ref: 00007FF746DC1BEF
write_multi_char.LIBCMT ref: 00007FF746DC1C11
free.LIBCMT ref: 00007FF746DC1C25
_isleadbyte_l.LIBCMT ref: 00007FF746DC1CF6
write_char.LIBCMT ref: 00007FF746DC1D0C
write_char.LIBCMT ref: 00007FF746DC1D2D
_errno.LIBCMT ref: 00007FF746DC1E30
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC1E3B

Strings

, xrefs: 00007FF746DC1AF3
@, xrefs: 00007FF746DC14CF

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 88c9b5e4abb27927cb064ca53120f5ed29995979e43e2f8379dfcc59aa9e6c90
Instruction ID: 80cff5ff623d19eb5a16fe93f49c18d44a216b31821b538f87fffd35cca8d514
Opcode Fuzzy Hash: 88c9b5e4abb27927cb064ca53120f5ed29995979e43e2f8379dfcc59aa9e6c90
Instruction Fuzzy Hash: EF52E022A0C6AAC5FF64BA158D4077FEAA4BF49780F940135DB4E566D4DF3CE8418FA0

Function 00007FF746DADBB4 Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 687COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF746DADC15

Part of subcall function 00007FF746DA5D80: _getptd.LIBCMT ref: 00007FF746DA5D96
Part of subcall function 00007FF746DA5D80: __updatetlocinfo.LIBCMT ref: 00007FF746DA5DCB
Part of subcall function 00007FF746DA5D80: __updatetmbcinfo.LIBCMT ref: 00007FF746DA5DF2

_errno.LIBCMT ref: 00007FF746DADC1A

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

_fileno.LIBCMT ref: 00007FF746DADC47

Part of subcall function 00007FF746DAD528: _errno.LIBCMT ref: 00007FF746DAD531
Part of subcall function 00007FF746DAD528: _invalid_parameter_noinfo.LIBCMT ref: 00007FF746DAD53C

write_multi_char.LIBCMT ref: 00007FF746DAE277
write_string.LIBCMT ref: 00007FF746DAE294
write_multi_char.LIBCMT ref: 00007FF746DAE2B1
write_string.LIBCMT ref: 00007FF746DAE310
write_string.LIBCMT ref: 00007FF746DAE347
write_multi_char.LIBCMT ref: 00007FF746DAE369
free.LIBCMT ref: 00007FF746DAE37D
_isleadbyte_l.LIBCMT ref: 00007FF746DAE44E
write_char.LIBCMT ref: 00007FF746DAE464
write_char.LIBCMT ref: 00007FF746DAE485
_errno.LIBCMT ref: 00007FF746DAE57F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DAE58A

Strings

%li.%li.%li.%li, xrefs: 00007FF746DADBBB
, xrefs: 00007FF746DAE24B

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $%li.%li.%li.%li
API String ID: 3318157856-2495504251
Opcode ID: 53a93e026cdb33f0ba4079394c99ec866ed19bb3243859ba2758b9384a7bb7d4
Instruction ID: 26130181bb78558dc2cb17be07c445b9e0bc076c4bb7550bd50532144acbc55c
Opcode Fuzzy Hash: 53a93e026cdb33f0ba4079394c99ec866ed19bb3243859ba2758b9384a7bb7d4
Instruction Fuzzy Hash: 6752CF22A0C696C5FF64BA16984437FEAA0BF45780F944036DA8E467E4DF7DE940DF20

Function 00007FF746D754A0 Relevance: 33.8, APIs: 17, Strings: 2, Instructions: 574timesleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746D75190: SHGetFolderPathA.SHELL32 ref: 00007FF746D75250

SetFileAttributesA.KERNEL32 ref: 00007FF746D75552
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF746D75901
_time64.LIBCMT ref: 00007FF746D75911
Sleep.KERNEL32 ref: 00007FF746D75930
_time64.LIBCMT ref: 00007FF746D75967
_time64.LIBCMT ref: 00007FF746D75988
_time64.LIBCMT ref: 00007FF746D7599E
rand.LIBCMT ref: 00007FF746D75B3A
rand.LIBCMT ref: 00007FF746D75B66
SetFileAttributesA.KERNEL32 ref: 00007FF746D75DAD
GetSystemTime.KERNEL32 ref: 00007FF746D75DBA
rand.LIBCMT ref: 00007FF746D75DC0
SystemTimeToFileTime.KERNEL32 ref: 00007FF746D75E06
CreateFileA.KERNEL32 ref: 00007FF746D75E44
SetFileTime.KERNEL32 ref: 00007FF746D75E5F
CloseHandle.KERNEL32 ref: 00007FF746D75E68
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF746D75EE7

Part of subcall function 00007FF746D98510: std::_Xbad_alloc.LIBCPMT ref: 00007FF746D9859D

Strings

string too long, xrefs: 00007FF746D75C43, 00007FF746D75C50
gfff, xrefs: 00007FF746D75DC8

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: File$Time_time64$rand$AttributesIos_base_dtorSystemstd::ios_base::_$CloseCreateFolderHandlePathSleepXbad_allocstd::_
String ID: gfff$string too long
API String ID: 438800184-2250279893
Opcode ID: f48570b9438044147d6169b71e2f6c8697e3a89a47b065e7cdbbb993b120ddd2
Instruction ID: 98218476d12de201bd1ffaceffe2f9e3cd6a0c7fa68c801e3d8ad9b2c01cc001
Opcode Fuzzy Hash: f48570b9438044147d6169b71e2f6c8697e3a89a47b065e7cdbbb993b120ddd2
Instruction Fuzzy Hash: 2B525D32609AC2D9EF70BF34CC543EEA361EB45748F800236DA5D4AA9ADF39D645C721

Function 00007FF746D8A594 Relevance: 28.5, APIs: 4, Strings: 12, Instructions: 543COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746D7E1B0: _time64.LIBCMT ref: 00007FF746D7E1BB

_errno.LIBCMT ref: 00007FF746D8ACE1
_errno.LIBCMT ref: 00007FF746D8AD90
_errno.LIBCMT ref: 00007FF746D8B009
_errno.LIBCMT ref: 00007FF746D8B0BA

Strings

@REMOTE, xrefs: 00007FF746D8A802
bytes to file , xrefs: 00007FF746D8AEC3, 00007FF746D8B187
FLT, xrefs: 00007FF746D8A5B9
l, xrefs: 00007FF746D8A7AE
(b, xrefs: 00007FF746D8AC73
FSU, xrefs: 00007FF746D8A615
writing , xrefs: 00007FF746D8AEA0, 00007FF746D8B14F
FAIL (, xrefs: 00007FF746D8AE4B, 00007FF746D8B10B
new license data: , xrefs: 00007FF746D8ACBD
Ub, xrefs: 00007FF746D8AC46
0, xrefs: 00007FF746D8AE60
new license data: trial license, xrefs: 00007FF746D8ACB4

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _errno$_time64
String ID: bytes to file $0$@REMOTE$FAIL ($FLT$FSU$new license data: $new license data: trial license$writing $l$(b$Ub
API String ID: 318442946-2718888663
Opcode ID: 2faf1186b392844c7a8e173c96a5c6931f4663901252734f3063624bf9146494
Instruction ID: 7a82d2695814ffe43533e2973144984ac5f72ef004a0d49ad20301202e12db9c
Opcode Fuzzy Hash: 2faf1186b392844c7a8e173c96a5c6931f4663901252734f3063624bf9146494
Instruction Fuzzy Hash: 38423B62A0DAC2C1EE30BB15E8543EBE761EB82784FC44135D69D47A9AEF2CD548CF50

Function 00007FF746D85050 Relevance: 23.8, APIs: 5, Strings: 8, Instructions: 1078COMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 00007FF746D850A1

Part of subcall function 00007FF746DA7BB8: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF746DA7BC6

Part of subcall function 00007FF746DA728C: _getptd.LIBCMT ref: 00007FF746DA7294

rand.LIBCMT ref: 00007FF746D85B16
_time64.LIBCMT ref: 00007FF746D85B97

Strings

@REMOTE, xrefs: 00007FF746D8525D
FLT, xrefs: 00007FF746D86445
FSU, xrefs: 00007FF746D86471
_RENDER_ONLY, xrefs: 00007FF746D8532D, 00007FF746D854A8, 00007FF746D857CB
FLT, xrefs: 00007FF746D85B0A
gfff, xrefs: 00007FF746D86268
gfff, xrefs: 00007FF746D85B9F
1.0.0, xrefs: 00007FF746D850BE

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Time_time64$FileSystem_getptdrand
String ID: 1.0.0$@REMOTE$FLT$FLT$FSU$_RENDER_ONLY$gfff$gfff
API String ID: 2056829080-791714639
Opcode ID: fb20300fa841780d844b4cdcaf53c710758ea8605ded05741403712cfa48ef4a
Instruction ID: ec0aeaf3f26aa022e9a3f02d12b3294a663a7fb463ee7389611b6a3efb26777f
Opcode Fuzzy Hash: fb20300fa841780d844b4cdcaf53c710758ea8605ded05741403712cfa48ef4a
Instruction Fuzzy Hash: 0FB23B2260CAC2C1EFB0BB24E8547EBE751EB82744F904535D69D46AAADF7CD489CF10

Function 00007FF746D86F32 Relevance: 19.2, Strings: 14, Instructions: 1678COMMON

Download Yara Rule

Strings

@REMOTE, xrefs: 00007FF746D88018, 00007FF746D88622, 00007FF746D8870E, 00007FF746D88BF5, 00007FF746D88FAD
|o:, xrefs: 00007FF746D88851
no matching machine ID found!, xrefs: 00007FF746D87F19
license data: , xrefs: 00007FF746D88304
000000000000, xrefs: 00007FF746D87D7C
|d:, xrefs: 00007FF746D88A1F
TLC, xrefs: 00007FF746D88EF9
|a:, xrefs: 00007FF746D888D9
DATA*, xrefs: 00007FF746D8807B
*****, xrefs: 00007FF746D86F5B
_RENDER_ONLY, xrefs: 00007FF746D890C6, 00007FF746D890DE
trial license found (no valid license data), xrefs: 00007FF746D882EE
LICS*, xrefs: 00007FF746D8796D, 00007FF746D87F77, 00007FF746D880DA
acde48001122, xrefs: 00007FF746D87DD6

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID: *****$000000000000$@REMOTE$DATA*$LICS*$TLC$_RENDER_ONLY$acde48001122$license data: $no matching machine ID found!$trial license found (no valid license data)$|a:$|d:$|o:
API String ID: 0-3095003553
Opcode ID: 26b0d6aed7b2d02e8b74628cebc35146b0c6599b3a704bc69bcfaeb2a67077dd
Instruction ID: 0e4dfbc56ba15e506b9c9da1f5566c3bbd389323ec9298ca7e0fda4dc24a86e3
Opcode Fuzzy Hash: 26b0d6aed7b2d02e8b74628cebc35146b0c6599b3a704bc69bcfaeb2a67077dd
Instruction Fuzzy Hash: 55034E2261C6C2D1EF31BA15E8943FBE761FB96784F800132D69D47A9AEE2CD509CF50

Function 00007FF746D83470 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 790COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746D81EE0: SHGetFolderPathA.SHELL32 ref: 00007FF746D81FC2
Part of subcall function 00007FF746D81EE0: remove.LIBCMT ref: 00007FF746D82080
Part of subcall function 00007FF746D81EE0: remove.LIBCMT ref: 00007FF746D820AD

_wgetenv.LIBCMT ref: 00007FF746D83E26

Part of subcall function 00007FF746DA7A0C: _errno.LIBCMT ref: 00007FF746DA7A21
Part of subcall function 00007FF746DA7A0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF746DA7A2C

Strings

</string>, xrefs: 00007FF746D83775
LicensingBackupServer_Port, xrefs: 00007FF746D83BFF
LicensingServer_Address, xrefs: 00007FF746D83B49
aescriptsLicensingServer, xrefs: 00007FF746D8357A, 00007FF746D835F3, 00007FF746D83E1F, 00007FF746D83ED9
LicensingBackupServer_Address, xrefs: 00007FF746D83BC6
LicensingServer_Port, xrefs: 00007FF746D83B89
<key>, xrefs: 00007FF746D83759
27100, xrefs: 00007FF746D83C61

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: remove$FolderPath_errno_invalid_parameter_noinfo_wgetenv
String ID: 27100$</string>$<key>$LicensingBackupServer_Address$LicensingBackupServer_Port$LicensingServer_Address$LicensingServer_Port$aescriptsLicensingServer
API String ID: 2317211808-1479187049
Opcode ID: 411b386f009fd4ea07bcd56b4c65bfa66c3fa2465820cf6a174a641641dffbc7
Instruction ID: f72304a6cdc0be8bd04e62a8cef0f1bd3e2d8c2edff68f1c7b0661b089eb7f12
Opcode Fuzzy Hash: 411b386f009fd4ea07bcd56b4c65bfa66c3fa2465820cf6a174a641641dffbc7
Instruction Fuzzy Hash: EC727232A0C781C5EF10FF65D8843EEAB61EB41788F801035EA5D5BA9ADF39D589CB50

