Edit tour

Windows Analysis Report
799Ox3XqxO.exe

Overview

General Information

Sample name:	799Ox3XqxO.exe renamed because original name is a hash value
Original sample name:	22f483e5f7640b4c3fb7c6170e20996f.exe
Analysis ID:	1557011
MD5:	22f483e5f7640b4c3fb7c6170e20996f
SHA1:	805294726f41bd098ac3731ae9c8d4e5dc0f3eca
SHA256:	8977bd6cba3e53c7f58f54531bd537d8fd760c887aaa2ec40e63a56dfed70e54
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found pyInstaller with non standard icon

Machine Learning detection for dropped file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

799Ox3XqxO.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\799Ox3XqxO.exe" MD5: 22F483E5F7640B4C3FB7C6170E20996F)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

799Ox3XqxO.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\799Ox3XqxO.exe" MD5: 22F483E5F7640B4C3FB7C6170E20996F)

cmd.exe (PID: 1124 cmdline: cmd /c echo %temp% MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6000 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\INST.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

INST.exe (PID: 4308 cmdline: C:\Users\user\AppData\Local\Temp\INST.exe MD5: 6EBB74CECB03FC2113252F69DDB68634)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["31.177.109.130:1912"], "Bot Id": "svis", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\INST.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.2107272579.0000000000172000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 799Ox3XqxO.exe PID: 6468	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: INST.exe PID: 4308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: INST.exe PID: 4308	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.INST.exe.170000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:37:06.057168+0100	2043234	1	A Network Trojan was detected	31.177.109.130	1912	192.168.2.5	49705	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:37:05.748280+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:11.103122+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:14.525840+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:15.184640+0100	2043231	1	A Network Trojan was detected	192.168.2.5	49705	31.177.109.130	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:37:13.266051+0100	2046056	1	A Network Trojan was detected	31.177.109.130	1912	192.168.2.5	49705	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:37:05.748280+0100	2046045	1	A Network Trojan was detected	192.168.2.5	49705	31.177.109.130	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["31.177.109.130:1912"], "Bot Id": "svis", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\INST.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Virustotal: Detection: 73%			Perma Link

Multi AV Scanner detection for submitted file

Source: 799Ox3XqxO.exe	ReversingLabs: Detection: 20%
Source: 799Ox3XqxO.exe	Virustotal: Detection: 47%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Joe Sandbox ML: detected

Source: 799Ox3XqxO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2090752080.000002400E463000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2090893778.000002400E463000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2085185633.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 799Ox3XqxO.exe, 00000000.00000003.2085304365.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2085304365.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2084862708.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2084700965.000002400E462000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 799Ox3XqxO.exe, 00000000.00000003.2084700965.000002400E462000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2085460075.000002400E463000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: python313.dll.0.dr

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD708840 FindFirstFileExW,FindClose,	0_2_00007FF7FD708840
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD707800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7FD707800
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD722AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7FD722AE4
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD708840 FindFirstFileExW,FindClose,	3_2_00007FF7FD708840
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD707800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF7FD707800
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD722AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7FD722AE4

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 0636CC60h	6_2_0636C768
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 06367E9Bh	6_2_06367C68
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 0636A72Bh	6_2_0636A468
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_06361CD8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 06361AA7h	6_2_06361348
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 0636881Ah	6_2_063683F8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 06368C9Ah	6_2_063683F8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 063647A1h	6_2_06364789
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 0636637Dh	6_2_0636635C
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 4x nop then jmp 0636040Dh	6_2_06360040

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49705 -> 31.177.109.130:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49705 -> 31.177.109.130:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 31.177.109.130:1912 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 31.177.109.130:1912 -> 192.168.2.5:49705

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 31.177.109.130:1912

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 31.177.109.130:1912

Source: Joe Sandbox View

ASN Name: UNILINK-ASRU UNILINK-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130
Source: unknown	TCP traffic detected without corresponding DNS query: 31.177.109.130

Source: 799Ox3XqxO.exe, 00000000.00000003.2090893778.000002400E463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: 799Ox3XqxO.exe, 00000000.00000003.2090893778.000002400E463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi9
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: INST.exe, 00000006.00000002.2223829634.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: INST.exe, 00000006.00000002.2223829634.00000000027B2000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: INST.exe, 00000006.00000002.2223829634.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 799Ox3XqxO.exe, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, python313.dll.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 799Ox3XqxO.exe, 00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000000.2107272579.0000000000172000.00000002.00000001.01000000.00000006.sdmp, INST.exe.3.dr	String found in binary or memory: https://api.ip.sb/ip
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 799Ox3XqxO.exe, 00000003.00000003.2106642629.000001A7D522D000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244023976.000001A7D4FC0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2106762789.000001A7D5213000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2243035959.000001A7D4FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 799Ox3XqxO.exe, 00000003.00000002.2259237122.000001A7D5090000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: 799Ox3XqxO.exe, 00000003.00000002.2258913392.000001A7D4FCA000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2256632653.000001A7D4FC6000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244023976.000001A7D4FC0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2248665131.000001A7D4FC3000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2095623390.000001A7D4FC1000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2243035959.000001A7D4FBE000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2249511736.000001A7D4FC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4CD4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4CD4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: 799Ox3XqxO.exe, 00000003.00000002.2258893564.000001A7D4FC3000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244023976.000001A7D4FC0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2253998281.000001A7D4FC3000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2248665131.000001A7D4FC3000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2095623390.000001A7D4FC1000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2256299676.000001A7D4FC3000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2243035959.000001A7D4FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 799Ox3XqxO.exe, 00000003.00000003.2247159111.000001A7D4FA0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244906146.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2246373542.000001A7D3386000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247218513.000001A7D33BF000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247041842.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258831605.000001A7D4FA2000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4CD4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 799Ox3XqxO.exe, 00000003.00000003.2247159111.000001A7D4FA0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244906146.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2246373542.000001A7D3386000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247218513.000001A7D33BF000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247041842.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258831605.000001A7D4FA2000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 799Ox3XqxO.exe, 00000003.00000003.2247159111.000001A7D4FA0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244906146.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2246373542.000001A7D3386000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247218513.000001A7D33BF000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247041842.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258831605.000001A7D4FA2000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 799Ox3XqxO.exe	String found in binary or memory: https://mozilla.org0/
Source: 799Ox3XqxO.exe, 00000003.00000002.2259665264.000001A7D53A8000.00000004.00001000.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2092293839.000001A7D33C9000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: python313.dll.0.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: libcrypto-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: python313.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/)

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD708020	0_2_00007FF7FD708020
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD727BD4	0_2_00007FF7FD727BD4
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD721B38	0_2_00007FF7FD721B38
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD7196D0	0_2_00007FF7FD7196D0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71AE20	0_2_00007FF7FD71AE20
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71F638	0_2_00007FF7FD71F638
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD726E70	0_2_00007FF7FD726E70
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD724E80	0_2_00007FF7FD724E80
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD727688	0_2_00007FF7FD727688
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD721B38	0_2_00007FF7FD721B38
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD708DC0	0_2_00007FF7FD708DC0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD710D18	0_2_00007FF7FD710D18
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD711538	0_2_00007FF7FD711538
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD70989B	0_2_00007FF7FD70989B
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD7270EC	0_2_00007FF7FD7270EC
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD719020	0_2_00007FF7FD719020
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71EFB8	0_2_00007FF7FD71EFB8
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD7127B8	0_2_00007FF7FD7127B8
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD710F1C	0_2_00007FF7FD710F1C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71173C	0_2_00007FF7FD71173C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD713750	0_2_00007FF7FD713750
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD713F8C	0_2_00007FF7FD713F8C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD722AE4	0_2_00007FF7FD722AE4
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD709A34	0_2_00007FF7FD709A34
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD70A26D	0_2_00007FF7FD70A26D
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD72A998	0_2_00007FF7FD72A998
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD711128	0_2_00007FF7FD711128
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD716CF0	0_2_00007FF7FD716CF0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD712420	0_2_00007FF7FD712420
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD714450	0_2_00007FF7FD714450
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD72531C	0_2_00007FF7FD72531C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71EB24	0_2_00007FF7FD71EB24
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71132C	0_2_00007FF7FD71132C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD713B88	0_2_00007FF7FD713B88
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD727BD4	3_2_00007FF7FD727BD4
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD7196D0	3_2_00007FF7FD7196D0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71AE20	3_2_00007FF7FD71AE20
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71F638	3_2_00007FF7FD71F638
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD726E70	3_2_00007FF7FD726E70
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD724E80	3_2_00007FF7FD724E80
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD727688	3_2_00007FF7FD727688
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD721B38	3_2_00007FF7FD721B38
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD708DC0	3_2_00007FF7FD708DC0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD710D18	3_2_00007FF7FD710D18
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD711538	3_2_00007FF7FD711538
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD70989B	3_2_00007FF7FD70989B
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD7270EC	3_2_00007FF7FD7270EC
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD708020	3_2_00007FF7FD708020
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD719020	3_2_00007FF7FD719020
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71EFB8	3_2_00007FF7FD71EFB8
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD7127B8	3_2_00007FF7FD7127B8
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD710F1C	3_2_00007FF7FD710F1C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71173C	3_2_00007FF7FD71173C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD713750	3_2_00007FF7FD713750
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD713F8C	3_2_00007FF7FD713F8C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD722AE4	3_2_00007FF7FD722AE4
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD709A34	3_2_00007FF7FD709A34
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD70A26D	3_2_00007FF7FD70A26D
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD72A998	3_2_00007FF7FD72A998
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD711128	3_2_00007FF7FD711128
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD716CF0	3_2_00007FF7FD716CF0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD712420	3_2_00007FF7FD712420
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD714450	3_2_00007FF7FD714450
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD72531C	3_2_00007FF7FD72531C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71EB24	3_2_00007FF7FD71EB24
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71132C	3_2_00007FF7FD71132C
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD721B38	3_2_00007FF7FD721B38
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD713B88	3_2_00007FF7FD713B88
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_0244DC74	6_2_0244DC74
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_0636E6A2	6_2_0636E6A2
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06363EA0	6_2_06363EA0
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_063656A0	6_2_063656A0
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06363738	6_2_06363738
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_0636C768	6_2_0636C768
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_0636AFC8	6_2_0636AFC8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06366410	6_2_06366410
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06361CD8	6_2_06361CD8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06364D68	6_2_06364D68
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06362278	6_2_06362278
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06361348	6_2_06361348
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_063683F8	6_2_063683F8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_063630F8	6_2_063630F8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06360978	6_2_06360978
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06368F38	6_2_06368F38
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06363729	6_2_06363729
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06366402	6_2_06366402
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06361CC8	6_2_06361CC8
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06364D67	6_2_06364D67
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06366D50	6_2_06366D50
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_063683E7	6_2_063683E7
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_06360040	6_2_06360040
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Code function: 6_2_063630F7	6_2_063630F7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll 36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: String function: 00007FF7FD702020 appears 34 times
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: String function: 00007FF7FD701E50 appears 106 times