Function 00007FF746D74030 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF746D740A8
GetAdaptersInfo.IPHLPAPI ref: 00007FF746D740BD
free.LIBCMT ref: 00007FF746D740CB
malloc.LIBCMT ref: 00007FF746D740D4
GetAdaptersInfo.IPHLPAPI ref: 00007FF746D740E9
free.LIBCMT ref: 00007FF746D740F6
sprintf.LIBCMT ref: 00007FF746D74373
free.LIBCMT ref: 00007FF746D74635

Strings

%li.%li.%li.%li, xrefs: 00007FF746D74368

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: free$AdaptersInfomalloc$sprintf
String ID: %li.%li.%li.%li
API String ID: 3176089250-1731176481
Opcode ID: d10cdf357ab2bc3959a5a3fc129a597d6f23535822cbe3174e1f630efbb2aa6d
Instruction ID: ba858d53802cee5fdeb659e3ad0acba55de5594ad21e55d0c2caf21cadeafa2e
Opcode Fuzzy Hash: d10cdf357ab2bc3959a5a3fc129a597d6f23535822cbe3174e1f630efbb2aa6d
Instruction Fuzzy Hash: 52128C22A1CB91C9EF11EF64E8403AEB7A0FB45798F940235EA5D47AD9CF38D440CB50

Function 00007FF746D739F0 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 373windownetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32 ref: 00007FF746D73A4A
getaddrinfo.WS2_32 ref: 00007FF746D73EA9
FormatMessageA.KERNEL32 ref: 00007FF746D73EE2
inet_ntop.WS2_32 ref: 00007FF746D73F80
freeaddrinfo.WS2_32 ref: 00007FF746D73FF9

Strings

.local, xrefs: 00007FF746D73DBE
.localdomain, xrefs: 00007FF746D73CDE
getaddrinfo error , xrefs: 00007FF746D73EE8

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: FormatMessagefreeaddrinfogetaddrinfogethostnameinet_ntop
String ID: .local$.localdomain$getaddrinfo error
API String ID: 1835220482-1587782278
Opcode ID: 4227a21081fd419a4c05240025a767e1e5a9454a560846ddd155f91dd31bdc0c
Instruction ID: a0125af90a38b2d0f90c0314cd77ff7722983b00ce6b698929f59f322f279e50
Opcode Fuzzy Hash: 4227a21081fd419a4c05240025a767e1e5a9454a560846ddd155f91dd31bdc0c
Instruction Fuzzy Hash: F7026A32A1DB92C9EB00FB74EC403AEA7A1FB41758F800235EA5D17A9ADF78D544CB50

Function 00007FF746D865D0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 314COMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 00007FF746D8672A

Strings

@REMOTE, xrefs: 00007FF746D86696, 00007FF746D86ABD
TLC, xrefs: 00007FF746D8689C
FLT, xrefs: 00007FF746D86869
K, xrefs: 00007FF746D86690
_RENDER_ONLY, xrefs: 00007FF746D869C2, 00007FF746D86A69
1.0.0, xrefs: 00007FF746D8670E, 00007FF746D86748

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _time64
String ID: 1.0.0$@REMOTE$FLT$TLC$_RENDER_ONLY$K
API String ID: 1670930206-2998733053
Opcode ID: 6a2d34c6ceb55a6fa653833b9ca4c061a6abb3f4207e8aff040eca89f61d54ab
Instruction ID: 9334fc1885945e75d38977e8db4b8eedcac8f8c016ac742f8eee9d09f375f1f5
Opcode Fuzzy Hash: 6a2d34c6ceb55a6fa653833b9ca4c061a6abb3f4207e8aff040eca89f61d54ab
Instruction Fuzzy Hash: F6F18C22A1CA81C9FB20FB74DC443EEBB61EB41758F800136EA5D56ADADF78D145CB50

Function 00007FF746D82500 Relevance: 11.4, APIs: 4, Strings: 2, Instructions: 917COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746D737C0: GetUserNameA.ADVAPI32 ref: 00007FF746D73822

_Mtx_unlock.LIBCPMT ref: 00007FF746D82617
rand.LIBCMT ref: 00007FF746D828E9
closesocket.WS2_32 ref: 00007FF746D82F9E

Part of subcall function 00007FF746D735B0: recv.WS2_32 ref: 00007FF746D7360A

closesocket.WS2_32 ref: 00007FF746D833CA

Strings

DRPL, xrefs: 00007FF746D82F80
REQL, xrefs: 00007FF746D83366

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: closesocket$Mtx_unlockNameUserrandrecv
String ID: DRPL$REQL
API String ID: 2035232360-3605393878
Opcode ID: 721fc08aca532f495d05d118156107921167988e477034a3580ef18a1549f98c
Instruction ID: 573bfcf63b5211a6bc6ba516414465e81f182e97563f2c0dce2aec6b499e8ce0
Opcode Fuzzy Hash: 721fc08aca532f495d05d118156107921167988e477034a3580ef18a1549f98c
Instruction Fuzzy Hash: 79A27022A0CA82C9EF10BF71DC543EEA761EB41798F801535EA5D47ADADF78D184C7A0

Function 00007FF746D8BE20 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 465COMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 00007FF746D8C062
_time64.LIBCMT ref: 00007FF746D8C240
_time64.LIBCMT ref: 00007FF746D8C34A
_Mtx_unlock.LIBCPMT ref: 00007FF746D8C709

Strings

t~, xrefs: 00007FF746D8C31F
1.0.0, xrefs: 00007FF746D8BEEF, 00007FF746D8C084, 00007FF746D8C36C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _time64$Mtx_unlock
String ID: 1.0.0$t~
API String ID: 1903240241-4207783639
Opcode ID: c360343a8360908138749ddabf9604666f8e131e62fd64f0da7eb135858dfb96
Instruction ID: 8d0fcb30c7158781e5fab7519d74e6380812e35c48d13c7f7fd62a4cca26e9a1
Opcode Fuzzy Hash: c360343a8360908138749ddabf9604666f8e131e62fd64f0da7eb135858dfb96
Instruction Fuzzy Hash: C432497250C7C1C5EB71AB24E8443EBF6A4EB95764F804235D6E946AEADF3CD188CB10

Function 00007FF746D8CB40 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 446COMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 00007FF746D8CBCD
_time64.LIBCMT ref: 00007FF746D8CE1D
_Mtx_unlock.LIBCPMT ref: 00007FF746D8D407

Strings

@REMOTE, xrefs: 00007FF746D8D37E
content, xrefs: 00007FF746D8CEC8
1.0.0, xrefs: 00007FF746D8CBEA, 00007FF746D8CE3F

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _time64$Mtx_unlock
String ID: 1.0.0$@REMOTE$content
API String ID: 1903240241-4152950612
Opcode ID: 40e5f10e47ca47a6761a1aedc3e36bdca0f7d5396d43875c1889cb17a7612ab4
Instruction ID: 8882911b60f77d390ccc98386c548db5be5793085531d90231a4f0521643f84e
Opcode Fuzzy Hash: 40e5f10e47ca47a6761a1aedc3e36bdca0f7d5396d43875c1889cb17a7612ab4
Instruction Fuzzy Hash: CE323A7250CBC2C5EB71BB24E8443EBE6A0FB957A4F804235D6A946ADADF7CD044CB10

Function 00007FF746D78DD0 Relevance: 8.5, APIs: 3, Strings: 1, Instructions: 1485COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF746D7945F
_wcstoi64.LIBCMT ref: 00007FF746D7962C

Strings

2%i, xrefs: 00007FF746D79451

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _wcstoi64sprintf
String ID: 2%i
API String ID: 3955018481-70509047
Opcode ID: 5e23b37e2fdf3e6468c6f338f5f408d1b77b1317337c8013a83a54b6ab350443
Instruction ID: c6f9951feaba8124fe913fab0f70033d3217f223a070e7b6b8e7a611be64b9a8
Opcode Fuzzy Hash: 5e23b37e2fdf3e6468c6f338f5f408d1b77b1317337c8013a83a54b6ab350443
Instruction Fuzzy Hash: 6EE22E22A1D582D5EF20FB71CC553EEA360FB96388FC01531E64D87ADAEE29D618C750

Function 00007FF746D7CB60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 1071COMMON

Download Yara Rule

APIs

sprintf.LIBCMT ref: 00007FF746D7D776

Strings

1%i, xrefs: 00007FF746D7D768
7654321234567898, xrefs: 00007FF746D7DA06, 00007FF746D7DA2E, 00007FF746D7DA42, 00007FF746D7DA56, 00007FF746D7DA6A, 00007FF746D7DA7E
3194837251290356, xrefs: 00007FF746D7DA1A

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: sprintf
String ID: 1%i$3194837251290356$7654321234567898
API String ID: 590974362-2870800511
Opcode ID: 3398522d3731beca5f597bdad1c4eb6b5ef9381435dd5f48417ed061d0fb1c3a
Instruction ID: dba4d988131e68ee9f2cb7d26048a98bfe64da3e8ac19580cdcae89cfbc06df6
Opcode Fuzzy Hash: 3398522d3731beca5f597bdad1c4eb6b5ef9381435dd5f48417ed061d0fb1c3a
Instruction Fuzzy Hash: EFC23D22A0DA81D9EF20FF74DC543EEA760EB45348F804536DA4D5BAAADF38D648C750

Function 00007FF746D75F70 Relevance: 6.3, APIs: 4, Instructions: 327COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746D75190: SHGetFolderPathA.SHELL32 ref: 00007FF746D75250

_time64.LIBCMT ref: 00007FF746D763BA
_time64.LIBCMT ref: 00007FF746D76411
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF746D764B0
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF746D76510

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Ios_base_dtor_time64std::ios_base::_$FolderPath
String ID:
API String ID: 1954716527-0
Opcode ID: af25f6fde421100cb7257152a915afc76279274dcf84ef90c747a9d93e43852d
Instruction ID: dbde64dbc341513f3fe6454c1dab06d253e97ec285ec42ce30e07f8f3efb412d
Opcode Fuzzy Hash: af25f6fde421100cb7257152a915afc76279274dcf84ef90c747a9d93e43852d
Instruction Fuzzy Hash: 74F13D2260C6C2C9EF70BF34CC547EAA761EB41348F804135D65D4AADAEF78D689C751

Function 00007FF746D75190 Relevance: 4.7, APIs: 3, Instructions: 191COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 00007FF746D75250
CreateDirectoryA.KERNEL32 ref: 00007FF746D75382
SetFileAttributesA.KERNEL32 ref: 00007FF746D7539C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: AttributesCreateDirectoryFileFolderPath
String ID:
API String ID: 1991693529-0
Opcode ID: 82fd2451d5227bc0dcd1215ad816a73d7755197062dc978f56ad1395053a3863
Instruction ID: 9d890e9a9406a9e96acb71e6644280f768f258a794f4d809d78eb4d7440c950f
Opcode Fuzzy Hash: 82fd2451d5227bc0dcd1215ad816a73d7755197062dc978f56ad1395053a3863
Instruction Fuzzy Hash: 8D91A522A1CA91C5FF14BB64EC443AEE761FB417A8F901235EA6D07ADACF78D444CB11

Function 00007FF746D8F298 Relevance: 4.0, Strings: 3, Instructions: 296COMMON

Download Yara Rule

Strings

FILE*, xrefs: 00007FF746D8F53A
DATA*, xrefs: 00007FF746D8F551
- Unknown, xrefs: 00007FF746D8F8DF

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID: - Unknown$DATA*$FILE*
API String ID: 0-115703852
Opcode ID: e1c2be8004ab9af23c8c31ef78b101c7679321b3403413e10f1c5487ff0b581b
Instruction ID: ccd1a21307661e61d388a1752464846b8e2e4ea61b3c5ebbc4984ac9b114d367
Opcode Fuzzy Hash: e1c2be8004ab9af23c8c31ef78b101c7679321b3403413e10f1c5487ff0b581b
Instruction Fuzzy Hash: ADE11C22A1C6C2D5EF35FE24CC553EEA361EB55788FC00432D60D4BA9AEF68D649C720

Function 00007FF746DB3868 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF746DB38AB

Strings

csm, xrefs: 00007FF746DB386F

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: csm
API String ID: 3192549508-1018135373
Opcode ID: 2447300f6ec3465ead16d629e4ce46c99b562a325acde4c5e5da852cf9bc7048
Instruction ID: 585076b58638f8b15d4ec5a07bb67f789d87573a87174ebb076fe79712a7c149
Opcode Fuzzy Hash: 2447300f6ec3465ead16d629e4ce46c99b562a325acde4c5e5da852cf9bc7048
Instruction Fuzzy Hash: C1E06539E1C002E5DE597A259C8907EE7A1EB94B04FD21531C20DC2394DA6CE992DF12

Function 00007FF746D847B0 Relevance: 3.0, Strings: 2, Instructions: 547COMMON

Download Yara Rule

Strings

string too long, xrefs: 00007FF746D84CCA, 00007FF746D84CD7, 00007FF746D84CF2, 00007FF746D84CFF
1.0.0, xrefs: 00007FF746D84F01

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: memchr
String ID: 1.0.0$string too long
API String ID: 3297308162-3307889991
Opcode ID: 33dfac10b30f5bac4d1ad7bc2cfdde2bb7764896482db54e0ee1ae35160bfca3
Instruction ID: 72991942a8c0cfb372b2e8683a47ab44ae8fe23cf81be782a97e936c91143bce
Opcode Fuzzy Hash: 33dfac10b30f5bac4d1ad7bc2cfdde2bb7764896482db54e0ee1ae35160bfca3
Instruction Fuzzy Hash: 7D429C22A1CB81C5EF10FF65D8843AEE7A1FB51B48F900536EA5E47A9ADF78D144CB10

Function 00007FF746D84160 Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

DRPL, xrefs: 00007FF746D843FD
REQL, xrefs: 00007FF746D84404

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID: DRPL$REQL
API String ID: 0-3605393878
Opcode ID: c9a52c2b3fbd5138a98fb996f46619709b60f3b5713481f66d8d2fef14153de3
Instruction ID: 968aa83cd5b4730a486d83d2b99b7381616aa955a48b97a6285e47b8a551975b
Opcode Fuzzy Hash: c9a52c2b3fbd5138a98fb996f46619709b60f3b5713481f66d8d2fef14153de3
Instruction Fuzzy Hash: CAE12922608BC199EB70AF74EC443EEB7A4F74174CF804135DA9D1BA9ADF789288C750

Function 00007FF746D737C0 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32 ref: 00007FF746D73822

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0f98686a4b8fcfee3e556cf16876fa0a5e50784ec64797073e31495439e65b8c
Instruction ID: d77c163591c4f2a9211745a82083ef4aa21f061105f4bada2b229eca2cee55d8
Opcode Fuzzy Hash: 0f98686a4b8fcfee3e556cf16876fa0a5e50784ec64797073e31495439e65b8c
Instruction Fuzzy Hash: 21518C32A1CA92C5FB10FB74E8403AEA760EB41798F800235DA5E57AEADF78D145CB50

Function 00007FF746D81A00 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

27100, xrefs: 00007FF746D81B41

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID: 27100
API String ID: 0-2886292763
Opcode ID: 6e4a6d859505b2f3c07ea4f32d8960a1d868a64456b9a277e269e8e1eb1d1e88
Instruction ID: b3f50c985fae0b2f1fe31aab8988adca91e8aa600fce9eff4e22aae87a6ba529
Opcode Fuzzy Hash: 6e4a6d859505b2f3c07ea4f32d8960a1d868a64456b9a277e269e8e1eb1d1e88
Instruction Fuzzy Hash: E7D19126B1D602C1FF14BA61EC547BFE3A1AB46B98F804630DD2A07BC6DF78D1498B50

Function 00007FF746DACF9C Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,?,00007FF746DC42C7,?,?,00000140,00007FF746DC4997), ref: 00007FF746DACFCD

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 987e55d109183da88758b5caddb6c4ece99c384733c83da0ac54fc19a894a36d
Instruction ID: 164c6265fc70094de4e285df833dd2ae0ff80f953cf1022a8426768dd489f661
Opcode Fuzzy Hash: 987e55d109183da88758b5caddb6c4ece99c384733c83da0ac54fc19a894a36d
Instruction Fuzzy Hash: 11E0EC75E1EA22D5FF457B45FC82323E2A0BB58305FC04236C40E16764CF2CE0958720

Function 00007FF746D76590 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56002f7d27eb1eb39365d711a26b4f71e54e163b4668d0f80b23bc306ea981a8
Instruction ID: ad015363bf0b841af4e8986c8b9c825def1f6356c8c2d65412f4ed30bc2ba53c
Opcode Fuzzy Hash: 56002f7d27eb1eb39365d711a26b4f71e54e163b4668d0f80b23bc306ea981a8
Instruction Fuzzy Hash: 511292B7F3816057C35DCB29EC52F9A3692B7A4308749D428E706D2F08E63DFA159B44

Function 00007FF746D77360 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: 61394798c055cc122092d47e7fc80b814d525bccadcad0948e68e49d4e1d6167
Instruction ID: 0cf527801d784b9a8650703ae46a15588f3d173090892b38cdfd2f54fc874541
Opcode Fuzzy Hash: 61394798c055cc122092d47e7fc80b814d525bccadcad0948e68e49d4e1d6167
Instruction Fuzzy Hash: 9CA1D322B2C69186EB14BB78EC453AEE661F781348F800539EA4D4BFDADF79D444CB50

Function 00007FF746DCCB44 Relevance: 180.6, APIs: 85, Strings: 18, Instructions: 371libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF746DCCB63
GetProcAddress.KERNEL32 ref: 00007FF746DCCB73
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCB94
GetProcAddress.KERNEL32 ref: 00007FF746DCCBA4
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCBC5
GetProcAddress.KERNEL32 ref: 00007FF746DCCBD5
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCBF6
GetProcAddress.KERNEL32 ref: 00007FF746DCCC06
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCC27
GetProcAddress.KERNEL32 ref: 00007FF746DCCC37
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCC58
GetProcAddress.KERNEL32 ref: 00007FF746DCCC68
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCC89
GetProcAddress.KERNEL32 ref: 00007FF746DCCC99
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCCBA
GetProcAddress.KERNEL32 ref: 00007FF746DCCCCA
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCCEB
GetProcAddress.KERNEL32 ref: 00007FF746DCCCFB
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCD1C
GetProcAddress.KERNEL32 ref: 00007FF746DCCD2C
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCD4D
GetProcAddress.KERNEL32 ref: 00007FF746DCCD5D
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCD7E
GetProcAddress.KERNEL32 ref: 00007FF746DCCD8E
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCDAF
GetProcAddress.KERNEL32 ref: 00007FF746DCCDBF
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCDE0
GetProcAddress.KERNEL32 ref: 00007FF746DCCDF0
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCE11
GetProcAddress.KERNEL32 ref: 00007FF746DCCE21
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCE42
GetProcAddress.KERNEL32 ref: 00007FF746DCCE52
GetModuleHandleW.KERNEL32 ref: 00007FF746DCCE73
GetProcAddress.KERNEL32 ref: 00007FF746DCCE83
GetLastError.KERNEL32 ref: 00007FF746DCCEBD
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCED6
_CxxThrowException.LIBCMT ref: 00007FF746DCCEE7
GetLastError.KERNEL32 ref: 00007FF746DCCEED
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCF05
_CxxThrowException.LIBCMT ref: 00007FF746DCCF15
GetLastError.KERNEL32 ref: 00007FF746DCCF1B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCF33
_CxxThrowException.LIBCMT ref: 00007FF746DCCF43
GetLastError.KERNEL32 ref: 00007FF746DCCF49
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCF64
_CxxThrowException.LIBCMT ref: 00007FF746DCCF77
GetLastError.KERNEL32 ref: 00007FF746DCCF7D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCF95
_CxxThrowException.LIBCMT ref: 00007FF746DCCFA5
GetLastError.KERNEL32 ref: 00007FF746DCCFAB
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCFC6
_CxxThrowException.LIBCMT ref: 00007FF746DCCFD9
GetLastError.KERNEL32 ref: 00007FF746DCCFDF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCCFF7
_CxxThrowException.LIBCMT ref: 00007FF746DCD007
GetLastError.KERNEL32 ref: 00007FF746DCD00D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD028
_CxxThrowException.LIBCMT ref: 00007FF746DCD03B
GetLastError.KERNEL32 ref: 00007FF746DCD041
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD05A
_CxxThrowException.LIBCMT ref: 00007FF746DCD06B
GetLastError.KERNEL32 ref: 00007FF746DCD071
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD08A
_CxxThrowException.LIBCMT ref: 00007FF746DCD09B
GetLastError.KERNEL32 ref: 00007FF746DCD0A1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD0B9
_CxxThrowException.LIBCMT ref: 00007FF746DCD0C9
GetLastError.KERNEL32 ref: 00007FF746DCD0CF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD0E7
_CxxThrowException.LIBCMT ref: 00007FF746DCD0F7
GetLastError.KERNEL32 ref: 00007FF746DCD0FD
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD115
_CxxThrowException.LIBCMT ref: 00007FF746DCD125
GetLastError.KERNEL32 ref: 00007FF746DCD12B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD143
_CxxThrowException.LIBCMT ref: 00007FF746DCD153
GetLastError.KERNEL32 ref: 00007FF746DCD159
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD174
_CxxThrowException.LIBCMT ref: 00007FF746DCD187
GetLastError.KERNEL32 ref: 00007FF746DCD18D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD1A8
_CxxThrowException.LIBCMT ref: 00007FF746DCD1BB
GetLastError.KERNEL32 ref: 00007FF746DCD1C1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DCD1DC
_CxxThrowException.LIBCMT ref: 00007FF746DCD1EF

Strings

GetNextUmsListItem, xrefs: 00007FF746DCCD53
DeleteUmsCompletionList, xrefs: 00007FF746DCCC2D
ExecuteUmsThread, xrefs: 00007FF746DCCCF1
GetCurrentUmsThread, xrefs: 00007FF746DCCD22
InitializeProcThreadAttributeList, xrefs: 00007FF746DCCDB5
CreateUmsThreadContext, xrefs: 00007FF746DCCBCB
DeleteProcThreadAttributeList, xrefs: 00007FF746DCCBFC
CreateUmsCompletionList, xrefs: 00007FF746DCCB9A
CreateRemoteThreadEx, xrefs: 00007FF746DCCB69
QueryUmsThreadInformation, xrefs: 00007FF746DCCDE6
kernel32.dll, xrefs: 00007FF746DCCB59
GetUmsCompletionListEvent, xrefs: 00007FF746DCCD84
DeleteUmsThreadContext, xrefs: 00007FF746DCCC5E
DequeueUmsCompletionListItems, xrefs: 00007FF746DCCC8F
SetUmsThreadInformation, xrefs: 00007FF746DCCE17
UmsThreadYield, xrefs: 00007FF746DCCE48
EnterUmsSchedulingMode, xrefs: 00007FF746DCCCC0
UpdateProcThreadAttribute, xrefs: 00007FF746DCCE79

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: AddressConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionHandleLastModuleProcThrow
String ID: CreateRemoteThreadEx$CreateUmsCompletionList$CreateUmsThreadContext$DeleteProcThreadAttributeList$DeleteUmsCompletionList$DeleteUmsThreadContext$DequeueUmsCompletionListItems$EnterUmsSchedulingMode$ExecuteUmsThread$GetCurrentUmsThread$GetNextUmsListItem$GetUmsCompletionListEvent$InitializeProcThreadAttributeList$QueryUmsThreadInformation$SetUmsThreadInformation$UmsThreadYield$UpdateProcThreadAttribute$kernel32.dll
API String ID: 1942842289-2643937717
Opcode ID: 2beddd28d9a71738a41f93e85f78c5167e4941fd89a7b66c7690ebcdfcd8415d
Instruction ID: 971c36b47f11a7a3387bd34ba8cf1f6534bdb9b5e2d30ccc5063c1f53c48d154
Opcode Fuzzy Hash: 2beddd28d9a71738a41f93e85f78c5167e4941fd89a7b66c7690ebcdfcd8415d
Instruction Fuzzy Hash: 0302D824F0DA57D5EE08BB61EC542BAE2A1BF89784FC44035D94E47299EE3CE505CBB0

Function 00007FF746DBA504 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 88synchronizationCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00007FF746DBA535
_CxxThrowException.LIBCMT ref: 00007FF746DBA552
std::exception::exception.LIBCMT ref: 00007FF746DBA56E
_CxxThrowException.LIBCMT ref: 00007FF746DBA58B
_SpinWait.LIBCMT ref: 00007FF746DBA5ED
EnterCriticalSection.KERNEL32 ref: 00007FF746DBA632
LeaveCriticalSection.KERNEL32 ref: 00007FF746DBA642
SetEvent.KERNEL32 ref: 00007FF746DBA64B
WaitForSingleObject.KERNEL32 ref: 00007FF746DBA658
Concurrency::details::ResourceManager::~ResourceManager.LIBCMT ref: 00007FF746DBA661

Strings

version, xrefs: 00007FF746DBA558
pScheduler, xrefs: 00007FF746DBA51F

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: CriticalExceptionResourceSectionThrowWaitstd::exception::exception$Concurrency::details::EnterEventLeaveManagerManager::~ObjectSingleSpin
String ID: pScheduler$version
API String ID: 699445218-3154422776
Opcode ID: 37124c8201fcf94d47151efbafb6cda6ec09a0aeebdb7ffeb8d655e1df7dfb0a
Instruction ID: efb839b5885ae97d936d38e6ce1214bcb424f33f9578333da51dfcf94e2a73f1
Opcode Fuzzy Hash: 37124c8201fcf94d47151efbafb6cda6ec09a0aeebdb7ffeb8d655e1df7dfb0a
Instruction Fuzzy Hash: 39415831A0DA56D2EF10FB54EC400BAE3A0FB84790F840132D65D43AA8DF7CE555CB60

Function 00007FF746D8A9CB Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 377COMMON

Download Yara Rule

Strings

bytes to file , xrefs: 00007FF746D8AEC3, 00007FF746D8B187
(b, xrefs: 00007FF746D8AC73
writing , xrefs: 00007FF746D8AEA0, 00007FF746D8B14F
content, xrefs: 00007FF746D8AA5D
Ub, xrefs: 00007FF746D8AC46
new license data: trial license, xrefs: 00007FF746D8ACB4