Source: 799Ox3XqxO.exe

Static PE information: invalid certificate

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 799Ox3XqxO.exe, 00000000.00000003.2084700965.000002400E462000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2090893778.000002400E463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2090752080.000002400E463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2085013333.000002400E462000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2085304365.000002400E462000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2085460075.000002400E463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2084862708.000002400E462000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000000.00000003.2085185633.000002400E462000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 799Ox3XqxO.exe
Source: 799Ox3XqxO.exe, 00000003.00000003.2106585781.000001A7D5321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 799Ox3XqxO.exe

Source: 799Ox3XqxO.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9956395348837209

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/13@0/1

Source: C:\Users\user\AppData\Local\Temp\INST.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI66642

Jump to behavior

Source: 799Ox3XqxO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: INST.exe, 00000006.00000002.2223829634.0000000002A72000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002A88000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 799Ox3XqxO.exe	ReversingLabs: Detection: 20%
Source: 799Ox3XqxO.exe	Virustotal: Detection: 47%

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

File read: C:\Users\user\Desktop\799Ox3XqxO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\799Ox3XqxO.exe "C:\Users\user\Desktop\799Ox3XqxO.exe"
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Users\user\Desktop\799Ox3XqxO.exe "C:\Users\user\Desktop\799Ox3XqxO.exe"
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\cmd.exe cmd /c echo %temp%
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\INST.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\INST.exe C:\Users\user\AppData\Local\Temp\INST.exe
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Users\user\Desktop\799Ox3XqxO.exe "C:\Users\user\Desktop\799Ox3XqxO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\cmd.exe cmd /c echo %temp%	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\INST.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\INST.exe C:\Users\user\AppData\Local\Temp\INST.exe	Jump to behavior

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 799Ox3XqxO.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 799Ox3XqxO.exe

Static file information: File size 7466653 > 1048576

Source: 799Ox3XqxO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 799Ox3XqxO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 799Ox3XqxO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 799Ox3XqxO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 799Ox3XqxO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 799Ox3XqxO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 799Ox3XqxO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 799Ox3XqxO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2090752080.000002400E463000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2090893778.000002400E463000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2085185633.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 799Ox3XqxO.exe, 00000000.00000003.2085304365.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2085304365.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2084862708.000002400E462000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2084700965.000002400E462000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 799Ox3XqxO.exe, 00000000.00000003.2084700965.000002400E462000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 799Ox3XqxO.exe, 00000000.00000003.2085460075.000002400E463000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: python313.dll.0.dr

Source: 799Ox3XqxO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 799Ox3XqxO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 799Ox3XqxO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 799Ox3XqxO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 799Ox3XqxO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: INST.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x51d5f
Source: 799Ox3XqxO.exe	Static PE information: real checksum: 0x720b36 should be: 0x72c38c

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python313.dll.0.dr	Static PE information: section name: PyRuntim

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Process created: "C:\Users\user\Desktop\799Ox3XqxO.exe"

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\INST.exe	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll	Jump to dropped file

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Code function: 0_2_00007FF7FD706B00 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7FD706B00

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\INST.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\INST.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Memory allocated: 2400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Memory allocated: 2660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Memory allocated: 2460000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Window / User API: threadDelayed 956			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Window / User API: threadDelayed 3016			Jump to behavior

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI66642\_lzma.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-19045

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

API coverage: 7.0 %

Source: C:\Users\user\AppData\Local\Temp\INST.exe TID: 5588	Thread sleep time: -12912720851596678s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe TID: 5436	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD708840 FindFirstFileExW,FindClose,	0_2_00007FF7FD708840
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD707800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7FD707800
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD722AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7FD722AE4
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD708840 FindFirstFileExW,FindClose,	3_2_00007FF7FD708840
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD707800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF7FD707800
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD722AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7FD722AE4

Source: C:\Users\user\AppData\Local\Temp\INST.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002C29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LRjq
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002A02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LRjq
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: INST.exe, 00000006.00000002.2222867397.00000000007FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: INST.exe, 00000006.00000002.2230699623.0000000003753000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: INST.exe, 00000006.00000002.2223829634.0000000002B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Code function: 6_2_0636AFC8 LdrInitializeThunk,

6_2_0636AFC8

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Code function: 0_2_00007FF7FD70C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7FD70C6FC

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Code function: 0_2_00007FF7FD7246F0 GetProcessHeap,

0_2_00007FF7FD7246F0

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD70C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FD70C6FC
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD70BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7FD70BE60
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD71B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FD71B558
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 0_2_00007FF7FD70C8A0 SetUnhandledExceptionFilter,	0_2_00007FF7FD70C8A0
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD70C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7FD70C6FC
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD70BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF7FD70BE60
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD71B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7FD71B558
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Code function: 3_2_00007FF7FD70C8A0 SetUnhandledExceptionFilter,	3_2_00007FF7FD70C8A0

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Users\user\Desktop\799Ox3XqxO.exe "C:\Users\user\Desktop\799Ox3XqxO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\cmd.exe cmd /c echo %temp%	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\INST.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\INST.exe C:\Users\user\AppData\Local\Temp\INST.exe	Jump to behavior

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Code function: 0_2_00007FF7FD72A7E0 cpuid

0_2_00007FF7FD72A7E0

Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI66642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\Desktop\799Ox3XqxO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\799Ox3XqxO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\INST.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\INST.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Code function: 0_2_00007FF7FD70C5E0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7FD70C5E0

Source: C:\Users\user\Desktop\799Ox3XqxO.exe

Code function: 0_2_00007FF7FD726E70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7FD726E70

Source: C:\Users\user\AppData\Local\Temp\INST.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\INST.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.0.INST.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.2107272579.0000000000172000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 799Ox3XqxO.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INST.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\INST.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\INST.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INST.exe PID: 4308, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.0.INST.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.2107272579.0000000000172000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 799Ox3XqxO.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INST.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\INST.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	241 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
799Ox3XqxO.exe	21%	ReversingLabs	Win64.Trojan.Generic
799Ox3XqxO.exe	48%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\INST.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\INST.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
C:\Users\user\AppData\Local\Temp\INST.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI66642\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\_bz2.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI66642\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI66642\unicodedata.pyd	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	INST.exe, 00000006.00000002.2223829634.00000000027B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	799Ox3XqxO.exe, 00000003.00000003.2247159111.000001A7D4FA0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244906146.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2246373542.000001A7D3386000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247218513.000001A7D33BF000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247041842.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258831605.000001A7D4FA2000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	799Ox3XqxO.exe, 00000003.00000003.2106642629.000001A7D522D000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244023976.000001A7D4FC0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2106762789.000001A7D5213000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2243035959.000001A7D4FBE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://cacerts.digi	799Ox3XqxO.exe, 00000000.00000003.2090893778.000002400E463000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0205/	799Ox3XqxO.exe, 00000003.00000002.2259665264.000001A7D53A8000.00000004.00001000.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2092293839.000001A7D33C9000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	799Ox3XqxO.exe, 00000003.00000002.2258913392.000001A7D4FCA000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2256632653.000001A7D4FC6000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244023976.000001A7D4FC0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2248665131.000001A7D4FC3000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2095623390.000001A7D4FC1000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2243035959.000001A7D4FBE000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2249511736.000001A7D4FC5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4CD4000.00000004.00001000.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	799Ox3XqxO.exe, 00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000000.2107272579.0000000000172000.00000002.00000001.01000000.00000006.sdmp, INST.exe.3.dr	false	high
https://mozilla.org0/	799Ox3XqxO.exe	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	799Ox3XqxO.exe, 00000003.00000003.2247159111.000001A7D4FA0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244906146.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2246373542.000001A7D3386000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247218513.000001A7D33BF000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247041842.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258831605.000001A7D4FA2000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	799Ox3XqxO.exe, 00000003.00000002.2258560454.000001A7D4C50000.00000004.00001000.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	INST.exe, 00000006.00000002.2230699623.00000000037F8000.00000004.00000800.00020000.00000000.sdmp, INST.exe, 00000006.00000002.2223829634.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	799Ox3XqxO.exe, 00000003.00000003.2247159111.000001A7D4FA0000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2244906146.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2246373542.000001A7D3386000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247218513.000001A7D33BF000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000003.2247041842.000001A7D4F9E000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258831605.000001A7D4FA2000.00000004.00000020.00020000.00000000.sdmp, 799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.python.org/psf/license/)	python313.dll.0.dr	false	high
http://tempuri.org/Entity/Id14	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	799Ox3XqxO.exe, 00000003.00000002.2258452298.000001A7D33C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	INST.exe, 00000006.00000002.2223829634.0000000002661000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	INST.exe, 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.177.109.130	unknown	Russian Federation		44053	UNILINK-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557011
Start date and time:	2024-11-17 03:36:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	799Ox3XqxO.exe renamed because original name is a hash value
Original Sample Name:	22f483e5f7640b4c3fb7c6170e20996f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/13@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 86 Number of non-executed functions: 130
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:37:12	API Interceptor	21x Sleep call for process: INST.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNILINK-ASRU	UwKpCJ6l4p.exe	Get hash	malicious	DCRat	Browse	31.177.108.176
	w0QdNGUNtd.exe	Get hash	malicious	RedLine	Browse	31.177.110.65
	GAzFeul43b.exe	Get hash	malicious	RedLine	Browse	31.177.108.40
	Z7q8C34yfN.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	31.177.110.44
	84JufgBTrA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	31.177.108.211
	Galaxy Swapper v2.0.3.exe	Get hash	malicious	RedLine	Browse	31.177.108.53
	Build.exe	Get hash	malicious	Luca Stealer, Quasar	Browse	31.177.108.29
	KR6nDu9fLhop1bFe.exe	Get hash	malicious	Quasar	Browse	31.177.108.29
	k5kWDiia0s.elf	Get hash	malicious	Mirai, Gafgyt	Browse	95.174.91.180
	hVRAoMLVTN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	95.174.91.180

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll	XODc5nV1kC.exe	Get hash	malicious	LummaC	Browse
	active.exe	Get hash	malicious	Unknown	Browse
	Creal.exe	Get hash	malicious	Creal Stealer	Browse
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse
	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse
	MVPloader.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INST.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\INST.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\INST.exe

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	307712
Entropy (8bit):	5.081310441128374
Encrypted:	false
SSDEEP:	3072:GcZqf7D34cp/0+mAykyoORQYg/xB1fA0PuTVAtkxzA3R4eqiOL2bBOA:GcZqf7DIknmWhB1fA0GTV8kqYL
MD5:	6EBB74CECB03FC2113252F69DDB68634
SHA1:	E2F55A7901B2475700CE6C34EEA017D11BF2D554
SHA-256:	DA50552614D109888646D706E671D607D167905AFB0B7D32577BEA9B7D9FC0EE
SHA-512:	043176686E765D5FDA893F2796FF781A57CB9B79551B09079F92D2E114FBF5FD7F58B8AD7ECF59F9448A43574E68D4361E5D850F2611EF3A15A9730FD5115392
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\INST.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@.................................@...K.... ............................................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B................p.......H....... ... ...........(w..............................................a.u.t.o.f.i.l.l.5.t.Y.W.R.q.a.W.V.o.a.m.h.h.a.m.J.8.W.W.9.y.b.2.l.X.Y.W.x.s.Z.X.Q.K.a.W.J.u.Z.W.p.k.Z.m.p.t.b.W.t.w.Y.2.5.s.c.G.V.i.a.2.x.t.b.m.t.v.Z.W.9.p.a.G.9.m.Z.W.N.8.V.H.J.v.b.m.x.p.b.m.s.K.a.m.J.k.Y.W.9.j.b.m.V.p.a.W.l.u.b.W.p.i.a.m.x.n.Y.W.x.o.Y.2.V.s.Z.2.J.l.a.m.1.u.a.W.R.8.T.m.l.m.d.H.l.X.Y.W.x.s.Z.X.Q.K.b.m.t.i.a.W.h.m.Y.m.V.v.Z.2.F.l.Y.W.9.l.a.G.x.l.Z.m.5.r.b.2.R.i.Z.W.Z.n.c.G.d.r.b.m.5.8.T.W.