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID:
String ID: bytes to file $content$new license data: trial license$writing $(b$Ub
API String ID: 0-3042556935
Opcode ID: 67f29d3554dbf294886c29468a21855e38c7c375944c9162ccc8094c270c95f0
Instruction ID: 3e7288a9970325f229cb17b3678f3fc90d3b0c6c222516318f0238090c1601c5
Opcode Fuzzy Hash: 67f29d3554dbf294886c29468a21855e38c7c375944c9162ccc8094c270c95f0
Instruction Fuzzy Hash: 9C123B6260CAC2C1EB35BB15E8453EBE765FB86784F840135E68D47A9AEF2CD548CF10

Function 00007FF746D71920 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00007FF746D71966

Part of subcall function 00007FF746DA87F8: RtlPcToFileHeader.KERNEL32 ref: 00007FF746DA8887
Part of subcall function 00007FF746DA87F8: RaiseException.KERNEL32 ref: 00007FF746DA88C6

std::exception::exception.LIBCMT ref: 00007FF746D719C3
_CxxThrowException.LIBCMT ref: 00007FF746D71A05
std::exception::exception.LIBCMT ref: 00007FF746D71A3C
_CxxThrowException.LIBCMT ref: 00007FF746D71A7E
std::exception::exception.LIBCMT ref: 00007FF746D71AB1
_CxxThrowException.LIBCMT ref: 00007FF746D71AF3

Strings

ios_base::eofbit set, xrefs: 00007FF746D71A8A
ios_base::failbit set, xrefs: 00007FF746D71A15
ios_base::badbit set, xrefs: 00007FF746D7199C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Exception$Throw$std::exception::exception$FileHeaderRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4097400096-1866435925
Opcode ID: 20b84a5826d7b11eb14a7e140e936dd628b3824314bec0e49429d5af5ecbd604
Instruction ID: 87895f98acdfb174cd2191ce48c18ab39973dc626b7426ec0488fd63232c6567
Opcode Fuzzy Hash: 20b84a5826d7b11eb14a7e140e936dd628b3824314bec0e49429d5af5ecbd604
Instruction Fuzzy Hash: 30510636B0DB01D8EB14FF64D8A02EAB3A1FB4474CF804935DA1D46AA9DF79D119C760

Function 00007FF746DB606C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DB9043,?,?,?,?,00007FF746DB9779), ref: 00007FF746DB6083
malloc.LIBCMT ref: 00007FF746DB6090

Part of subcall function 00007FF746DA5C2C: _FF_MSGBANNER.LIBCMT ref: 00007FF746DA5C5C
Part of subcall function 00007FF746DA5C2C: _NMSG_WRITE.LIBCMT ref: 00007FF746DA5C66
Part of subcall function 00007FF746DA5C2C: HeapAlloc.KERNEL32(?,?,00000000,00007FF746DAAE48,?,?,?,00007FF746DA93C0,?,?,?,00007FF746DA92BF), ref: 00007FF746DA5C81
Part of subcall function 00007FF746DA5C2C: _callnewh.LIBCMT ref: 00007FF746DA5C9A
Part of subcall function 00007FF746DA5C2C: _errno.LIBCMT ref: 00007FF746DA5CA5
Part of subcall function 00007FF746DA5C2C: _errno.LIBCMT ref: 00007FF746DA5CB0

Part of subcall function 00007FF746DAC2B0: SetLastError.KERNEL32(?,?,?,?,00007FF746DB6083,?,?,?,?,?,?,00000000,00007FF746DB9043), ref: 00007FF746DAC2D0

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DB9043,?,?,?,?,00007FF746DB9779), ref: 00007FF746DB60BA
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DB60D3
_CxxThrowException.LIBCMT ref: 00007FF746DB60E4
_CxxThrowException.LIBCMT ref: 00007FF746DB6123
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DB9043,?,?,?,?,00007FF746DB9779), ref: 00007FF746DB6129
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DB6142
_CxxThrowException.LIBCMT ref: 00007FF746DB6153

Strings

bad allocation, xrefs: 00007FF746DB60EA

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ErrorLast$ExceptionThrow$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error_errno$AllocHeap_callnewhmalloc
String ID: bad allocation
API String ID: 1961218317-2104205924
Opcode ID: 0225e01ed3cd48f97f23321390d0bb6128aebccebbd389f9e5f25c7c7613fbfe
Instruction ID: 9a2dbacfe8ff5e768dd5433f315d76b2778501eedb18a8b518ea6f1e3fc47042
Opcode Fuzzy Hash: 0225e01ed3cd48f97f23321390d0bb6128aebccebbd389f9e5f25c7c7613fbfe
Instruction Fuzzy Hash: BF212C25B0CA47D1EE14BB62EC541BAE3A1FF84788F808431D64D47699EE3CE515CB60

Function 00007FF746D82250 Relevance: 16.7, APIs: 11, Instructions: 171networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF746D822F9
_Mtx_unlock.LIBCPMT ref: 00007FF746D8230A
_Mtx_unlock.LIBCPMT ref: 00007FF746D82323

Part of subcall function 00007FF746DA1054: Concurrency::critical_section::unlock.LIBCMT ref: 00007FF746DA106E

socket.WS2_32 ref: 00007FF746D82352
closesocket.WS2_32 ref: 00007FF746D8237D
socket.WS2_32 ref: 00007FF746D823A7
closesocket.WS2_32 ref: 00007FF746D823D2
inet_ntop.WS2_32 ref: 00007FF746D82404
freeaddrinfo.WS2_32 ref: 00007FF746D8240F
setsockopt.WS2_32 ref: 00007FF746D8243B
setsockopt.WS2_32 ref: 00007FF746D82464

Part of subcall function 00007FF746DA0368: std::_Throw_Cpp_error.LIBCPMT ref: 00007FF746DA0389
Part of subcall function 00007FF746DA0368: std::_Throw_Cpp_error.LIBCPMT ref: 00007FF746DA0391
Part of subcall function 00007FF746DA0368: std::_Throw_Cpp_error.LIBCPMT ref: 00007FF746DA039C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Mtx_unlockclosesocketsetsockoptsocket$Concurrency::critical_section::unlockfreeaddrinfogetaddrinfoinet_ntop
String ID:
API String ID: 3148495818-0
Opcode ID: f604289629911277989480bb5d5973037388575b7524291c876a2ebb8b5018d2
Instruction ID: 5cbab12402b493107474df3d7bbb52f6cad61e10c03c784c5e56b36b71ce5f96
Opcode Fuzzy Hash: f604289629911277989480bb5d5973037388575b7524291c876a2ebb8b5018d2
Instruction Fuzzy Hash: 29815C36A0CA42C6EB20BF25E85436AF3A0EB48B54F944235DA9D477D5DF7CE481CB60

Function 00007FF746DD89FC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00007FF746DD8A4C
_CxxThrowException.LIBCMT ref: 00007FF746DD8A69
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCMT ref: 00007FF746DD8AD7
SignalObjectAndWait.KERNEL32 ref: 00007FF746DD8AF3
std::exception::exception.LIBCMT ref: 00007FF746DD8B2F
_CxxThrowException.LIBCMT ref: 00007FF746DD8B4C

Strings

switchState, xrefs: 00007FF746DD8A36
pContext, xrefs: 00007FF746DD8B19

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrowstd::exception::exception$AffinitizeConcurrency::details::FreeObjectProcessorRoot::SignalVirtualWait
String ID: pContext$switchState
API String ID: 2521916644-2660820399
Opcode ID: a3473efad4469623265d71763c12b7fb0313d89ce7e337f260fd642833b2ecea
Instruction ID: a5ff626c3bc0f35be366805763fa91717d60f93caf7f68fe67070cda87041df2
Opcode Fuzzy Hash: a3473efad4469623265d71763c12b7fb0313d89ce7e337f260fd642833b2ecea
Instruction Fuzzy Hash: 3D419D76A0DB0AC2EF21FB01E84066AE3A0FB84B84F905131DB5D07BA8DE3CE555CB50

Function 00007FF746DCACA0 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00007FF746DCACB9

Part of subcall function 00007FF746DCC1D8: TlsGetValue.KERNEL32(?,?,?,00007FF746DCACBE), ref: 00007FF746DCC1EA

std::exception::exception.LIBCMT ref: 00007FF746DCACF9
_CxxThrowException.LIBCMT ref: 00007FF746DCAD16
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DCAD21
_CxxThrowException.LIBCMT ref: 00007FF746DCAD32
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DCAD3D
_CxxThrowException.LIBCMT ref: 00007FF746DCAD4E

Strings

pScheduler, xrefs: 00007FF746DCACE3

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrow$std::bad_exception::bad_exception$Concurrency::details::CurrentExecutionProxy::ResourceSchedulerThreadValuestd::exception::exception
String ID: pScheduler
API String ID: 2546527957-923244539
Opcode ID: 0a92d1236b80b8fdbef8a58dc719a057624d1992e7403410bef65b88da2779f8
Instruction ID: 54237b9cc119eeeaef6ba443a7d2cc1e6df11dc1ab994e3d0f24cd3f0846aa76
Opcode Fuzzy Hash: 0a92d1236b80b8fdbef8a58dc719a057624d1992e7403410bef65b88da2779f8
Instruction Fuzzy Hash: 21111C62A0CA46D1EE20FB05E8500BAE370FB84788FD44131EA8D476A9EF7CD645CB60

Function 00007FF746DB248C Relevance: 13.6, APIs: 9, Instructions: 63COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF746DB24A5

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__lock_fhandle.LIBCMT ref: 00007FF746DB24ED
FlushFileBuffers.KERNEL32(?,?,?,00007FF746DA63DE,?,?,00000000,00007FF746DA64A0), ref: 00007FF746DB2508
GetLastError.KERNEL32(?,?,?,00007FF746DA63DE,?,?,00000000,00007FF746DA64A0), ref: 00007FF746DB2512
__doserrno.LIBCMT ref: 00007FF746DB2522
_errno.LIBCMT ref: 00007FF746DB2529
_unlock_fhandle.LIBCMT ref: 00007FF746DB2539

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 2927645455-0
Opcode ID: a89aaae0539ade81d037064eb86fb358608727817e567aabedb7f0df4bab6221
Instruction ID: 736bb64ad4c830c4c591fe46d7289dbf3033f449c4211e13c00355d2c3d77333
Opcode Fuzzy Hash: a89aaae0539ade81d037064eb86fb358608727817e567aabedb7f0df4bab6221
Instruction Fuzzy Hash: 8121B322B0C686C5EF157F65AC9527FE5906F81B50FD80138D61E463DACE6CE841CB38

Function 00007FF746D81EE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 00007FF746D81FC2
remove.LIBCMT ref: 00007FF746D82080
remove.LIBCMT ref: 00007FF746D820AD
remove.LIBCMT ref: 00007FF746D82104

Strings

.lic, xrefs: 00007FF746D82129
aescripts\, xrefs: 00007FF746D8208B
.plist, xrefs: 00007FF746D82122

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: remove$FolderPath
String ID: .lic$.plist$aescripts\
API String ID: 2070512967-1236034080
Opcode ID: 50eeefc3062eecd178c5cc6e2785b66720f537c8fa5d53ec275a4f874a5f38b1
Instruction ID: ca6fc5c8c85b38471756f95775bb505f728aea0394e9a2af9e334afa91353597
Opcode Fuzzy Hash: 50eeefc3062eecd178c5cc6e2785b66720f537c8fa5d53ec275a4f874a5f38b1
Instruction Fuzzy Hash: 9D814F2261CA82C1EF10BB15E8543ABE761FB92764FD00235E6AD43AE9DF7DD444CB50

Function 00007FF746DD87C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00007FF746DD881D
_CxxThrowException.LIBCMT ref: 00007FF746DD883A
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DD8845
_CxxThrowException.LIBCMT ref: 00007FF746DD8856
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DD8861
_CxxThrowException.LIBCMT ref: 00007FF746DD8872

Strings

pContext, xrefs: 00007FF746DD8801

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrow$std::bad_exception::bad_exception$std::exception::exception
String ID: pContext
API String ID: 3610078031-2046700901
Opcode ID: 1a10e65e9c3be4f5ef1747115894c9c672c718e4b042ef2fd29cfcd7c0986a62
Instruction ID: ac23afa2bdf826a0d173136dc5ad2936782d28aec14bf226add331d7720a04c0
Opcode Fuzzy Hash: 1a10e65e9c3be4f5ef1747115894c9c672c718e4b042ef2fd29cfcd7c0986a62
Instruction Fuzzy Hash: 0B116D65A0DA46D1EF54FB04E8501BAE3A0FF84B48FD04031DA5E476A9EE3CE549CB60

Function 00007FF746DB1820 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 00007FF746DB1849