C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: XODc5nV1kC.exe, Detection: malicious, Browse Filename: active.exe, Detection: malicious, Browse Filename: Creal.exe, Detection: malicious, Browse Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: B6EGeOHEFm.exe, Detection: malicious, Browse Filename: Q60ZbERXWZ.exe, Detection: malicious, Browse Filename: XCubQJqiz7.exe, Detection: malicious, Browse Filename: MVPloader.exe, Detection: malicious, Browse Filename: MVPloader.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI66642\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\python313.dll

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\select.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI66642\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\799Ox3XqxO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.991655591664257
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	799Ox3XqxO.exe
File size:	7'466'653 bytes
MD5:	22f483e5f7640b4c3fb7c6170e20996f
SHA1:	805294726f41bd098ac3731ae9c8d4e5dc0f3eca
SHA256:	8977bd6cba3e53c7f58f54531bd537d8fd760c887aaa2ec40e63a56dfed70e54
SHA512:	f4a3115a54d9b83efe8a3afd1b685ea1f9e8dec2e101b5a757b09f3ea1b80b938f951805971cadc05d009daeb8f2f6481bee2aa8c3aa71b39705a6d0fb2187a9
SSDEEP:	196608:3AckY8XMCHGLLc54i1wN+lPIcu9KYK39sI3PPJNMRRccx8:QXXMCHWUjqcuI3/PJNey
TLSH:	C176335865D015FEEAB3803CDFF11697D975B8620B32C69B87A883928E532D08D3D763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xh.B<...<...<...wq..;...wq......wq..6...,.W.>...,...5...,...-...,.......wq..;...<.......w...%...w...=...Rich<...........PE..d..

File Icon


Icon Hash:	0f3317af33160e09

Static PE Info

General

Entrypoint:	0x14000c380
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67331332 [Tue Nov 12 08:34:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a06f302f71edd380da3d5bf4a6d94ebd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	02/04/2024 02:00:00 19/06/2027 01:59:59
Subject Chain	CN=Mozilla Corporation, OU=Firefox Engineering Operations, O=Mozilla Corporation, L=San Francisco, S=California, C=US
Version:	3
Thumbprint MD5:	C7D85E7FB216697F9E1CDEEABDF1D6A3
Thumbprint SHA-1:	40890F2FE1ACAE18072FA7F3C0AE456AACC8570D
Thumbprint SHA-256:	BB8FFB6AB921F253B7D24AA68E449286E17DA713C38142EDA6D909E9892EE179
Serial:	0737B0D0DCDCAB8D78D2F40CB122F93F

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F35807FFD1Ch
dec eax
add esp, 28h
jmp 00007F35807FF92Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F35808000A8h
test eax, eax
je 00007F35807FFAE3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F35807FFAC7h
dec eax
cmp ecx, eax
je 00007F35807FFAD6h
xor eax, eax
dec eax
cmpxchg dword ptr [000381ACh], ecx
jne 00007F35807FFAB0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F35807FFAB9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F35807FFAC9h
mov byte ptr [00038195h], 00000001h
call 00007F35807FF205h
call 00007F35808004C0h
test al, al
jne 00007F35807FFAC6h
xor al, al
jmp 00007F35807FFAD6h
call 00007F358080E9CFh
test al, al
jne 00007F35807FFACBh
xor ecx, ecx
call 00007F35808004D0h
jmp 00007F35807FFAACh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003815Ch], 00000000h
mov ebx, ecx
jne 00007F35807FFB29h
cmp ecx, 01h
jnbe 00007F35807FFB2Ch
call 00007F358080001Eh
test eax, eax
je 00007F35807FFAEAh
test ebx, ebx
jne 00007F35807FFAE6h
dec eax
lea ecx, dword ptr [00038146h]
call 00007F358080E7C2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e9ec	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x2af6c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x22bc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x71c05d	0x2e40
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x74000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3bfb0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3be70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x400	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b170	0x2b200	420661550c659f884db561712e500aae	False	0.5455615942028985	data	6.498595774489571	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x12802	0x12a00	ce33b83c72d29c8937f4893d6abc4533	False	0.5229262793624161	data	5.7684281187463675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x5408	0xe00	aff56347f897785154c53727472c548d	False	0.13504464285714285	data	1.8315705466577277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x22bc	0x2400	2411a276649fc67a0a93227155911735	False	0.4740668402777778	data	5.334571311334213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x2af6c	0x2b000	a8b940a0e8d97a0a3c0848a47ae14c57	False	0.9956395348837209	data	7.973842322154436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x74000	0x768	0x800	42d6242177dbae8e11ed5d64b87d0d48	False	0.5576171875	data	5.268722219019965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x490e8	0x2a95d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.0
RT_GROUP_ICON	0x73a48	0x14	data	1.1
RT_MANIFEST	0x73a5c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	TranslateMessage, ShutdownBlockReasonCreate, GetWindowThreadProcessId, SetWindowLongPtrW, GetWindowLongPtrW, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, GetMessageW
KERNEL32.dll	GetTimeZoneInformation, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, GetStringTypeW, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, HeapSize, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, GetConsoleWindow, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, GetFileAttributesExW, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetDriveTypeW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableW
ADVAPI32.dll	ConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T03:37:05.748280+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:05.748280+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:06.057168+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	31.177.109.130	1912	192.168.2.5	49705	TCP
2024-11-17T03:37:11.103122+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:13.266051+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	31.177.109.130	1912	192.168.2.5	49705	TCP
2024-11-17T03:37:14.525840+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49705	31.177.109.130	1912	TCP
2024-11-17T03:37:15.184640+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49705	31.177.109.130	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 03:37:04.750705957 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:04.755892992 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:04.755984068 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:04.765007019 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:04.770097017 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:05.720623970 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:05.748280048 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:05.753330946 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:06.057168007 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:06.108942032 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:11.103121996 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:11.108489990 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413291931 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413340092 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413376093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413410902 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413420916 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:11.413444042 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413481951 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:11.413485050 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:11.413834095 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.260766983 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266051054 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266103983 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266129971 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266149998 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266166925 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266180038 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266208887 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266227007 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266242981 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266262054 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266277075 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266304970 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266307116 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266336918 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266340017 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266366959 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266366959 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.266392946 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.266417980 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271264076 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271295071 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271349907 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271356106 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271400928 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271429062 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271456957 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271457911 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271509886 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271533966 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271564960 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271593094 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271641970 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271848917 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271898985 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271913052 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.271925926 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.271994114 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.272001028 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.272053957 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276396036 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276452065 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276460886 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276513100 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276539087 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276618004 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276662111 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276738882 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276742935 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276787996 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276799917 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276849985 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276882887 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276926994 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276937962 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.276958942 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.276993990 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277020931 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277049065 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277076960 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277103901 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277124882 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277132034 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277153015 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277201891 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277209044 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277230978 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277259111 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277261019 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277286053 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277307034 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277312040 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277334929 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277362108 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277374029 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277405977 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277409077 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277436972 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277462959 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277483940 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277489901 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277520895 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277530909 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277556896 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277569056 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.277581930 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.277643919 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281466961 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281518936 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281536102 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281578064 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281582117 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281606913 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281631947 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281632900 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281660080 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281685114 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281686068 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281713009 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281743050 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281744957 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281768084 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281773090 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281795025 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281826973 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281888008 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281917095 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281943083 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.281944036 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.281989098 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.282422066 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282571077 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282598972 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282649040 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282675982 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282702923 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282749891 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282778025 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282804012 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282855988 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282882929 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282934904 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282962084 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.282989025 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283015966 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283041954 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283070087 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283118963 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283145905 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283174992 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283201933 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283231020 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283282042 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283309937 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283350945 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283376932 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283425093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283452034 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283479929 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283505917 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283533096 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283559084 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283607960 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283636093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283663034 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283674955 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.283689022 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283715963 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283765078 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283792973 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283797979 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.283819914 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283848047 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283874035 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283921957 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283948898 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.283976078 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284002066 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284028053 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284054041 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284080029 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284128904 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284156084 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284182072 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284209967 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284235954 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284262896 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.284293890 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286597967 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286732912 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286761045 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286870003 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286897898 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286925077 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.286956072 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287184000 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287246943 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287273884 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287345886 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287373066 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287400007 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287447929 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287475109 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287501097 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287527084 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287554026 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287580013 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287606001 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287653923 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287681103 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287708044 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287734032 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.287780046 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.288014889 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.288132906 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.289120913 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289220095 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289247036 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289299011 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289325953 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289375067 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289402962 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289448977 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289477110 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289504051 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289530993 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289557934 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289585114 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289633989 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289661884 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289689064 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289715052 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289741993 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289768934 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289820910 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289849043 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289881945 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289907932 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289935112 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.289977074 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290004969 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290030003 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290056944 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290082932 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290133953 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290162086 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290189028 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290220022 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290246964 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290272951 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290299892 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290327072 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290353060 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290379047 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290405989 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290431976 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290457964 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290483952 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290510893 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290538073 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290564060 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290590048 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290636063 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290663004 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290746927 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290764093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290775061 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.290786982 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293298006 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293309927 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293332100 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293344021 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293356895 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293368101 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293421984 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293433905 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293457031 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293468952 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293481112 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293492079 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293514013 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293526888 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293538094 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293549061 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293570995 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293581963 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293582916 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.293603897 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293615103 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293627024 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293642044 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293653965 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293683052 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.293689013 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293703079 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293714046 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293725967 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293737888 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293749094 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293770075 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293781996 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293792963 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293804884 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293817043 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293828964 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293839931 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293855906 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293868065 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293879986 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293900967 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293911934 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293924093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293935061 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293946028 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293958902 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293971062 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293982029 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.293993950 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.294004917 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.294015884 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.294044971 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.294056892 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.294068098 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299005985 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299019098 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299030066 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299043894 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299066067 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299078941 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299177885 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299190998 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299206018 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299217939 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299236059 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.299238920 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299263000 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299273968 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299284935 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299307108 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299325943 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299338102 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299350023 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299365044 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299366951 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.299392939 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299407005 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299494982 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299506903 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299519062 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299530029 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299540997 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299554110 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299566031 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299623966 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299635887 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299647093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299658060 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299669027 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299680948 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299701929 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299714088 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299725056 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299736023 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299746990 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299757957 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299768925 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299782038 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299793005 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299803972 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299814939 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299827099 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299838066 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299849033 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299880028 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299891949 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299904108 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299915075 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.299926996 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304230928 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304424047 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304450035 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304474115 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304490089 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.304558039 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304583073 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304588079 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.304626942 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304651022 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304694891 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304718971 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304743052 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304766893 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304810047 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304835081 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304858923 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304882050 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304910898 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304934978 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304958105 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.304981947 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305005074 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305027962 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305052996 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305095911 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305123091 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305147886 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305171013 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305195093 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305219889 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305243969 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305268049 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305291891 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305315971 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305340052 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305362940 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305387020 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305409908 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305433989 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305458069 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305480957 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305524111 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305547953 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305572033 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305594921 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305619001 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305643082 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305665970 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305690050 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305713892 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305737019 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305759907 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305783987 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.305807114 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310683012 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310751915 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310776949 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310807943 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310813904 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:13.310853958 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310878992 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310904026 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310951948 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.310978889 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311026096 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311053038 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311100006 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311126947 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311182976 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311232090 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311259985 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311285973 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311352968 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311379910 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311407089 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311434984 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311472893 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311500072 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311527967 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311554909 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311602116 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311630011 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311656952 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311683893 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311709881 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311737061 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311763048 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311789989 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311815977 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311841965 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311867952 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311893940 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311943054 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311969995 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.311995983 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.312021971 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.312048912 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.312074900 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.312100887 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:13.359069109 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:14.524876118 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:14.525840044 CET	49705	1912	192.168.2.5	31.177.109.130
Nov 17, 2024 03:37:14.530821085 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:15.141052961 CET	1912	49705	31.177.109.130	192.168.2.5
Nov 17, 2024 03:37:15.184639931 CET	49705	1912	192.168.2.5	31.177.109.130

Target ID:	0
Start time:	21:37:00
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\799Ox3XqxO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\799Ox3XqxO.exe"
Imagebase:	0x7ff7fd700000
File size:	7'466'653 bytes
MD5 hash:	22F483E5F7640B4C3FB7C6170E20996F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:37:00
Start date:	16/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:37:01
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\799Ox3XqxO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\799Ox3XqxO.exe"
Imagebase:	0x7ff7fd700000
File size:	7'466'653 bytes
MD5 hash:	22F483E5F7640B4C3FB7C6170E20996F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000003.2106585781.000001A7D52DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:37:03
Start date:	16/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c echo %temp%
Imagebase:	0x7ff7d2cf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:37:03
Start date:	16/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\INST.exe
Imagebase:	0x7ff7d2cf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:37:03
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\INST.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\INST.exe
Imagebase:	0x170000
File size:	307'712 bytes
MD5 hash:	6EBB74CECB03FC2113252F69DDB68634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000000.2107272579.0000000000172000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000002.2223829634.00000000026F6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\INST.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 00007FF7FD708020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

SetConsoleCtrlHandler.KERNEL32(FFFFFFFF,00000000,?,00007FF7FD7033B4), ref: 00007FF7FD70807B
GetStartupInfoW.KERNEL32 ref: 00007FF7FD708096

Part of subcall function 00007FF7FD71B384: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71B398

Part of subcall function 00007FF7FD719658: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7196BF

GetCommandLineW.KERNEL32 ref: 00007FF7FD708126
CreateProcessW.KERNELBASE ref: 00007FF7FD70815E
GetLastError.KERNEL32 ref: 00007FF7FD708168

Part of subcall function 00007FF7FD702310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD702360
Part of subcall function 00007FF7FD702310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD70241A

RegisterClassW.USER32 ref: 00007FF7FD7081C0
GetLastError.KERNEL32 ref: 00007FF7FD7081CB
CreateWindowExW.USER32 ref: 00007FF7FD708215
GetLastError.KERNEL32 ref: 00007FF7FD708227
WaitForSingleObject.KERNEL32 ref: 00007FF7FD708242
GetLastError.KERNEL32 ref: 00007FF7FD708255
PeekMessageW.USER32 ref: 00007FF7FD708279
TranslateMessage.USER32 ref: 00007FF7FD708287
DispatchMessageW.USER32 ref: 00007FF7FD708291
PeekMessageW.USER32 ref: 00007FF7FD7082AC
WaitForSingleObject.KERNEL32 ref: 00007FF7FD7082BE
WaitForSingleObject.KERNEL32 ref: 00007FF7FD7082D9
TerminateProcess.KERNEL32 ref: 00007FF7FD7082EF
GetLastError.KERNEL32 ref: 00007FF7FD7082F9
WaitForSingleObject.KERNEL32 ref: 00007FF7FD708307
DestroyWindow.USER32 ref: 00007FF7FD708444
GetExitCodeProcess.KERNELBASE ref: 00007FF7FD708459
CloseHandle.KERNEL32 ref: 00007FF7FD708462
CloseHandle.KERNEL32 ref: 00007FF7FD70846F

Strings

Failed to create child process!, xrefs: 00007FF7FD708170
PyInstaller Onefile Hidden Window, xrefs: 00007FF7FD7081D5
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7FD708194
CreateProcessW, xrefs: 00007FF7FD708177

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 4208240515-3165540532
Opcode ID: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
Instruction ID: 2d9d528642599ff2b6a066c96a2bb83a9b823fc030445e316efef986448dbe22
Opcode Fuzzy Hash: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
Instruction Fuzzy Hash: 2BD15431A0CA8286EB10AF74E8552A9B760FB48759F900235DA6D4BAD5FF3CD145CBF0

Function 00007FF7FD727BD4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD727908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD727949
Part of subcall function 00007FF7FD727908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7279C7
Part of subcall function 00007FF7FD727908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD727A18

CreateFileW.KERNELBASE ref: 00007FF7FD727CDA
CreateFileW.KERNEL32 ref: 00007FF7FD727D2A
GetLastError.KERNEL32 ref: 00007FF7FD727D5A
GetFileType.KERNELBASE ref: 00007FF7FD727D6F
GetLastError.KERNEL32 ref: 00007FF7FD727D79
CloseHandle.KERNEL32 ref: 00007FF7FD727DAC
CloseHandle.KERNEL32 ref: 00007FF7FD727F0F
CreateFileW.KERNEL32 ref: 00007FF7FD727F44
GetLastError.KERNEL32 ref: 00007FF7FD727F53

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
Instruction ID: 499752a41a6a50ceef8625cbd51d5fabddf0125e94f55a1d7201da7d6b6abc8a
Opcode Fuzzy Hash: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
Instruction Fuzzy Hash: 4FC1C032B2CA8185EB10EF64D5802BC7761E74DBA8B811229DA2E5B7D4EF38D455C7E0

Function 00007FF7FD707800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,00007FF7FD707F59,00007FF7FD7033DA), ref: 00007FF7FD70786B
RemoveDirectoryW.KERNEL32 ref: 00007FF7FD7078EE
DeleteFileW.KERNELBASE ref: 00007FF7FD70790D
FindNextFileW.KERNELBASE ref: 00007FF7FD70791B
FindClose.KERNEL32 ref: 00007FF7FD70792C
RemoveDirectoryW.KERNELBASE ref: 00007FF7FD707935

Strings

%s\*, xrefs: 00007FF7FD707832

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
Instruction ID: 470e8bde98ca2c917ec2a044185a2294cf6382406cdbbb71d78f5c796f33dc54
Opcode Fuzzy Hash: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
Instruction Fuzzy Hash: FA415121A1C59285EB30BB20A8486B9B361FB98755FD00632D96D4B6D4FF2CD64AC7F0

Function 00007FF7FD708840 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7FD708873
FindClose.KERNELBASE ref: 00007FF7FD708882

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
Instruction ID: 7deff5693d7dc9c63736dd1d1517b42b836c8fdb6df488e8b0ba2046baedc36f
Opcode Fuzzy Hash: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
Instruction Fuzzy Hash: 45F0CD22A1C64186F760AB50B85D366F351FB88324F800335D57E0A6D4EF3CD0098BE0

Function 00007FF7FD721B38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: d70616fd39e3356d62f1cefa5de58e6b50940288d833e3fc99e884f751c7ecc8
Instruction ID: 9daebb40788ccd869da1638af2e75bb1ef946d6de3cb93950892a8af2dbf61da
Opcode Fuzzy Hash: d70616fd39e3356d62f1cefa5de58e6b50940288d833e3fc99e884f751c7ecc8
Instruction Fuzzy Hash: 2602A022A1D68280EB15BB119805279E294FF0EBA1FC58635DD3D8E3D2FE7CA40197F0

Function 00007FF7FD701000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 527COMMON

Download Yara Rule

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7FD703043
Failed to convert DLL search path!, xrefs: 00007FF7FD703222
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7FD7032ED
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7FD703302
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7FD702D9E
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7FD702DD8, 00007FF7FD702DF0, 00007FF7FD702E5C
pyi-hide-console, xrefs: 00007FF7FD702F7D
Failed to load splash screen resources!, xrefs: 00007FF7FD7032CC
pyi-python-flag, xrefs: 00007FF7FD702EA0
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7FD70317B
MEI, xrefs: 00007FF7FD702CF3
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7FD703158
minimize-early, xrefs: 00007FF7FD702FAE
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7FD702EFC
pkg, xrefs: 00007FF7FD702D7E
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7FD7030A5
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7FD702DCC, 00007FF7FD70311A, 00007FF7FD7033A0
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7FD703250
Py_GIL_DISABLED, xrefs: 00007FF7FD702EBE
VCRUNTIME140.dll, xrefs: 00007FF7FD7031F7
Could not create temporary directory!, xrefs: 00007FF7FD703105
minimize-late, xrefs: 00007FF7FD702FE8
hide-early, xrefs: 00007FF7FD702F91
Failed to remove temporary directory: %s, xrefs: 00007FF7FD7033F8
hide-late, xrefs: 00007FF7FD702FCB
pyi-contents-directory, xrefs: 00007FF7FD702F58
_PYI_ARCHIVE_FILE, xrefs: 00007FF7FD702C92, 00007FF7FD702DC0
_PYI_SPLASH_IPC, xrefs: 00007FF7FD702DE4, 00007FF7FD70333C
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7FD702C43, 00007FF7FD702C6F
Failed to start splash screen!, xrefs: 00007FF7FD70331B
pyi-runtime-tmpdir, xrefs: 00007FF7FD702F33
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7FD702D31

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-3325264605
Opcode ID: c1346cf4b298824b9ad79641df7289de93bb454833d3473a466a1e8c411a0cd2
Instruction ID: 9f70bcfd7c3f41548fe9506e947afc0cfbfe334988926b605270116e333a4dc8
Opcode Fuzzy Hash: c1346cf4b298824b9ad79641df7289de93bb454833d3473a466a1e8c411a0cd2
Instruction Fuzzy Hash: E2423F21A0C68291FB25B72098592FAE651AF5D784FC44036DA7E4E2D6FF2CE549C3F0