Part of subcall function 00007FF746DAAE18: malloc.LIBCMT ref: 00007FF746DAAE43
Part of subcall function 00007FF746DAAE18: Sleep.KERNEL32(?,?,?,00007FF746DA93C0,?,?,?,00007FF746DA92BF), ref: 00007FF746DAAE56

free.LIBCMT ref: 00007FF746DB194A
free.LIBCMT ref: 00007FF746DB1966

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: d538ba41b055fb1f9364d438104dd17988e7f216bec028accaf4dd629781d306
Instruction ID: 18d82d13a3ef6025ed6afec99a299475c6dbc579ca26e8155242b8995ee3f244
Opcode Fuzzy Hash: d538ba41b055fb1f9364d438104dd17988e7f216bec028accaf4dd629781d306
Instruction Fuzzy Hash: AB616126B0DB42E2EF14BB16ED4067AF2A0BB48B94F844135DE5D03B59DF3CE4658B50

Function 00007FF746DC5F40 Relevance: 12.1, APIs: 8, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 00007FF746DC5F6D

Part of subcall function 00007FF746DA9368: _FF_MSGBANNER.LIBCMT ref: 00007FF746DA9385
Part of subcall function 00007FF746DA9368: _NMSG_WRITE.LIBCMT ref: 00007FF746DA938F

_lock.LIBCMT ref: 00007FF746DC5F80
_lock.LIBCMT ref: 00007FF746DC5FDB
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00000109,80000000,00007FF746DC7179), ref: 00007FF746DC5FF0
EnterCriticalSection.KERNEL32(?,?,?,00000109,80000000,00007FF746DC7179), ref: 00007FF746DC600C
LeaveCriticalSection.KERNEL32(?,?,?,00000109,80000000,00007FF746DC7179), ref: 00007FF746DC601C
_calloc_crt.LIBCMT ref: 00007FF746DC6092
__lock_fhandle.LIBCMT ref: 00007FF746DC60FA

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: CriticalSection$_lock$CountEnterInitializeLeaveSpin__lock_fhandle_calloc_crt_mtinitlocknum
String ID:
API String ID: 854778215-0
Opcode ID: 08545cbb6868adf57ace4d267df997acc697e57f35bf43482b42d38d8ee1e828
Instruction ID: eafac65e29329b3f6ac5c84d76eb1f27d22a280518f03867fa71d16fa824ad7f
Opcode Fuzzy Hash: 08545cbb6868adf57ace4d267df997acc697e57f35bf43482b42d38d8ee1e828
Instruction Fuzzy Hash: FA51BC22A1C685C2EF24BB25DC4422AE3A5FF94B58F954135DA4D477D5CF3CE841CB60

Function 00007FF746DB7370 Relevance: 12.0, APIs: 8, Instructions: 44threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCMT ref: 00007FF746DB7395

Part of subcall function 00007FF746DB6488: CreateThread.KERNEL32 ref: 00007FF746DB64A0
Part of subcall function 00007FF746DB6488: Concurrency::details::ReferenceLoadLibrary.LIBCMT ref: 00007FF746DB64C2

SetThreadPriority.KERNEL32 ref: 00007FF746DB73AB
GetLastError.KERNEL32 ref: 00007FF746DB73BB
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DB73D4
_CxxThrowException.LIBCMT ref: 00007FF746DB73E5
GetLastError.KERNEL32 ref: 00007FF746DB73EB
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DB7404
_CxxThrowException.LIBCMT ref: 00007FF746DB7415

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Thread$Concurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorExceptionLastLibraryLoadThrow$PriorityReference
String ID:
API String ID: 2237552173-0
Opcode ID: 0cb42799f0be884d7e1ea55998eca801c8cc529737faef5f85796a878d6bb837
Instruction ID: 091891913cd8155ea5564a616ce24c33ed2e75f4a6a8198e563acb4f9195b841
Opcode Fuzzy Hash: 0cb42799f0be884d7e1ea55998eca801c8cc529737faef5f85796a878d6bb837
Instruction Fuzzy Hash: 63112A21A1DA43D6EF04B721EC543BBE2A1BF84B44F904531E95E86699EE3CE505CBA0

Function 00007FF746DC7720 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC774B
_errno.LIBCMT ref: 00007FF746DC7740

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

_errno.LIBCMT ref: 00007FF746DC77EE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC77F9

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: d285b2bbadf80e2166a45276edc87aa0736bfca5b4ec6619b3545f8714ce3ff0
Instruction ID: 61874f2247e19a1b60357f73fb0858b070378b95a0996a5b72ee3734eda09fbc
Opcode Fuzzy Hash: d285b2bbadf80e2166a45276edc87aa0736bfca5b4ec6619b3545f8714ce3ff0
Instruction Fuzzy Hash: D041F262E0C29BC1EF647B1299405BBE6A0FF41B90FC84135EB89076C4DF2CE941DBA0

Function 00007FF746DC125C Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC1282
_errno.LIBCMT ref: 00007FF746DC1277

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF746DC1301
_errno.LIBCMT ref: 00007FF746DC1312
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DC131D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 0899df62475010d5ee482fa7f7096b6a796be90366d2c6e758e3543dec0c843c
Instruction ID: 23fff1183a3a95284265f3feaa35e09250190339d4ffe3fb8e9f93105a209bfc
Opcode Fuzzy Hash: 0899df62475010d5ee482fa7f7096b6a796be90366d2c6e758e3543dec0c843c
Instruction Fuzzy Hash: 9C412666E0C2B6C1EF60B7119C111BEF2A0EB44BA5FD44035E79907AC4DF2CE8528B60

Function 00007FF746D9CD50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9CD71

Part of subcall function 00007FF746DA07BC: _lock.LIBCMT ref: 00007FF746DA07CE

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9CD96
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746D9CE31
_CxxThrowException.LIBCMT ref: 00007FF746D9CE42
std::_Facet_Register.LIBCPMT ref: 00007FF746D9CE60

Strings

bad cast, xrefs: 00007FF746D9CE25

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: b620016426c3c4f85725f080e70a896ebae7bd1f02c87cd46daec41abacdc0d6
Instruction ID: 7bf9d243953dc42283d1aa91d7eed6da6feb9bd5fa21b57dd452838450619d1a
Opcode Fuzzy Hash: b620016426c3c4f85725f080e70a896ebae7bd1f02c87cd46daec41abacdc0d6
Instruction Fuzzy Hash: 33315265A0CA12C1EE11BB15EC401BBE7A0FB95BA4F844231DA5E437E5EE3CE446CB20

Function 00007FF746D9CC10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9CC31

Part of subcall function 00007FF746DA07BC: _lock.LIBCMT ref: 00007FF746DA07CE

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9CC56
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746D9CCF1
_CxxThrowException.LIBCMT ref: 00007FF746D9CD02
std::_Facet_Register.LIBCPMT ref: 00007FF746D9CD20

Strings

bad cast, xrefs: 00007FF746D9CCE5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 8a5555141b173215c6208a9c8aeb2d79524cb6a645284a8cc6ebc8768d1bb076
Instruction ID: e4bdb4cc5b23c68fd39b5aca68e2223038ba333034dd5437ff91b2c00a1bd61d
Opcode Fuzzy Hash: 8a5555141b173215c6208a9c8aeb2d79524cb6a645284a8cc6ebc8768d1bb076
Instruction Fuzzy Hash: A3315061A0DA12C1EE14BB15EC401BBE7A0FB95BA4FD40231DA5D137E5DE3CE546CB20

Function 00007FF746D9C990 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9C9B1

Part of subcall function 00007FF746DA07BC: _lock.LIBCMT ref: 00007FF746DA07CE

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9C9D6
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746D9CA71
_CxxThrowException.LIBCMT ref: 00007FF746D9CA82
std::_Facet_Register.LIBCPMT ref: 00007FF746D9CAA0

Strings

bad cast, xrefs: 00007FF746D9CA65

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 0cb3c862abbe387d89923255385b267e96230e7d8c8512852b1ed9874cb265e9
Instruction ID: 2d3f1d025484e0fcc534db3190c70b5957c76f537954d97dbde33c17b2cd778e
Opcode Fuzzy Hash: 0cb3c862abbe387d89923255385b267e96230e7d8c8512852b1ed9874cb265e9
Instruction Fuzzy Hash: 74313E61A0CA12D1EE11FB15EC405ABE3A1FB957A4F844231DA5D137E6DF3CE846CB24

Function 00007FF746D9CAD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9CAF1

Part of subcall function 00007FF746DA07BC: _lock.LIBCMT ref: 00007FF746DA07CE

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9CB16
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746D9CBB1
_CxxThrowException.LIBCMT ref: 00007FF746D9CBC2
std::_Facet_Register.LIBCPMT ref: 00007FF746D9CBE0

Strings

bad cast, xrefs: 00007FF746D9CBA5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: cf94a65d29a58edc82353b24941c8619b48cca9a216b557fe6a530e4c3d837b9
Instruction ID: cbba79fd69991f1aba74f42cb070d3babaed6e1610e09b507f67590d35c8a7b7
Opcode Fuzzy Hash: cf94a65d29a58edc82353b24941c8619b48cca9a216b557fe6a530e4c3d837b9
Instruction Fuzzy Hash: AB314F61A0CA12D1EE14BB15EC401ABF3A0FB95BA8FC44231DA5D437E5DE3CE446CB20

Function 00007FF746D9BD00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9BD21

Part of subcall function 00007FF746DA07BC: _lock.LIBCMT ref: 00007FF746DA07CE

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF746D9BD46
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746D9BDE1
_CxxThrowException.LIBCMT ref: 00007FF746D9BDF2
std::_Facet_Register.LIBCPMT ref: 00007FF746D9BE10

Strings

bad cast, xrefs: 00007FF746D9BDD5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: aa154f2c991e8ed59acf2e90d9ba5e8cd8cb48189b39342ab2e944e951774971
Instruction ID: 8d224be55ea883947f398560fd9a27bf9feea02384a5f902705517d40c0c1168
Opcode Fuzzy Hash: aa154f2c991e8ed59acf2e90d9ba5e8cd8cb48189b39342ab2e944e951774971
Instruction Fuzzy Hash: 4E314E21A0DA12C1EE10BB15EC401ABE3A1FF95BA4FD50231DA5E437A5DE3CE446CB20

Function 00007FF746DB3574 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF746DB35A8

Part of subcall function 00007FF746DA5D80: _getptd.LIBCMT ref: 00007FF746DA5D96
Part of subcall function 00007FF746DA5D80: __updatetlocinfo.LIBCMT ref: 00007FF746DA5DCB
Part of subcall function 00007FF746DA5D80: __updatetmbcinfo.LIBCMT ref: 00007FF746DA5DF2

_errno.LIBCMT ref: 00007FF746DB35C3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DB35CE

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 0feb9feecc3329452ea8ec885c6d8bb3b47baf9b3ae0000ffeb1a2f89b7271b5
Instruction ID: 31137e49d4eeca4149c925496fd29c9955b2da0ed718401970814d2677842ea6
Opcode Fuzzy Hash: 0feb9feecc3329452ea8ec885c6d8bb3b47baf9b3ae0000ffeb1a2f89b7271b5
Instruction Fuzzy Hash: 3E319171A0C785D9EB20BB11D98067EF6A4FB94FE0F994131EA5D03799CF38E8419B60

Function 00007FF746DD82F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCMT ref: 00007FF746DD8316

Part of subcall function 00007FF746DCBECC: SetEvent.KERNEL32(?,?,?,00007FF746DCAB67,?,?,?,00007FF746DBA891), ref: 00007FF746DCBF21

std::exception::exception.LIBCMT ref: 00007FF746DD8342
_CxxThrowException.LIBCMT ref: 00007FF746DD835F
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DD836A
_CxxThrowException.LIBCMT ref: 00007FF746DD837B

Strings

pScheduler, xrefs: 00007FF746DD832C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrow$Concurrency::details::CoreDecrementEventProxy::SchedulerSubscriptionstd::bad_exception::bad_exceptionstd::exception::exception
String ID: pScheduler
API String ID: 627769529-923244539
Opcode ID: 4a65618706d70c55c2da5df99ba9c83219bbdc0a02742f42fd5244051ed5d83f
Instruction ID: d24ce3566c6b31040717204c4d48b16a539629397e15d9ec79a5e4468003e79d
Opcode Fuzzy Hash: 4a65618706d70c55c2da5df99ba9c83219bbdc0a02742f42fd5244051ed5d83f
Instruction Fuzzy Hash: 18013075A0CA0AD1EE14FB14E8500BAE361FF80B48FD01431EA5D4B6A5DF3CE546CB50

Function 00007FF746DAA330 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF746DAA351
_getptd.LIBCMT ref: 00007FF746DAA35F
_getptd.LIBCMT ref: 00007FF746DAA371

Strings

csm, xrefs: 00007FF746DAA347
MOC, xrefs: 00007FF746DAA33F
RCC, xrefs: 00007FF746DAA337

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 9cd19f3f06bc7988da1e9b1409e20964e5baf2f5a54db59486cd1313f4ff8454
Instruction ID: 0151432524ec98d23a17213daedaef80145b2f9f50fe538a0c05332d0be99e59
Opcode Fuzzy Hash: 9cd19f3f06bc7988da1e9b1409e20964e5baf2f5a54db59486cd1313f4ff8454
Instruction Fuzzy Hash: B6F01235D0C246C5EE557B5588453BAE1A0EF54B05FC98571C24802382CBBCE8809E62

Function 00007FF746DB8D64 Relevance: 9.1, APIs: 6, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::Version.LIBCMT ref: 00007FF746DB8D79