Function 00007FF7FD701930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD7073D0: _fread_nolock.LIBCMT ref: 00007FF7FD70747A

_fread_nolock.LIBCMT ref: 00007FF7FD7019FB

Part of subcall function 00007FF7FD702020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FD701B4A), ref: 00007FF7FD702070

Strings

Failed to read cookie!, xrefs: 00007FF7FD701A0B
fread, xrefs: 00007FF7FD701A12, 00007FF7FD701B3C
Failed to seek to cookie position!, xrefs: 00007FF7FD7019CE
fseek, xrefs: 00007FF7FD7019D5
Could not allocate buffer for TOC!, xrefs: 00007FF7FD701AFB
MEI, xrefs: 00007FF7FD701971
Could not allocate memory for archive structure!, xrefs: 00007FF7FD701A41
Error on file., xrefs: 00007FF7FD701B6D
malloc, xrefs: 00007FF7FD701B02
Could not read full TOC!, xrefs: 00007FF7FD701B35
calloc, xrefs: 00007FF7FD701A48

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 2a5ae2fd7745493d2805d04ea5b84e7346e55229abc7bda53aa1a0b2e839e741
Instruction ID: e0a5c45d094e3411d8b8287047ec9bc05fbeebd07b8c41a03e24920d1e651064
Opcode Fuzzy Hash: 2a5ae2fd7745493d2805d04ea5b84e7346e55229abc7bda53aa1a0b2e839e741
Instruction Fuzzy Hash: DC816F32A0C68285E710EB24D4592B9A3A1EB4C744FC04136E9AD8B7D5FF3CE5458BF0

Function 00007FF7FD7015E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to create symbolic link %s!, xrefs: 00007FF7FD701602
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FD701682
fwrite, xrefs: 00007FF7FD7017B1
fread, xrefs: 00007FF7FD7017C6
fseek, xrefs: 00007FF7FD7016C1
Failed to extract %s: failed to open target file!, xrefs: 00007FF7FD70163C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FD7016BA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7FD701722
fopen, xrefs: 00007FF7FD701643
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FD7017BF
malloc, xrefs: 00007FF7FD701729
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7FD7017AA

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: f14996505aee479e3fbf857bc6199d6c0c540684e92f7f83997eafc19810b08b
Instruction ID: a6ad6a246c3e7ccd8b46b1e42bd98fc9fc7534a5b4a27681700919a6bac09a36
Opcode Fuzzy Hash: f14996505aee479e3fbf857bc6199d6c0c540684e92f7f83997eafc19810b08b
Instruction Fuzzy Hash: 6F515C22A0C68242EB15BB1198141A9A3A1BF5C794FC44136EE2C4F7D6FF3CE54587F0

Function 00007FF7FD707CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF7FD703101), ref: 00007FF7FD707D44
GetCurrentProcessId.KERNEL32(?,00007FF7FD703101), ref: 00007FF7FD707D4A
CreateDirectoryW.KERNELBASE(?,00007FF7FD703101), ref: 00007FF7FD707D8C

Part of subcall function 00007FF7FD707E70: GetEnvironmentVariableW.KERNEL32(00007FF7FD702C4F), ref: 00007FF7FD707EA7
Part of subcall function 00007FF7FD707E70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FD707EC9

Part of subcall function 00007FF7FD719174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71918D

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7FD707DBE
_MEI%d, xrefs: 00007FF7FD707D52
TMP, xrefs: 00007FF7FD707CDC, 00007FF7FD707DE3
TMP, xrefs: 00007FF7FD707D02
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7FD707D1C

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 365913792-1339014028
Opcode ID: ffb589f732eab392f51c917e2ec5332ba92e64a2874c8252f98761f4106046c7
Instruction ID: 010a26c14590d229e4d024c52508480d22db0de15eaad9a4f8e4af0dd4d3770e
Opcode Fuzzy Hash: ffb589f732eab392f51c917e2ec5332ba92e64a2874c8252f98761f4106046c7
Instruction Fuzzy Hash: 7A418E21A1D68240EB24F72299592B9E251AF4DB90FC00235E92D4F7E6FF3CE94586F0

Function 00007FF7FD7011F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7FD7012CF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7FD701256
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7FD7013FE
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7FD70129A
malloc, xrefs: 00007FF7FD7012A1, 00007FF7FD7012D6
1.3.1, xrefs: 00007FF7FD701229

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 21b818922593efca9863ac24669686fe4c62a968634b6e2f67df8ae5b45223b3
Instruction ID: ed15ccd2a3e0f8b807b541f1ff7372d72d2d9a67b611032ec8929554f9ebe59a
Opcode Fuzzy Hash: 21b818922593efca9863ac24669686fe4c62a968634b6e2f67df8ae5b45223b3
Instruction Fuzzy Hash: 5B51A022A0C68245EB20BB11A8543BAE291FB48794F944135ED6D8B7D5FF3CE405C7F0

Function 00007FF7FD71FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7FD720316,?,?,-00000018,00007FF7FD71BC5B,?,?,?,00007FF7FD71BB52,?,?,?,00007FF7FD716EFE), ref: 00007FF7FD7200F8
GetProcAddress.KERNEL32(?,?,?,00007FF7FD720316,?,?,-00000018,00007FF7FD71BC5B,?,?,?,00007FF7FD71BB52,?,?,?,00007FF7FD716EFE), ref: 00007FF7FD720104

Strings

ext-ms-, xrefs: 00007FF7FD720055
api-ms-, xrefs: 00007FF7FD720042

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
Instruction ID: f90abe54904e0062abc9ea4ae4ff047cc815a776d6e68d39e045a2277b9c90e2
Opcode Fuzzy Hash: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
Instruction Fuzzy Hash: 7C41DC22B1DA8241FB22AB16A804675A291FB0DBA1FC44135CD2D8F3D8FE7DE44596F0

Function 00007FF7FD702A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7FD702BC5), ref: 00007FF7FD702AA1
GetLastError.KERNEL32(?,00007FF7FD702BC5), ref: 00007FF7FD702AAB

Part of subcall function 00007FF7FD702310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD702360
Part of subcall function 00007FF7FD702310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD70241A

Strings

Failed to obtain executable path., xrefs: 00007FF7FD702AB3
Failed to convert executable path to UTF-8., xrefs: 00007FF7FD702B50
GetModuleFileNameW, xrefs: 00007FF7FD702ABA
Failed to resolve full path to executable %ls., xrefs: 00007FF7FD702AF9
\\?\, xrefs: 00007FF7FD702B1A

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 4002088556-2863816727
Opcode ID: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
Instruction ID: dbaa86a840a33224792de4bcb75f9b9886a32a2c83d1e5d58ed8969de2b7b465
Opcode Fuzzy Hash: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
Instruction Fuzzy Hash: 9C213562B1C58281FB60BB24EC593B69250AF4C355FC00136E56E8E5D5FF2CE50487F4

Function 00007FF7FD71C95C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71CD89

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 679e2116dd05a76568968dc7f32b3b29ab801d3ec6643e684efacd8b52b00439
Instruction ID: 88a693ca1fb38e44803c2bcebb9e8540d98ab898e63780fd9ab99abcbdb8d007
Opcode Fuzzy Hash: 679e2116dd05a76568968dc7f32b3b29ab801d3ec6643e684efacd8b52b00439
Instruction Fuzzy Hash: BCC1093290C78281E721AB5590052BDEB60FB89BA0FE54335DA6D0B7D1EE7CE85587F0

Function 00007FF7FD707BB0 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7FD707BD0
OpenProcessToken.ADVAPI32 ref: 00007FF7FD707BE3
GetTokenInformation.KERNELBASE ref: 00007FF7FD707C08
GetLastError.KERNEL32 ref: 00007FF7FD707C12
GetTokenInformation.KERNELBASE ref: 00007FF7FD707C52
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FD707C6E
CloseHandle.KERNEL32 ref: 00007FF7FD707C86

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 4b16fab3d36e05ad3a3445a5c074aa8767ee98c8fbd83efe929b6b0b20bb971a
Instruction ID: 8a61ffa45dfe13b6730fb17bb4f64fcce3d16e891375c2f054d9af8657005e85
Opcode Fuzzy Hash: 4b16fab3d36e05ad3a3445a5c074aa8767ee98c8fbd83efe929b6b0b20bb971a
Instruction Fuzzy Hash: 8D215531A0CA8251EB10AB55A84453AF3A5EB897A0F900235D67D4BAE4FF6CD4458BF0

Function 00007FF7FD7085C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD707BB0: GetCurrentProcess.KERNEL32 ref: 00007FF7FD707BD0
Part of subcall function 00007FF7FD707BB0: OpenProcessToken.ADVAPI32 ref: 00007FF7FD707BE3
Part of subcall function 00007FF7FD707BB0: GetTokenInformation.KERNELBASE ref: 00007FF7FD707C08
Part of subcall function 00007FF7FD707BB0: GetLastError.KERNEL32 ref: 00007FF7FD707C12
Part of subcall function 00007FF7FD707BB0: GetTokenInformation.KERNELBASE ref: 00007FF7FD707C52
Part of subcall function 00007FF7FD707BB0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FD707C6E
Part of subcall function 00007FF7FD707BB0: CloseHandle.KERNEL32 ref: 00007FF7FD707C86

LocalFree.KERNEL32(00000000,00007FF7FD703099), ref: 00007FF7FD70864C
LocalFree.KERNEL32 ref: 00007FF7FD708655

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7FD708637
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7FD708663
S-1-3-4, xrefs: 00007FF7FD708601
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7FD708622

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
Instruction ID: b89d9aa516b181c6e34923d3431d811568ea5c2f630c031b736bc0a049d5200a
Opcode Fuzzy Hash: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
Instruction Fuzzy Hash: 1B214F21A0C68281E750BB50E8193EAE261EB8C780FD54135EA6D4B7D6FF3CD94487F0

Function 00007FF7FD71DE60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD71DE4B), ref: 00007FF7FD71DF7C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD71DE4B), ref: 00007FF7FD71E007

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
Instruction ID: d9a2e701cc75d01f9cc4eda6418bbb43b6c794d713c30baaff5ffaec9be64f3e
Opcode Fuzzy Hash: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
Instruction Fuzzy Hash: D191D432F0C65285F750AB2594402BDABA0BB08BA8FD44239DE2E5B6C5EE3DD44187F0

Function 00007FF7FD7165E4 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD716611
CreateFileW.KERNELBASE ref: 00007FF7FD716650
CloseHandle.KERNEL32 ref: 00007FF7FD716685

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
Instruction ID: b7e448ddda7af2e75b30735a1bad40ba6b49c2a64017569bbe7a0426dff67f22
Opcode Fuzzy Hash: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
Instruction Fuzzy Hash: E9419562D1C78283E754AB20951037EA260FB99774F509334E66C0BAD5FF6CA5E087F0

Function 00007FF7FD71A968 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7FD71A964), ref: 00007FF7FD71A979
TerminateProcess.KERNEL32(?,?,?,00007FF7FD71A964), ref: 00007FF7FD71A984
ExitProcess.KERNEL32 ref: 00007FF7FD71A993

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
Instruction ID: 32e70b4a6a652c37e0a88e2c7585c07c4bde0663bdef17c01ab2d2f1dd6e864e
Opcode Fuzzy Hash: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
Instruction Fuzzy Hash: ABD06710B1C68642EB543B70585627992519F8C722F821539C86A0B7D7FD2DA48A4AF0

Function 00007FF7FD70F694 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD70F6D8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD70F7CF

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction ID: 36e1b701b3d4cc9521b446dfd8a4fea18f4a0564c9283707ea00f7ea6182fe7b
Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction Fuzzy Hash: 8851E621A0D2D146E728BA2598046B9E290BF48BA4F944735DE7D0B7D9EF3CE40186F1

Function 00007FF7FD70C1FC Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD70C3DC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FD70C3F0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FD70C225
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FD70C293

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
Instruction ID: 1c1133063985f774e05a631c8056a45a3c1c577e0c3e007176c8fc8cdee1cf94
Opcode Fuzzy Hash: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
Instruction Fuzzy Hash: 19316A21A0C24282EB14BB65981A3BDE391AF4D784FC85035E96D4F2D7FF6CB50582F1

Function 00007FF7FD71D318 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7FD71D391
GetFileType.KERNELBASE ref: 00007FF7FD71D3A7

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
Instruction ID: 00270ecd4eba496267221a2af04cc0b4316b248147b61beafd089faa8adecbcb
Opcode Fuzzy Hash: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
Instruction Fuzzy Hash: 1F318431A1CB45C1DB64AB1585501B9A650FB49BB0FA40339DB7E0B3E0DF38E451D7E1

Function 00007FF7FD71D034 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7FD71D020,?,?,?,?,?,00007FF7FD71D129), ref: 00007FF7FD71D080
GetLastError.KERNEL32(?,?,?,?,?,00007FF7FD71D020,?,?,?,?,?,00007FF7FD71D129), ref: 00007FF7FD71D08A

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
Instruction ID: 5ca269bf5c257229a356f60190d75828a16e5b34b53ad1ce3995e9d58436d373
Opcode Fuzzy Hash: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
Instruction Fuzzy Hash: 7011B261B0CA8281DB10AB25A444069E761EB49BF4FD40331EA7D0F7E9EE7CD0558BE4

Function 00007FF7FD71B464 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
Instruction ID: e32c1d82496bdf2b5c545196a2e82ec8e3e6db7e7070fcf3d3c16725148b77a1
Opcode Fuzzy Hash: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
Instruction Fuzzy Hash: C9E0BF51E0D64282FF1A7BB1944507891619F4D751FC49634D92D8F2E2FE2C654546F0

Function 00007FF7FD71BA60 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7FD71B8DD,?,?,00000000,00007FF7FD71B992), ref: 00007FF7FD71BACE
GetLastError.KERNEL32(?,?,?,00007FF7FD71B8DD,?,?,00000000,00007FF7FD71B992), ref: 00007FF7FD71BAD8

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
Instruction ID: 31cae1a55a4bbb8f94690d569d7dc8b6bc166755dd84a53da5eedba9eccf3879
Opcode Fuzzy Hash: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
Instruction Fuzzy Hash: 1A21CF20B0C68241FB607321A48127D92929F8DBB4F845334DA3E4FBC6FE6CA44943F0

Function 00007FF7FD71CDAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71CDD4

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca67b63ad487b7dd06d77dc7b625cd7cf40d94e9b0d9a023c4747a6b48452177
Instruction ID: d462622a77c316c6311ee0fe2ffe1d02452251d470e90a7009381ae524022b15
Opcode Fuzzy Hash: ca67b63ad487b7dd06d77dc7b625cd7cf40d94e9b0d9a023c4747a6b48452177
Instruction Fuzzy Hash: E141D43290C24183EB24AA59A44117DF7A1FB5EB64FA01335D6AE4B6D4EF2CE442C7F1

Function 00007FF7FD7073D0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7FD70747A

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: ccae1b7e8167be86a642595e62811ecfdca16a7d8a38ac59a6bf41a7aa38a37a
Instruction ID: 595fb4949831f31c56e7839db0599b98725ec4961ad19a980ac483ce863404ee
Opcode Fuzzy Hash: ccae1b7e8167be86a642595e62811ecfdca16a7d8a38ac59a6bf41a7aa38a37a
Instruction Fuzzy Hash: C3219121B0C69245EB50AA1268093BAEA51BF49BD8FC84030EE5D0F7C6EF7CE40182F0

Function 00007FF7FD71C83C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71C8C2

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
Instruction ID: 1874e1e62920cb51ab2789a3da0acd322e70abbba00b7217121570305375cd5e
Opcode Fuzzy Hash: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
Instruction Fuzzy Hash: 87316E32E1C65285E716BB55844137CE6A0AB48B74F910339EA3D0B3D2EE7CE44183F0

Function 00007FF7FD71A899 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FD71A8C7

Part of subcall function 00007FF7FD71A9C0: GetModuleHandleExW.KERNEL32 ref: 00007FF7FD71A9E5
Part of subcall function 00007FF7FD71A9C0: GetProcAddress.KERNEL32 ref: 00007FF7FD71A9FB
Part of subcall function 00007FF7FD71A9C0: FreeLibrary.KERNEL32 ref: 00007FF7FD71AA22

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
Instruction ID: f51550ef1ae19fd323ce58dc28774f2799e8cb111d82a3bcba3ce4b4fb5d4d4e
Opcode Fuzzy Hash: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
Instruction Fuzzy Hash: B9219132A087458AEB15AF64C4403AC73B4EB08328F850736D67D0AAC5FF38D585C7E0

Function 00007FF7FD716F54 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD716EB9

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction ID: 1175ed36321ba83ee18a507c0d93e2d084e6b98fa44ddd5b612d070baa94187f
Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction Fuzzy Hash: 25114C22A1C64181EB61BF51D40027EE264BF49BA0FC44235EA5C5BAD6EF3CD45487F0

Function 00007FF7FD7275C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7275E7

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
Instruction ID: f94bad5914bfd4860e1e8f43864d102a393537647fee07b1f05ccc8605d7126d
Opcode Fuzzy Hash: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
Instruction Fuzzy Hash: A321C83260CA8187D7619F19D540379F2A0EB89B95F940234D66D4B6D5FF3CD4018BA0

Function 00007FF7FD70F914 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD70F968

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction ID: 6e263c743d9dfc581ca4e7d8622d679adb19af1857f0b7a3c83b772577bb8519
Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction Fuzzy Hash: 3E018E21A1C78240EB04EB529800069E6A4BF89FE0F884731DE7C5BBDAEF3CD00187E0

Function 00007FF7FD718E38 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD718E76

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1708b530f5072f472fe09baedec27f5756de37f3e343805e4a7815c0544b33da
Instruction ID: 9d7fcc1d96d087ce5f3407c392c2bfbe2411b2475c456c326cef37a838eb2eed
Opcode Fuzzy Hash: 1708b530f5072f472fe09baedec27f5756de37f3e343805e4a7815c0544b33da
Instruction Fuzzy Hash: BF017920E1D64290FB697B256501279E190AF0C7B4F944338EA3C4A7DAEF7CA44992F0

Function 00007FF7FD719174 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71918D

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
Instruction ID: ccbb6b00fe8ba230c31c7be6aa263b7df0bf15e025e02bb12e7f3f70f2ae8407
Opcode Fuzzy Hash: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
Instruction Fuzzy Hash: 75E0EC71E4C20746F71A7AF0458617891605F1CB64FD45274DA384E2C3FE1D688AA6F2

Function 00007FF7FD70C3DC Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FD70C3F0

Part of subcall function 00007FF7FD70CE18: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7FD70CE20
Part of subcall function 00007FF7FD70CE18: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7FD70CE25

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
Instruction ID: 855094d4f2fff5e2e21cec269c9e8530e55516d705620108742697b773732d16
Opcode Fuzzy Hash: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
Instruction Fuzzy Hash: A5E09220D1D24282FF653A61184A2BDC6481F2E348FD01478E97A9A1C7BF0D256B21F2

Function 00007FF7FD71FE04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7FD71C22A,?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392), ref: 00007FF7FD71FE59

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
Instruction ID: ab01ac18b4cc2dbf3e6b8461a6059755d91edfb7384ada064641819985a43040
Opcode Fuzzy Hash: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
Instruction Fuzzy Hash: 2CF0AF52B1D28785FF55766199053B4C290AF4CBA0F880338C92D8E2C2FE2CA54846F0

Function 00007FF7FD71E6C4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7FD710268,?,?,?,00007FF7FD7118D2,?,?,?,?,?,00007FF7FD714595), ref: 00007FF7FD71E702

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
Instruction ID: 1abc99e339aca3182b96eb5a722bb2e9f904b3268cc114b615b44c28488ed686
Opcode Fuzzy Hash: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
Instruction Fuzzy Hash: 9CF0F821E1D24285FB697AB259052B9A1909F4D7B1FD84730D93E8E2C2FE2DA48086F0

Non-executed Functions

Function 00007FF7FD706B00 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FD706B17
GetLastError.KERNEL32 ref: 00007FF7FD706B29
GetProcAddress.KERNEL32 ref: 00007FF7FD706B65
GetLastError.KERNEL32 ref: 00007FF7FD706B77
GetProcAddress.KERNEL32 ref: 00007FF7FD706B90
GetLastError.KERNEL32 ref: 00007FF7FD706BA2
GetProcAddress.KERNEL32 ref: 00007FF7FD706BBB
GetLastError.KERNEL32 ref: 00007FF7FD706BCD
GetProcAddress.KERNEL32 ref: 00007FF7FD706BE9
GetLastError.KERNEL32 ref: 00007FF7FD706BFB
GetProcAddress.KERNEL32 ref: 00007FF7FD706C17
GetLastError.KERNEL32 ref: 00007FF7FD706C29
GetProcAddress.KERNEL32 ref: 00007FF7FD706C45
GetLastError.KERNEL32 ref: 00007FF7FD706C57
GetProcAddress.KERNEL32 ref: 00007FF7FD706C73
GetLastError.KERNEL32 ref: 00007FF7FD706C85
GetProcAddress.KERNEL32 ref: 00007FF7FD706CA1
GetLastError.KERNEL32 ref: 00007FF7FD706CB3