Part of subcall function 00007FF746DBB508: _SpinWait.LIBCMT ref: 00007FF746DBB550
Part of subcall function 00007FF746DBB508: Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCMT ref: 00007FF746DBB56E

Concurrency::details::UMS::CreateUmsCompletionList.LIBCMT ref: 00007FF746DB8D88
Concurrency::details::ResourceManager::Version.LIBCMT ref: 00007FF746DB8DF6
Concurrency::details::ResourceManager::Version.LIBCMT ref: 00007FF746DB8E00
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DB8E90
_CxxThrowException.LIBCMT ref: 00007FF746DB8EA1

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Concurrency::details::$Manager::ResourceVersion$CompletionCreateExceptionInformationListRetrieveSpinSystemThrowWaitstd::bad_exception::bad_exception
String ID:
API String ID: 1876357193-0
Opcode ID: 04b2fa28b64b16b95eb29dc48d225d5f6a05fa65057bac5eed109b2516558bb8
Instruction ID: 63f197ee89bfa65767f11a9f9a182a6f46aaff2ee3f7c0a4c5367cdae07f3f0f
Opcode Fuzzy Hash: 04b2fa28b64b16b95eb29dc48d225d5f6a05fa65057bac5eed109b2516558bb8
Instruction Fuzzy Hash: 3831A472E0C292D6EF687B15D80027EE391FF80F41FD44036E64D96699CE2DE9508B20

Function 00007FF746D74770 Relevance: 9.1, APIs: 6, Instructions: 71networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF746D747DD
connect.WS2_32 ref: 00007FF746D747EC
WSAGetLastError.WS2_32 ref: 00007FF746D747F7
select.WS2_32 ref: 00007FF746D7482D
__WSAFDIsSet.WS2_32 ref: 00007FF746D74840
ioctlsocket.WS2_32 ref: 00007FF746D7485F

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ioctlsocket$ErrorLastconnectselect
String ID:
API String ID: 3923486878-0
Opcode ID: 03cf7c826b59199f0458c21940543876197c5f873f210f816771850b6b73a7d2
Instruction ID: 99a3501cc972cbe3836091bac4bc68bff287f7a6d841b9529954085dcd392e91
Opcode Fuzzy Hash: 03cf7c826b59199f0458c21940543876197c5f873f210f816771850b6b73a7d2
Instruction Fuzzy Hash: B021C522A1CA8186EB54BB25EC0466AF261BF89759FC45231E94E42BA4DF3CD4048F10

Function 00007FF746D9D810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

localeconv.LIBCMT ref: 00007FF746D9D837

Part of subcall function 00007FF746DA6AA4: _getptd.LIBCMT ref: 00007FF746DA6AA8
Part of subcall function 00007FF746DA6AA4: __updatetlocinfo.LIBCMT ref: 00007FF746DA6ACB

_Getcvt.LIBCPMT ref: 00007FF746D9D844

Part of subcall function 00007FF746D9FDE0: ___lc_codepage_func.LIBCMT ref: 00007FF746D9FE04
Part of subcall function 00007FF746D9FDE0: ___mb_cur_max_func.LIBCMT ref: 00007FF746D9FE0B
Part of subcall function 00007FF746D9FDE0: ___lc_locale_name_func.LIBCMT ref: 00007FF746D9FE13

_Getcvt.LIBCPMT ref: 00007FF746D9D86C

Strings

true, xrefs: 00007FF746D9D8E3
false, xrefs: 00007FF746D9D8B3

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Getcvt$___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__updatetlocinfo_getptdlocaleconv
String ID: false$true
API String ID: 379465546-2658103896
Opcode ID: 73d06d7626cf9a4e34ff0ac674d40b771966c80e8ed58987b3a410164db86684
Instruction ID: 26ec4a75d5317ce9120767a4139c879c4eda821380278f3f6b1ec51dc4989f51
Opcode Fuzzy Hash: 73d06d7626cf9a4e34ff0ac674d40b771966c80e8ed58987b3a410164db86684
Instruction Fuzzy Hash: 7931E32260CF81C2DF26BB21E94016AF7A1F755BE0B884236CAAE07395EF3CD159C750

Function 00007FF746DAA233 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF746DAA287
_getptd.LIBCMT ref: 00007FF746DAA23B

Part of subcall function 00007FF746DB07B0: _getptd_noexit.LIBCMT ref: 00007FF746DB07B6

_getptd.LIBCMT ref: 00007FF746DAA2ED
_getptd.LIBCMT ref: 00007FF746DAA2F9

Strings

csm, xrefs: 00007FF746DAA2BB

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd$ExceptionRaise_getptd_noexit
String ID: csm
API String ID: 1742125525-1018135373
Opcode ID: 07e646bd3f459ca950e7042a5cd6759f866d2739a47ac95533c609a32ddd3d48
Instruction ID: 091a6f3f50ab5963be67ed55a7a9e7060f572b82a6bd5abe99d9c53213adb3ec
Opcode Fuzzy Hash: 07e646bd3f459ca950e7042a5cd6759f866d2739a47ac95533c609a32ddd3d48
Instruction Fuzzy Hash: 5521D636A0C641C6DA30AE52E44026EF761FB89BA5F444236DE9E07795CF3DE885CB50

Function 00007FF746DC6334 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF746DC6396
_isleadbyte_l.LIBCMT ref: 00007FF746DC63C6
MultiByteToWideChar.KERNEL32 ref: 00007FF746DC6405
MultiByteToWideChar.KERNEL32 ref: 00007FF746DC6453
_errno.LIBCMT ref: 00007FF746DC645D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 5297c7b9408e9efefd71701747c1766c4c13969b4c72a5129c678fb0fd4e6d0e
Instruction ID: e544ba4c7769c37e2710a95425961f554d60f762623ccc3e845cd0ca6522a46f
Opcode Fuzzy Hash: 5297c7b9408e9efefd71701747c1766c4c13969b4c72a5129c678fb0fd4e6d0e
Instruction Fuzzy Hash: 10419D32B0C7C5C6EB60AF15AD5423AFAA1EF88B80F584135EB8947B95DF38D8518B50

Function 00007FF746DC86D8 Relevance: 7.5, APIs: 5, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::GetDetachedWorkQueue.LIBCMT ref: 00007FF746DC86F3

Part of subcall function 00007FF746DD2508: ListArray.LIBCMT ref: 00007FF746DD2598

InterlockedPopEntrySList.KERNEL32 ref: 00007FF746DC870E
Concurrency::details::WorkQueue::WorkQueue.LIBCMT ref: 00007FF746DC873F
Concurrency::details::WorkQueue::Reinitialize.LIBCMT ref: 00007FF746DC874D

Part of subcall function 00007FF746DD6AA8: Concurrency::details::_CriticalNonReentrantLock::_Acquire.LIBCMT ref: 00007FF746DD6ABF

ListArray.LIBCMT ref: 00007FF746DC8761

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Work$Concurrency::details::List$ArrayQueueQueue::$AcquireBase::Concurrency::details::_CriticalDetachedEntryGroupInterlockedLock::_ReentrantReinitializeScheduleSegment
String ID:
API String ID: 935885060-0
Opcode ID: 012604970d0fc19f81394ac8f7f33d0d900d104ee6330319d1940e19e3f4b366
Instruction ID: c20e0d70101d471a5bdeb830ee326edb7986221d05a72efc615c97ea3676be08
Opcode Fuzzy Hash: 012604970d0fc19f81394ac8f7f33d0d900d104ee6330319d1940e19e3f4b366
Instruction Fuzzy Hash: D5110A25B1DB46C2EF64BB15E81073AE6A0EB85B94F940634DBAD073D9EF39D0108B50

Function 00007FF746D712F0 Relevance: 7.5, APIs: 6, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF746DA0230: setlocale.LIBCMT ref: 00007FF746DA023F

free.LIBCMT ref: 00007FF746D7130B

Part of subcall function 00007FF746DA5A10: RtlFreeHeap.NTDLL(?,?,?,00007FF746DA4EA0,?,?,?,00007FF746D71214), ref: 00007FF746DA5A26
Part of subcall function 00007FF746DA5A10: _errno.LIBCMT ref: 00007FF746DA5A30
Part of subcall function 00007FF746DA5A10: GetLastError.KERNEL32(?,?,?,00007FF746DA4EA0,?,?,?,00007FF746D71214), ref: 00007FF746DA5A38

free.LIBCMT ref: 00007FF746D7131F
free.LIBCMT ref: 00007FF746D71331
free.LIBCMT ref: 00007FF746D71343
free.LIBCMT ref: 00007FF746D71355
free.LIBCMT ref: 00007FF746D71367

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errnosetlocale
String ID:
API String ID: 3944588114-0
Opcode ID: a129dca775d2206b801279d9bcf3f6d9b083367e658b8ec053318e3da434a495
Instruction ID: 686b7e42ea5004cfa7a9d6a91da990a8c90d3a630ce66bb88b6ba64d5c61dfcd
Opcode Fuzzy Hash: a129dca775d2206b801279d9bcf3f6d9b083367e658b8ec053318e3da434a495
Instruction Fuzzy Hash: 66013021B1E601C4EF58BF619CD157AE395FF84F84F980535D60E07A85CE28E890C6B1

Function 00007FF746DC61E4 Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF746DC61F5

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

__doserrno.LIBCMT ref: 00007FF746DC61ED

Part of subcall function 00007FF746DA6658: _getptd_noexit.LIBCMT ref: 00007FF746DA665C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 0927e6ef729c9e596bf91f2aacf5c84096a56864d4d06e221d04a04a90b24eca
Instruction ID: 5fc2bf2fda96f2299d8fe11786b561fa793e1755a30ee97dd9526cb30bdf8aab
Opcode Fuzzy Hash: 0927e6ef729c9e596bf91f2aacf5c84096a56864d4d06e221d04a04a90b24eca
Instruction Fuzzy Hash: 8001ADB1F0E69AC4EE293B148C6937EE590AF91B21FD84335C52D063E2CF2CA0018A70

Function 00007FF746DBC600 Relevance: 7.5, APIs: 5, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Acquire.LIBCMT ref: 00007FF746DBC61C

Part of subcall function 00007FF746DB66D0: _SpinWait.LIBCMT ref: 00007FF746DB66FF

Concurrency::details::SchedulerBase::UpdatePendingVersion.LIBCMT ref: 00007FF746DBC624

Part of subcall function 00007FF746DBFE00: Concurrency::details::SchedulerBase::ComputeSafePointCommitVersion.LIBCMT ref: 00007FF746DBFE09

Concurrency::details::SchedulerBase::CommitToVersion.LIBCMT ref: 00007FF746DBC630
Concurrency::details::_CriticalNonReentrantLock::_Acquire.LIBCMT ref: 00007FF746DBC638
Concurrency::details::SchedulerBase::UpdateCommitVersion.LIBCMT ref: 00007FF746DBC642

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Base::Concurrency::details::SchedulerVersion$Commit$AcquireConcurrency::details::_CriticalLock::_ReentrantUpdate$ComputePendingPointSafeSpinWait
String ID:
API String ID: 4127798528-0
Opcode ID: b752e140cde508a889828605ea4a5ff6bff43a6522ddf288ae4795b530531b87
Instruction ID: ba994f77274dbe570b1898d7589bf191d968d9d436e029eaa95145c4ebff4de7
Opcode Fuzzy Hash: b752e140cde508a889828605ea4a5ff6bff43a6522ddf288ae4795b530531b87
Instruction Fuzzy Hash: 49F09011F0C29291ED14BA226D411BFD210AF84FC0F841031EA0A0B75ACE2CD4428B90

Function 00007FF746DA8CA0 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF746DA8CAD

Part of subcall function 00007FF746DB07B0: _getptd_noexit.LIBCMT ref: 00007FF746DB07B6

_inconsistency.LIBCMT ref: 00007FF746DA8CBB

Part of subcall function 00007FF746DAEAEC: DecodePointer.KERNEL32(?,?,?,?,00007FF746DB431D,?,?,?,00007FF746DA8906), ref: 00007FF746DAEAF7

_getptd.LIBCMT ref: 00007FF746DA8CC0
_inconsistency.LIBCMT ref: 00007FF746DA8CDC
_getptd.LIBCMT ref: 00007FF746DA8CEC

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_getptd_noexit
String ID:
API String ID: 3566995948-0
Opcode ID: db5a918070a374afb43049a900a9a587905e0fb94cbe37e2d6d5f365a64d4e94
Instruction ID: a14978698316f725bbf13830d7fd20109bd6a21616d81f4bffaa3b8ebaa9a8ac
Opcode Fuzzy Hash: db5a918070a374afb43049a900a9a587905e0fb94cbe37e2d6d5f365a64d4e94
Instruction Fuzzy Hash: F6F0F422E0D682D0EF517B51D4411BFE265AF48B40F8C4131EB4C07387DE68E8909F70

Function 00007FF746D8AFC1 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF746D8B009

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

Part of subcall function 00007FF746D81EE0: SHGetFolderPathA.SHELL32 ref: 00007FF746D81FC2
Part of subcall function 00007FF746D81EE0: remove.LIBCMT ref: 00007FF746D82080
Part of subcall function 00007FF746D81EE0: remove.LIBCMT ref: 00007FF746D820AD