Strings

Tcl_DeleteInterp, xrefs: 00007FF7FD706C3B, 00007FF7FD706C5D
Tcl_ConditionNotify, xrefs: 00007FF7FD706DAB, 00007FF7FD706DCD
Tcl_JoinThread, xrefs: 00007FF7FD706CC5, 00007FF7FD706CE7
Tcl_ConditionFinalize, xrefs: 00007FF7FD706D7D, 00007FF7FD706D9F
Tcl_SetVar2, xrefs: 00007FF7FD706E91, 00007FF7FD706EB3
Tcl_MutexFinalize, xrefs: 00007FF7FD706D4F, 00007FF7FD706D71
Tcl_NewByteArrayObj, xrefs: 00007FF7FD706F49, 00007FF7FD706F6B
Tcl_EvalFile, xrefs: 00007FF7FD706FD3, 00007FF7FD706FF5
Tcl_GetString, xrefs: 00007FF7FD706EED, 00007FF7FD706F0F
Tcl_Finalize, xrefs: 00007FF7FD706BDF, 00007FF7FD706C01
Failed to get address for %hs, xrefs: 00007FF7FD706B38
Tcl_FindExecutable, xrefs: 00007FF7FD706B86, 00007FF7FD706BA8
Tk_GetNumMainWindows, xrefs: 00007FF7FD7070E7, 00007FF7FD707109
Tcl_MutexLock, xrefs: 00007FF7FD706CF3, 00007FF7FD706D15
Tcl_Init, xrefs: 00007FF7FD706B10, 00007FF7FD706B2F
Tcl_GetVar2, xrefs: 00007FF7FD706E63, 00007FF7FD706E85
Tcl_Alloc, xrefs: 00007FF7FD70705D, 00007FF7FD70707F
Tcl_SetVar2Ex, xrefs: 00007FF7FD706F77, 00007FF7FD706F99
Tcl_DoOneEvent, xrefs: 00007FF7FD706BB1, 00007FF7FD706BD3
Tcl_ThreadAlert, xrefs: 00007FF7FD706E35, 00007FF7FD706E57
Tcl_GetObjResult, xrefs: 00007FF7FD706FA5, 00007FF7FD706FC7
Tcl_FinalizeThread, xrefs: 00007FF7FD706C0D, 00007FF7FD706C2F
Tcl_EvalEx, xrefs: 00007FF7FD707001, 00007FF7FD707023
Tcl_CreateObjCommand, xrefs: 00007FF7FD706EBF, 00007FF7FD706EE1
Tcl_MutexUnlock, xrefs: 00007FF7FD706D21, 00007FF7FD706D43
Tcl_CreateThread, xrefs: 00007FF7FD706C69, 00007FF7FD706C8B
Tk_Init, xrefs: 00007FF7FD7070B9, 00007FF7FD7070DB
Tcl_Free, xrefs: 00007FF7FD70708B, 00007FF7FD7070AD
Tcl_ConditionWait, xrefs: 00007FF7FD706DD9, 00007FF7FD706DFB
Tcl_EvalObjv, xrefs: 00007FF7FD70702F, 00007FF7FD707051
Tcl_ThreadQueueEvent, xrefs: 00007FF7FD706E07, 00007FF7FD706E29
Tcl_CreateInterp, xrefs: 00007FF7FD706B5B, 00007FF7FD706B7D
Tcl_GetCurrentThread, xrefs: 00007FF7FD706C97, 00007FF7FD706CB9
GetProcAddress, xrefs: 00007FF7FD706B3F
Tcl_NewStringObj, xrefs: 00007FF7FD706F1B, 00007FF7FD706F3D

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
Instruction ID: 7f266ebe30288b17c36cadf16c9371c57985ed7b96e763a3ba8e9b0ddd78ffd2
Opcode Fuzzy Hash: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
Instruction Fuzzy Hash: 2702A36490DB8791FB25BB25A818579E3A0EF0DB46FD41135D82E0E2E4FF3CA54986F0

Function 00007FF7FD72531C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7FD72536A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7259D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD725B4C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD725E0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72602A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD726267
memcpy_s.LIBCPMT ref: 00007FF7FD726342
memcpy_s.LIBCPMT ref: 00007FF7FD7263ED
memcpy_s.LIBCPMT ref: 00007FF7FD7264BC

Strings

1#QNAN, xrefs: 00007FF7FD725483
1#IND, xrefs: 00007FF7FD725457
1#SNAN, xrefs: 00007FF7FD72547A
1#INF, xrefs: 00007FF7FD725493

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: d700f69ad9a83803b0d0e637264b1b7e22121a30603610bb88393cfb8a3bc4ed
Instruction ID: 989896644813b6a06fd9835bcf9b7f00b825aa3174f53a63f2cccf939a9f6740
Opcode Fuzzy Hash: d700f69ad9a83803b0d0e637264b1b7e22121a30603610bb88393cfb8a3bc4ed
Instruction Fuzzy Hash: 0FB2C472A1C2D28BE7259E24D4407FDB7A1FB58385FD05135DA295BAC4FB38A9008FE0

Function 00007FF7FD70A26D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/lengths set, xrefs: 00007FF7FD70A6F3
invalid distance too far back, xrefs: 00007FF7FD70AC30
invalid literal/length code, xrefs: 00007FF7FD70A9A2
too many length or distance symbols, xrefs: 00007FF7FD70A406
invalid bit length repeat, xrefs: 00007FF7FD70A659
invalid code lengths set, xrefs: 00007FF7FD70A3ED
invalid code -- missing end-of-block, xrefs: 00007FF7FD70A686
invalid distances set, xrefs: 00007FF7FD70A760
invalid distance code, xrefs: 00007FF7FD70AB74

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 4827148dd37d06b9a23a2cb7d22b3f776e5342dd5831b168843cb21776e0705c
Instruction ID: 030d25ed6f6ea1685797da0eef295f795409f3822f667a7d3cfcb36829b3db7a
Opcode Fuzzy Hash: 4827148dd37d06b9a23a2cb7d22b3f776e5342dd5831b168843cb21776e0705c
Instruction Fuzzy Hash: F552E573A186A68BD7549F14C85CB7E7BA9FB48340F414139E65A8B7C0EB7CD844CBA0

Function 00007FF7FD70C6FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FD70C718
RtlCaptureContext.KERNEL32 ref: 00007FF7FD70C745
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FD70C75F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FD70C7A0
IsDebuggerPresent.KERNEL32 ref: 00007FF7FD70C7F4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD70C811
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD70C81C

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
Instruction ID: 113234ed137e241269a6534296a1dd3fd3703fdf065f89fd8c52af5a254b113f
Opcode Fuzzy Hash: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
Instruction Fuzzy Hash: 7A311F72609B8186EB609F60E8447EDA364FB88745F44403ADA5D4BBD4EF38D548CBB4

Function 00007FF7FD726E70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FD726EB5

Part of subcall function 00007FF7FD726808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72681C

Part of subcall function 00007FF7FD71B464: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
Part of subcall function 00007FF7FD71B464: GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

Part of subcall function 00007FF7FD71B844: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FD71B823,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71B84D
Part of subcall function 00007FF7FD71B844: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FD71B823,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71B872

_get_daylight.LIBCMT ref: 00007FF7FD726EA4

Part of subcall function 00007FF7FD726868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72687C

_get_daylight.LIBCMT ref: 00007FF7FD72711A
_get_daylight.LIBCMT ref: 00007FF7FD72712B
_get_daylight.LIBCMT ref: 00007FF7FD72713C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FD72737C), ref: 00007FF7FD727163

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 1cc6d2bc0113d7e20a77d6be4757883c424c8a6b3909b765b0ec1a4afa43a119
Instruction ID: 151e6b468e8f0044dc3e91e789674155c5561b5b5f00bcf8526cb5f6e7c80011
Opcode Fuzzy Hash: 1cc6d2bc0113d7e20a77d6be4757883c424c8a6b3909b765b0ec1a4afa43a119
Instruction Fuzzy Hash: 2ED1A066A0C29286EB20FF25D5501B9B261EF4D795FC04136EA2D4B6D5FE3CE4418BF0

Function 00007FF7FD71B558 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FD71B5D1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FD71B5E9
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FD71B624
IsDebuggerPresent.KERNEL32 ref: 00007FF7FD71B65D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD71B667
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD71B672

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
Instruction ID: 897af98fd1ffa7003629338d6853c8d9c69d3194cbf15181e19992c94e1c67aa
Opcode Fuzzy Hash: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
Instruction Fuzzy Hash: 5D31853260CB8186D720DF24E8402AE73A4FB89754F900136EA9D47B98FF3CC145CBA0

Function 00007FF7FD722AE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD722B30
FindFirstFileExW.KERNEL32 ref: 00007FF7FD722C3A

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ccac9e585c27fa031d1f88e05c20b38684cf4203d2ca8c6846fc05bcbc68a6e8
Instruction ID: 1d391cdef616565b30caaee0f5a4bbceb2dcaae77f2b74c46949499722adfc3f
Opcode Fuzzy Hash: ccac9e585c27fa031d1f88e05c20b38684cf4203d2ca8c6846fc05bcbc68a6e8
Instruction Fuzzy Hash: 05B19522B1D6D241EB64AB2198042B9A251EB4CBE5F845136DE6D0FBD5FE3CE441CBF0

Function 00007FF7FD7270EC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FD72711A

Part of subcall function 00007FF7FD726868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72687C

_get_daylight.LIBCMT ref: 00007FF7FD72712B

Part of subcall function 00007FF7FD726808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72681C

_get_daylight.LIBCMT ref: 00007FF7FD72713C

Part of subcall function 00007FF7FD726838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72684C

Part of subcall function 00007FF7FD71B464: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
Part of subcall function 00007FF7FD71B464: GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FD72737C), ref: 00007FF7FD727163

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: fce0b41cc66c7972387442f4a259984a91ef9247f86000003104344bdc7b7ed6
Instruction ID: d267011627ff845c13a4e910dd11ac9ad3a18bf7eca4683a3fa2de0eb60a092e
Opcode Fuzzy Hash: fce0b41cc66c7972387442f4a259984a91ef9247f86000003104344bdc7b7ed6
Instruction Fuzzy Hash: 5D515022A0C68286E711FF21D9815A9B661FB4D785FC05136EA6D4B6D6FF3CE4408BF0

Function 00007FF7FD70C5E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FD70C60C
GetCurrentThreadId.KERNEL32 ref: 00007FF7FD70C61A
GetCurrentProcessId.KERNEL32 ref: 00007FF7FD70C626
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FD70C636

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
Instruction ID: a8fdec2e11528bb3e9622c5b6d1424abfe28625492edbbc2e058f60056e5960c
Opcode Fuzzy Hash: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
Instruction Fuzzy Hash: E5111F22B5CB0189EB00DF60E8552A873A4FB1D759F841E31DA6D477A4EF78D15483E0

Function 00007FF7FD724E80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7FD724EE6
memcpy_s.LIBCPMT ref: 00007FF7FD724F11

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: daec91e52c3c8fa483570386574765f7e801ce8fe9b555c3255bf715a79214bd
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: BCC10372B1C2C687E7259F1AA04466AF7A1F798785F848134DB5A4B784FA3DE900CFD0

Function 00007FF7FD709A34 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7FD709A85
, xrefs: 00007FF7FD709B1B
header crc mismatch, xrefs: 00007FF7FD709EE1