_errno.LIBCMT ref: 00007FF746D8B0BA

Strings

bytes to file , xrefs: 00007FF746D8B187
writing , xrefs: 00007FF746D8B14F

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _errnoremove$FolderPath_getptd_noexit
String ID: bytes to file $writing
API String ID: 1059067161-3905530474
Opcode ID: 6470c3c141038dd0d7531a56ba1d2c0fcef42c991189d2220646269d5382af48
Instruction ID: 4cc35f0712b5002eeffad2362f41c17bbf86104e9f3dc018908d449344b3641b
Opcode Fuzzy Hash: 6470c3c141038dd0d7531a56ba1d2c0fcef42c991189d2220646269d5382af48
Instruction Fuzzy Hash: 89611962A0D6C2D1EE20B711EC553EFE351AF96784FC04431D68D476AAEE2CE558CF60

Function 00007FF746D96360 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xbad_alloc.LIBCPMT ref: 00007FF746D98B39

Part of subcall function 00007FF746DA06BC: _CxxThrowException.LIBCMT ref: 00007FF746DA06F9

Strings

vector<T> too long, xrefs: 00007FF746D96427
gfffffff, xrefs: 00007FF746D96372
gfffffff, xrefs: 00007FF746D98AD9

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrowXbad_allocstd::_
String ID: gfffffff$gfffffff$vector<T> too long
API String ID: 944563697-3862842194
Opcode ID: b72b5e22a1e6967b328d59947a3b1c2996316e6ef01403dbe5283b184ee46dcc
Instruction ID: b1baba3a1b55fcec572b181343139296d0849827d7b8cf004876e6fd6e53e13d
Opcode Fuzzy Hash: b72b5e22a1e6967b328d59947a3b1c2996316e6ef01403dbe5283b184ee46dcc
Instruction Fuzzy Hash: C731F5A1F0DB6AC2DE04BB4BBD04076D355BB59BC4B849432CE0D8B394EE3CE1468A12

Function 00007FF746DA5CE4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_getptd_noexit.LIBCMT ref: 00007FF746DA5CF0

Part of subcall function 00007FF746DB07D4: GetLastError.KERNEL32(?,?,?,00007FF746DA66D1,?,?,?,?,00007FF746DA5A35,?,?,?,00007FF746DA4EA0), ref: 00007FF746DB07DE
Part of subcall function 00007FF746DB07D4: _calloc_crt.LIBCMT ref: 00007FF746DB0801
Part of subcall function 00007FF746DB07D4: _initptd.LIBCMT ref: 00007FF746DB0825
Part of subcall function 00007FF746DB07D4: GetCurrentThreadId.KERNEL32 ref: 00007FF746DB082A
Part of subcall function 00007FF746DB07D4: SetLastError.KERNEL32(?,?,?,00007FF746DA66D1,?,?,?,?,00007FF746DA5A35,?,?,?,00007FF746DA4EA0), ref: 00007FF746DB0842

_calloc_crt.LIBCMT ref: 00007FF746DA5D20
_invoke_watson.LIBCMT ref: 00007FF746DA5D78

Part of subcall function 00007FF746DAD360: _call_reportfault.LIBCMT ref: 00007FF746DAD388

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00007FF746DA5CFD

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ErrorLast_calloc_crt$CurrentThread_call_reportfault_getptd_noexit_initptd_invoke_watson
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 835963739-798102604
Opcode ID: e458e596050656dde5d0d4c743bcf5eb15964c97def0755c343391bd7b1bd0b9
Instruction ID: 13eba1f91a4e837a28c069dc04b2e71575a2fa1728759c5474a1cbd977a6ad0d
Opcode Fuzzy Hash: e458e596050656dde5d0d4c743bcf5eb15964c97def0755c343391bd7b1bd0b9
Instruction Fuzzy Hash: 7C117C26A0C606D2EE54BA2098453BFE290AF84B44F994435DA4D1BB86EE3CF840CB60

Function 00007FF746DD45A4 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF746DD45C8

Part of subcall function 00007FF746DA5D80: _getptd.LIBCMT ref: 00007FF746DA5D96
Part of subcall function 00007FF746DA5D80: __updatetlocinfo.LIBCMT ref: 00007FF746DA5DCB
Part of subcall function 00007FF746DA5D80: __updatetmbcinfo.LIBCMT ref: 00007FF746DA5DF2

_errno.LIBCMT ref: 00007FF746DD45D4

Part of subcall function 00007FF746DA66C8: _getptd_noexit.LIBCMT ref: 00007FF746DA66CC

_invalid_parameter_noinfo.LIBCMT ref: 00007FF746DD45DF
strchr.LIBCMT ref: 00007FF746DD45F5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 36c0bb8c8628e5e199e1d459f3f3e4ff65f57ebdba7ca7f1b266bdbb24a60703
Instruction ID: 64a10ad21885e272b48ca5895767c4d839ffd7ccb10e87a217a9db653384e687
Opcode Fuzzy Hash: 36c0bb8c8628e5e199e1d459f3f3e4ff65f57ebdba7ca7f1b266bdbb24a60703
Instruction Fuzzy Hash: 8F219662A0C3A6C1EF617A1598502BFE690EB80BD4F9C4135E7AF47AC5DD2CD5418FA0

Function 00007FF746DBC20C Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746DBCA80: TlsGetValue.KERNEL32(?,?,?,?,00007FF746DBC21A), ref: 00007FF746DBCA8A

Concurrency::details::SchedulerBase::AttachExternalContext.LIBCMT ref: 00007FF746DBC224

Part of subcall function 00007FF746DBC274: TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DBC8F8,?,?,?,00007FF746DAB153), ref: 00007FF746DBC28F
Part of subcall function 00007FF746DBC274: Concurrency::details::InternalContextBase::LeaveScheduler.LIBCMT ref: 00007FF746DBC2B0
Part of subcall function 00007FF746DBC274: Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00007FF746DBC2D3

Concurrency::details::SchedulerBase::ThrowSchedulerEvent.LIBCMT ref: 00007FF746DBC24B

Part of subcall function 00007FF746DBFC84: Concurrency::details::Etw::Trace.LIBCMT ref: 00007FF746DBFCF5

std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DBC25B
_CxxThrowException.LIBCMT ref: 00007FF746DBC26C

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Concurrency::details::Scheduler$Base::$Context$ExternalThrowValue$AttachEtw::EventExceptionInternalLeaveTracestd::bad_exception::bad_exception
String ID:
API String ID: 3337661974-0
Opcode ID: a8ffa42869d0cca481dc8e7d30508a6de5a9f9c283b2c504f4a04659c1eefe2b
Instruction ID: 587ed1a56df1a5a3e4daeaf1f78382641b38aeef13ade24c5d367e123f082b0c
Opcode Fuzzy Hash: a8ffa42869d0cca481dc8e7d30508a6de5a9f9c283b2c504f4a04659c1eefe2b
Instruction Fuzzy Hash: 1EF090A1E0C153D2EE24BB949C501B7E350BF85B48F881030DA6D0B39ACD2DF8458F60

Function 00007FF746DCA99C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DCA9D6
_CxxThrowException.LIBCMT ref: 00007FF746DCA9E7
std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DCA9F9
_CxxThrowException.LIBCMT ref: 00007FF746DCAA0A

Part of subcall function 00007FF746DCA6A0: std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DCA6D4
Part of subcall function 00007FF746DCA6A0: _CxxThrowException.LIBCMT ref: 00007FF746DCA6E5

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrowstd::bad_exception::bad_exception
String ID:
API String ID: 1480402491-0
Opcode ID: 52b6f9ac578ef59788abf9f234be2f52d284893acd74629aa72149f022c5e788
Instruction ID: c1c5bca316edc104e2e7d6f293983b0c0ffa4fa56b23d65eeff0da34f67be1a0
Opcode Fuzzy Hash: 52b6f9ac578ef59788abf9f234be2f52d284893acd74629aa72149f022c5e788
Instruction Fuzzy Hash: 7CF0EC61F1C95BD1EE10BB21EC511BBD361BF50388FD44031D98D465AADE2DD906CBA0

Function 00007FF746DD9340 Relevance: 6.0, APIs: 4, Instructions: 21threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?,?,?,?,?,?,?,00007FF746DCD610), ref: 00007FF746DD934B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF746DCD610), ref: 00007FF746DD935A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00007FF746DD9373
_CxxThrowException.LIBCMT ref: 00007FF746DD9384

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorExceptionLastPriorityThreadThrow
String ID:
API String ID: 152467346-0
Opcode ID: bd81974e09e3a9616df76e0388476f62eaa7e0dc68a4e20fee498b5bbef2bd85
Instruction ID: c920185999d4ddf8fdf034d06149458500feeb5846704e65149974ac13f3cc9c
Opcode Fuzzy Hash: bd81974e09e3a9616df76e0388476f62eaa7e0dc68a4e20fee498b5bbef2bd85
Instruction Fuzzy Hash: 5CE03965E0CA46C6EF18BB26DC401BAE2A0FB88744FD04931D64D865A8EE3DE516CB60

Function 00007FF746DBC9B4 Relevance: 6.0, APIs: 4, Instructions: 19timeCOMMON

Download Yara Rule

APIs

UnregisterWaitEx.KERNEL32 ref: 00007FF746DBC9C8
Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCMT ref: 00007FF746DBC9DB

Part of subcall function 00007FF746DB6000: DeleteTimerQueueTimer.KERNEL32 ref: 00007FF746DB6030

CloseHandle.KERNEL32 ref: 00007FF746DBC9E7
Concurrency::details::SchedulerBase::Finalize.LIBCMT ref: 00007FF746DBC9F9

Part of subcall function 00007FF746DBCAA4: CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DBF973,?,?,00000000,00007FF746DBC335), ref: 00007FF746DBCACA
Part of subcall function 00007FF746DBCAA4: InterlockedFlushSList.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DBF973,?,?,00000000,00007FF746DBC335), ref: 00007FF746DBCB10
Part of subcall function 00007FF746DBCAA4: InterlockedFlushSList.KERNEL32(?,?,?,?,?,?,00000000,00007FF746DBF973,?,?,00000000,00007FF746DBC335), ref: 00007FF746DBCB53
Part of subcall function 00007FF746DBCAA4: Concurrency::details::SchedulerBase::ThrowSchedulerEvent.LIBCMT ref: 00007FF746DBCBB0

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Timer$Scheduler$Base::CloseConcurrency::details::DeleteFlushHandleInterlockedListQueue$Concurrency::details::platform::__EventFinalizeThrowUnregisterWait
String ID:
API String ID: 1020705008-0
Opcode ID: 5d5854dba2f339c7cf30f9e02c3e4fad926736d1f37232c3274770b9356adc06
Instruction ID: 36d305c1a6feddc1d351b2f178125208f91c4bf56426f045f7810c60c98e0440
Opcode Fuzzy Hash: 5d5854dba2f339c7cf30f9e02c3e4fad926736d1f37232c3274770b9356adc06
Instruction Fuzzy Hash: D6E0EDA1A09881C1FF547B779C552BEA220FB54FB5F981331DD3E091E9CE1991514A20

Function 00007FF746D959D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

std::_Xbad_alloc.LIBCPMT ref: 00007FF746D98856

Part of subcall function 00007FF746DA06BC: _CxxThrowException.LIBCMT ref: 00007FF746DA06F9

std::_Xbad_alloc.LIBCPMT ref: 00007FF746D988BF

Part of subcall function 00007FF746DA7C18: malloc.LIBCMT ref: 00007FF746DA7C32

Strings

vector<T> too long, xrefs: 00007FF746D95A4E

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Xbad_allocstd::_$ExceptionThrowmalloc
String ID: vector<T> too long
API String ID: 1779041212-3788999226
Opcode ID: 4d53f08d9b7ad03c66b59ad33f6aded35af7739e85ecd2f3f253366adc879c3a
Instruction ID: 532a1ba7dde4a333459f19380352d657d55e525ed4d164c867b8e2ee7ecfc2de
Opcode Fuzzy Hash: 4d53f08d9b7ad03c66b59ad33f6aded35af7739e85ecd2f3f253366adc879c3a
Instruction Fuzzy Hash: 0B51B562B0D781C2EF14BB16B80516AE295FB45BE0F548A32DEAD177D9EE3CE0418B10

Function 00007FF746D96BF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00007FF746D96DB3

Strings

%, xrefs: 00007FF746D96D0D
+, xrefs: 00007FF746D96D21

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 6fa85a4a5f98d9b2edd65c8fc52f8eaba122c580845481ee6f06e08475fe2951
Instruction ID: 2b31af7d4cc199fa4cc4f8348a55c554089b66b730ed12f97593a4c455e711ef
Opcode Fuzzy Hash: 6fa85a4a5f98d9b2edd65c8fc52f8eaba122c580845481ee6f06e08475fe2951
Instruction Fuzzy Hash: 1951D722A0CBC5C5FE26B724EC513BBE655AF96380FA44231EA4D16795EF2CE4498B10

Function 00007FF746D96E30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00007FF746D96FE7

Strings

+, xrefs: 00007FF746D96F51
%, xrefs: 00007FF746D96F3D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: ba670cdc73b5d295f30c137456232ec9728c73304c93483a7b7d5d2b88c9bbc0
Instruction ID: 5d663c3f4dbd75f5b02366a0dfd3a6dc66903da4a41f784b1837a917b30dc44e
Opcode Fuzzy Hash: ba670cdc73b5d295f30c137456232ec9728c73304c93483a7b7d5d2b88c9bbc0
Instruction Fuzzy Hash: B251D622A0CBC1C5FE65BB24EC513ABE651AF56784F848231EA4D52A95EF3CE4498B10

Function 00007FF746D969F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00007FF746D96A99

Strings

+, xrefs: 00007FF746D96A32
%, xrefs: 00007FF746D96A1E

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: bd2448649ee57e4d5998f2208d3a164235575cf06586aa510bff15654f418069
Instruction ID: 5612d2cf90b1cabad7833e5f121a50fddeb7eb05b160645c4974a1d99a30cd7c
Opcode Fuzzy Hash: bd2448649ee57e4d5998f2208d3a164235575cf06586aa510bff15654f418069
Instruction Fuzzy Hash: C121A05260C7C184FB21AB15E8417EBE7A1EB96784F848035DB8D07B96EF2CD50DCB51

Function 00007FF746D96AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00007FF746D96B99

Strings

+, xrefs: 00007FF746D96B32
%, xrefs: 00007FF746D96B1E

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 4f884a797e3be12bfada8cb5e3661bfcc9e2ec278513ca55729cd4a6a98e770f
Instruction ID: 3e00ad23983d093c6deea4097b546d117729868e202fca34b59c918ec4061f68
Opcode Fuzzy Hash: 4f884a797e3be12bfada8cb5e3661bfcc9e2ec278513ca55729cd4a6a98e770f
Instruction Fuzzy Hash: 9A21A01260C7C185FB25AB15E8913EBF761EB96798F848035EB8C07B89EB2CD50DCB51

Function 00007FF746D967F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00007FF746D9688F

Strings

+, xrefs: 00007FF746D96831
%, xrefs: 00007FF746D9681E

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 38663dba18d0d25d2075d16b7d25364ae185f2c545367c52f6517a1dd6074f36
Instruction ID: 5101bd07bee940c099039ca5b7a775bd2f0ee75ca00c6bce2262102d618662f7
Opcode Fuzzy Hash: 38663dba18d0d25d2075d16b7d25364ae185f2c545367c52f6517a1dd6074f36
Instruction Fuzzy Hash: D021A15260C7C185FB25AB54E8413EBF760EBAA794F844035EB8D03B89EF6CD149CB61

Function 00007FF746D968F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00007FF746D9698F

Strings

%, xrefs: 00007FF746D9691E
+, xrefs: 00007FF746D96931

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: c2ab8cbe4c38ac8b2161e06a6ed5e29d440f316e3521188a2708fde680d69b84
Instruction ID: 04cca84cfa9ba0caf26fbf7d5b8a4ac363dfce39ae59a4a7935d8a36f2ba6ae5
Opcode Fuzzy Hash: c2ab8cbe4c38ac8b2161e06a6ed5e29d440f316e3521188a2708fde680d69b84
Instruction Fuzzy Hash: 6A21BF5260C7C195FB21AB54E8413EBF760EB9A794F844035EACD03B89EF2CD049CB61

Function 00007FF746DDBD9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF746DDBE61

Strings

csm, xrefs: 00007FF746DDBE1D
csm, xrefs: 00007FF746DDBDC4

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 761bbdb581a1da8e2284ec1f21cb742ae57594a5225517d28d8f09f6c435668e
Instruction ID: 033ca54f09d7d0308e055a5f9e81391a91fff0700d3b53ff4ae7f32035e70517
Opcode Fuzzy Hash: 761bbdb581a1da8e2284ec1f21cb742ae57594a5225517d28d8f09f6c435668e
Instruction Fuzzy Hash: DC3141B7508B04CADB60BF26C4802697B71FB58B9CF851275E71D47B54CB35D890CB94

Function 00007FF746DD70C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 00007FF746DD70ED

Part of subcall function 00007FF746DAAE18: malloc.LIBCMT ref: 00007FF746DAAE43
Part of subcall function 00007FF746DAAE18: Sleep.KERNEL32(?,?,?,00007FF746DA93C0,?,?,?,00007FF746DA92BF), ref: 00007FF746DAAE56

_CxxThrowException.LIBCMT ref: 00007FF746DD7131

Part of subcall function 00007FF746DA87F8: RtlPcToFileHeader.KERNEL32 ref: 00007FF746DA8887
Part of subcall function 00007FF746DA87F8: RaiseException.KERNEL32 ref: 00007FF746DA88C6

Strings

bad allocation, xrefs: 00007FF746DD70FA

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Exception$FileHeaderRaiseSleepThrow_malloc_crtmalloc
String ID: bad allocation
API String ID: 340456944-2104205924
Opcode ID: 35f1bc3740df1caf6d7d07bf89e0cc798afd3c848886c57562113992f615682e
Instruction ID: 3ee8c75777ba9af73c79dd49f583bab263bfe495d8a24ac9b0f3131d0a133588
Opcode Fuzzy Hash: 35f1bc3740df1caf6d7d07bf89e0cc798afd3c848886c57562113992f615682e
Instruction Fuzzy Hash: 2F217132608B42D2DB14BF15EC8016AF3A4FB94BA4B848235DBAD037A4DF3CD565CB50

Function 00007FF746DAC77A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF746DAC805

Strings

!, xrefs: 00007FF746DAC831
sqrt, xrefs: 00007FF746DAC7F9

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _handle_error
String ID: !$sqrt
API String ID: 1757819995-799759792
Opcode ID: 062c47d617d1b06cc8f9885f04ed537725f66ac90b938101cb89aa41ff868c8d
Instruction ID: 7a12b429b8839acb009354eff8c6c9a5b22225e8df1028c967bbe6aef2508771
Opcode Fuzzy Hash: 062c47d617d1b06cc8f9885f04ed537725f66ac90b938101cb89aa41ff868c8d
Instruction Fuzzy Hash: C5219572D1CB85C2DB51EF61A84136BE661FFDA7A4F600335EA6915BC9DB6CD0418F00

Function 00007FF746DDBE91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF746DA8CA0: _getptd.LIBCMT ref: 00007FF746DA8CAD
Part of subcall function 00007FF746DA8CA0: _inconsistency.LIBCMT ref: 00007FF746DA8CBB
Part of subcall function 00007FF746DA8CA0: _getptd.LIBCMT ref: 00007FF746DA8CC0
Part of subcall function 00007FF746DA8CA0: _inconsistency.LIBCMT ref: 00007FF746DA8CDC

_getptd.LIBCMT ref: 00007FF746DDBEE4
_getptd.LIBCMT ref: 00007FF746DDBEF7

Part of subcall function 00007FF746DA8D30: _getptd.LIBCMT ref: 00007FF746DA8D39

Strings

csm, xrefs: 00007FF746DDBEB1

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _getptd$_inconsistency
String ID: csm
API String ID: 1773999731-1018135373
Opcode ID: cc382658ad257d6a53cdc3de2009e2b9ead7a3f4f7326b46ffc43048dfa9dc90
Instruction ID: 86f2eb64eeecbd252c4cb74b57d763a48a86c5651a828573e5e99a793606fb0f
Opcode Fuzzy Hash: cc382658ad257d6a53cdc3de2009e2b9ead7a3f4f7326b46ffc43048dfa9dc90
Instruction Fuzzy Hash: 4C012C6290C682C9DF60FE718C912BEE3A4EF54B99F841572DF1D8B745DE28D880CB50

Function 00007FF746DCBB84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00007FF746DCBBD4
_CxxThrowException.LIBCMT ref: 00007FF746DCBBF1

Strings

pContext, xrefs: 00007FF746DCBBBE

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrowstd::exception::exception
String ID: pContext
API String ID: 4279132481-2046700901
Opcode ID: 9a9254acd0818dea865ed3536d1d2b2c234e7448caf268871d4950f6f5e143a4
Instruction ID: baa921f20cc572b49ca5522341096507c37d3910e2a247770ca81cc33a3e72db
Opcode Fuzzy Hash: 9a9254acd0818dea865ed3536d1d2b2c234e7448caf268871d4950f6f5e143a4
Instruction Fuzzy Hash: 5CF04666A0DB4AC1DE18FB01E98416AE3A1FF88BC4B848031DA9D07B28EF7CD154CB40

Function 00007FF746DAC778 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF746DAC805

Strings

sqrt, xrefs: 00007FF746DAC7F9
!, xrefs: 00007FF746DAC7E9

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: _handle_error
String ID: !$sqrt
API String ID: 1757819995-799759792
Opcode ID: 9ee81001ab96a3020d92c62d35741d9657c359ef35bf3942f53d73308bbadfc5
Instruction ID: 7c6348b69fd7c759541e06670a56850d8450bfacb979a4aff904654fff6f094e
Opcode Fuzzy Hash: 9ee81001ab96a3020d92c62d35741d9657c359ef35bf3942f53d73308bbadfc5
Instruction Fuzzy Hash: F2F08676E1CB85C2DA10EF51D841367E621EFEB7A4F504335EA5C19B88DB6CD0808F40

Function 00007FF746DD0888 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00007FF746DD08B3
_CxxThrowException.LIBCMT ref: 00007FF746DD08D0

Strings

pThreadProxy, xrefs: 00007FF746DD089D

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: ExceptionThrowstd::exception::exception
String ID: pThreadProxy
API String ID: 4279132481-3651400591
Opcode ID: 3b6d5a5437ee8c8c730aa7db00305f52f2161aba5272be33be333d17a79e59f8
Instruction ID: fb8432d761d487edb983dac2b897515465960e42e02e35ee18ae01d27565890a
Opcode Fuzzy Hash: 3b6d5a5437ee8c8c730aa7db00305f52f2161aba5272be33be333d17a79e59f8
Instruction Fuzzy Hash: ADE01CB5A0CB4BD0DE14FB40F84419AE3A4FB84348FD04531D69C46A64DE7CD219CB50

Function 00007FF746DD911D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DD912F

Part of subcall function 00007FF746DA4C48: std::bad_exception::bad_exception.LIBCMT ref: 00007FF746DA4C51

_CxxThrowException.LIBCMT ref: 00007FF746DD9140

Part of subcall function 00007FF746DA87F8: RtlPcToFileHeader.KERNEL32 ref: 00007FF746DA8887
Part of subcall function 00007FF746DA87F8: RaiseException.KERNEL32 ref: 00007FF746DA88C6

Strings

Access violation - no RTTI data!, xrefs: 00007FF746DD9123

Memory Dump Source

Source File: 00000000.00000002.2027370922.00007FF746D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF746D70000, based on PE: true

Associated: 00000000.00000002.2027338420.00007FF746D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027426396.00007FF746DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027497628.00007FF746E03000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027537069.00007FF746E0A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff746d70000_1PI1dOAtKY.jbxd

Similarity

API ID: Exceptionstd::bad_exception::bad_exception$FileHeaderRaiseThrow
String ID: Access violation - no RTTI data!
API String ID: 2866377151-2158758863
Opcode ID: 23997e88545030d1aea56eb2b441ca10bd2c9bedac894ae6f7fbeb74f77f7ac1
Instruction ID: ec05809e10a1992df7fff72f2032981202d5db26d380dc368eb02bb679bb7a58
Opcode Fuzzy Hash: 23997e88545030d1aea56eb2b441ca10bd2c9bedac894ae6f7fbeb74f77f7ac1
Instruction Fuzzy Hash: 09E01A26A1CA46D1DA41FB01F8817AAE320F784394FC11132EE1C43659DF39D98BCB50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1PI1dOAtKY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: 1PI1dOAtKY.exePID: 6404, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 1816, Parent PID: 6404

General

Chronological Activities

Disassembly

Windows Analysis Report
1PI1dOAtKY.exe

Function 00007FF746DB2644 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Function 00007FF746DA7C18 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73
COMMONLIBRARYCODE

Function 00007FF746DA7CC5 Relevance: 21.1, APIs: 14, Instructions: 76
COMMON

Function 00007FF746DC5528 Relevance: 16.6, APIs: 11, Instructions: 81
COMMONLIBRARYCODE

Function 00007FF746DB2314 Relevance: 15.1, APIs: 10, Instructions: 67
COMMONLIBRARYCODE

Function 00007FF746DB4E1C Relevance: 15.1, APIs: 10, Instructions: 67
COMMONLIBRARYCODE

Function 00007FF746DB2564 Relevance: 13.6, APIs: 9, Instructions: 67
COMMONLIBRARYCODE

Function 00007FF746DB36E8 Relevance: 13.6, APIs: 9, Instructions: 57
COMMONLIBRARYCODE

Function 00007FF746D93A00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 195
COMMON

Function 00007FF746D7DF90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
networkCOMMON

Function 00007FF746D935E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 198
COMMON

Function 00007FF746DA0974 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Function 00007FF746DB741C Relevance: 4.6, APIs: 3, Instructions: 65
COMMONLIBRARYCODE

Function 00007FF746D7DE90 Relevance: 4.5, APIs: 3, Instructions: 46
COMMON

Function 00007FF746D93D00 Relevance: 3.1, APIs: 2, Instructions: 69
COMMON