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: b4bf022b898153f2a381bcd878a50a5d3c06b36ca84da26d2d0edcb3d1e551c0
Instruction ID: 1baaa26ab8cecd22fdc90e535d0d4d2fc4397e1a70f249fb4553c4d3830d08d7
Opcode Fuzzy Hash: b4bf022b898153f2a381bcd878a50a5d3c06b36ca84da26d2d0edcb3d1e551c0
Instruction Fuzzy Hash: E1F19373A1C3D547E795AB14C88CB3ABAA9EF48740F494538DA594B3D0EB38E940C7E0

Function 00007FF7FD72A998 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7FD72ABE7
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7FD702BC5), ref: 00007FF7FD72ABF8

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: e29282b711dd5704c0e64fe7638cddbeeb7149a3015151b68882fd3146651568
Instruction ID: b65bc213649c6229a11c16aaf0cb8bfcfb25f40d614f5caee98583a83f1bb61c
Opcode Fuzzy Hash: e29282b711dd5704c0e64fe7638cddbeeb7149a3015151b68882fd3146651568
Instruction Fuzzy Hash: 85B19073608B898BE715CF29C84636C77E0F748B49F548822DB6D877A4EB39D451CBA0

Function 00007FF7FD714450 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7FD714800
, xrefs: 00007FF7FD7145BE

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 5ebab5a2817f928350dc9776a3da4b540f16bc97e78530f340af468d76ff9f5e
Instruction ID: 42bd05d271fbcd7a357273555fa5a694ac9b9084a5285c7c5a91406313546c85
Opcode Fuzzy Hash: 5ebab5a2817f928350dc9776a3da4b540f16bc97e78530f340af468d76ff9f5e
Instruction Fuzzy Hash: 39E1B672A0C65681EB68AE26805013DB3A0FF4DB6CF944335DA6E0B6D4EF29D851C7F0

Function 00007FF7FD70989B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7FD709A02
incorrect header check, xrefs: 00007FF7FD709A1B

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 8c4c8a6a705a7cf803fa5291bdc529627e531fe0bdcc095ab807ab19af6e2c49
Instruction ID: 8e50332c46f7a101b041761f5ba8a23176c2fa88fb4e9aab5af68a65d9d31288
Opcode Fuzzy Hash: 8c4c8a6a705a7cf803fa5291bdc529627e531fe0bdcc095ab807ab19af6e2c49
Instruction Fuzzy Hash: A0919773A1C3C687E7A59B14C84CB3E7AA9FB48350F554139DA5A4A7C4EB38E540CBE0

Function 00007FF7FD71EFB8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF7FD71F0C5
gfff, xrefs: 00007FF7FD71F142

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: ab39e04084c8b9065030c447a5361eb1aff85978d5a2f70618a83e2e92251626
Instruction ID: acaa43229cb912b4c6f6a975ddff75c54a61fd890ca22b2e78ab562f17da87cc
Opcode Fuzzy Hash: ab39e04084c8b9065030c447a5361eb1aff85978d5a2f70618a83e2e92251626
Instruction Fuzzy Hash: D9516823B1C6C646E7249A35D800769E791E749BA4FC88331CBBC4BAC5EF3DD44187A0

Function 00007FF7FD71EB24 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7FD71EE66

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
Instruction ID: e864a5b1f97575199f2b133ffcc82ebf357b829e037df89b171edd944586303b
Opcode Fuzzy Hash: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
Instruction Fuzzy Hash: F9A17962A0C7C586EB21DF2594007A9BB91EB58B94F408232DE9D4B7C1EE3ED405C7A1

Function 00007FF7FD7196D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7FD7196EF

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 8bb90b96481c3bc34baff152e4670fba6cb89323cf5fbd9ccfba4520d43ca801
Instruction ID: 6be7c39b6aa8fa3c8db89b1da8762be7ea63a0b1bedfad8bd5b8faf453a90a21
Opcode Fuzzy Hash: 8bb90b96481c3bc34baff152e4670fba6cb89323cf5fbd9ccfba4520d43ca801
Instruction Fuzzy Hash: 77517E15B0C65241EB68BA26551117AD291AF4DBA8F884234DE3E4F7D6FF3CE40686F0

Function 00007FF7FD7246F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7FD7246F4

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b79ea0c05b8e708bf2e7ff1fe6aa0946c24d08db99ce40c7e012d78a6a9acfe9
Instruction ID: b81c129c6c937b4421e8f3276433e47a3a09a6f280031c1682215de41a80a9fd
Opcode Fuzzy Hash: b79ea0c05b8e708bf2e7ff1fe6aa0946c24d08db99ce40c7e012d78a6a9acfe9
Instruction Fuzzy Hash: 9EB09220E1FA42C6EB8A3B516D8621862A4BF4C741FE44139C01C86370FE3C20A65BF0

Function 00007FF7FD713F8C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25825d834791a15779abc5a96815a53d20fd0a8b1de7024d724f2c7a0ffd609
Instruction ID: 915c36574bd08dae12411b58cbc9ceee6a1d2b0909cf24280720253ddec44b18
Opcode Fuzzy Hash: a25825d834791a15779abc5a96815a53d20fd0a8b1de7024d724f2c7a0ffd609
Instruction Fuzzy Hash: 5BE1802690C64785E768AA27C14413DA7A1FB49B6CF944335CE2D0F6D8EE39E951C3F0

Function 00007FF7FD713750 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f5019cce735186dcbe47a7940729bb5e8d7af8c1d6157f075a5e7b95ae45a8
Instruction ID: 9359790f9fb71f0bf9d4bfdfe4454cae633f9758c85496633d3eb5bd8455929a
Opcode Fuzzy Hash: 92f5019cce735186dcbe47a7940729bb5e8d7af8c1d6157f075a5e7b95ae45a8
Instruction Fuzzy Hash: E4E1B272A0C61285E764BA28C155378A7A1EB4DB78F944335CA6D0F2D9EF39E845C3F0

Function 00007FF7FD713B88 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86da56c12cd563bcad921fbd71c05d3fa176844b52d15b5090a52c27ad8a5c54
Instruction ID: bca234c9480065dc098a4e572c7ec6f3c7cdfb09b9d5e02347e204f738f4b4fe
Opcode Fuzzy Hash: 86da56c12cd563bcad921fbd71c05d3fa176844b52d15b5090a52c27ad8a5c54
Instruction Fuzzy Hash: 82D1B722A0C64685EB68BE25814027DA7A0BB49B68F944335CE6D4F6D5EF39E845C3F0

Function 00007FF7FD708DC0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0142d1de63ac36c46e431d0d75baaff102e1c1a7ac2c303afc5037c5988706
Instruction ID: 38fe0f53d7089b6899eded014bd8f235143fd0e1e693559f3a4e257101ec44aa
Opcode Fuzzy Hash: 8e0142d1de63ac36c46e431d0d75baaff102e1c1a7ac2c303afc5037c5988706
Instruction Fuzzy Hash: D3C186722141E14BD289EB29E86957A73E1F798789FC4803ADF8B47BC5C63CE014D761

Function 00007FF7FD712420 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5780ef2d000dcd486574e33efb2770a379a55a34775bc5a7b80e7b31bbd7158
Instruction ID: 62804717d71d04e1cd7e050a7ebff4483d765e384fd3d7bb5bd4cd06c61d001f
Opcode Fuzzy Hash: b5780ef2d000dcd486574e33efb2770a379a55a34775bc5a7b80e7b31bbd7158
Instruction Fuzzy Hash: 18B18072A0C64586E765AF29C09223DBBA0EB49B68F944335CB5D4B3D5EF29D840C7F0

Function 00007FF7FD7127B8 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ef1490d9aa7cb50fdbcb208ea1e35327a83dacbd264ffe23c56c6782292f60
Instruction ID: c24da9af5b726d408f41a089f545419dfed70d8d0ceafc937ab88fe10a00fed0
Opcode Fuzzy Hash: 56ef1490d9aa7cb50fdbcb208ea1e35327a83dacbd264ffe23c56c6782292f60
Instruction Fuzzy Hash: E8B16D72A0C68686E7649F29805223CBBA4E74DB68FA40235CF5D4B3D5EF29D845C7F0

Function 00007FF7FD71F638 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a05c6059b1d422c1c0961fd67960772ff2ba502e6a05041136868912dff4d23
Instruction ID: 663821e447a359ca99dec8de43313f8c397b0ac918d24a818e0508d4f00d6bbd
Opcode Fuzzy Hash: 2a05c6059b1d422c1c0961fd67960772ff2ba502e6a05041136868912dff4d23
Instruction Fuzzy Hash: 5681E373A0C7C146E764EB19A440369E690FB4D7A4F904339DAAD4BBD9EF3DD4008BA0

Function 00007FF7FD727688 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3d8bfe423dff4df6de2cefd44ce27ce383885c2d2dce1211dff8719a47f1b1c4
Instruction ID: cdae7a6e2ea96c08219749ee71240b4f6653a03bec5d437147614ddaf057b51b
Opcode Fuzzy Hash: 3d8bfe423dff4df6de2cefd44ce27ce383885c2d2dce1211dff8719a47f1b1c4
Instruction Fuzzy Hash: 0661D732E0C2D246F724A9288651239F681EF4A762F944239D63D4A7C1FE7DE800CBF1

Function 00007FF7FD710F1C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 42a525cacd00553cdb00dd9009b3fe2f37b9723c12ec254d5b3bff90eae4aa60
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 44518737A1C65285E7249B29C051228B364EB4CB78FA44231DE5D1F7D4EB3AE843D7E0

Function 00007FF7FD71173C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 2d3699ffeab07cc4145f56bd9adc6b142f4957dabfde7b5c4272d7386f4f0c5a
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 33516537A1C65586E7249B29C050238A3A1EB58B78F648331CE5D1F7D4EB3AE943C7E0

Function 00007FF7FD71132C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 7e0bdb4cbcabfe2284d862a092e04c0cfc611103735696e97571531350e18e9d
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 43516433A1CA5181E7249B29D04422877A0EB49F78F644231CE5D5FBD8EB3AE843C7E0

Function 00007FF7FD710D18 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction ID: b7ca855b4fcf6668efc6667dd51f10ba3c23b62b502ec0d45e03e43fb8739daf
Opcode Fuzzy Hash: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
Instruction Fuzzy Hash: 3951A636A1C65186E7249B29C04032977A0EB4DF68F644235DE9C1B7D4EB3AF842D7E0

Function 00007FF7FD711538 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction ID: 508ee474a6f9650da87a725890f55698d686c0b9ee7c0aed319a3b35540a1ba7
Opcode Fuzzy Hash: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
Instruction Fuzzy Hash: 9F517237A1C65186E7249B29C041238A7A1EB4DB68F684231CE5D5F7D4EF3AE842C7F0

Function 00007FF7FD711128 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction ID: 547a1d53b142b1b3be2d5b63022f9f27d09f00fdb4d1b7abf496132b6f591476
Opcode Fuzzy Hash: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
Instruction Fuzzy Hash: C9518337B1CA5186E7249B29D040628B7B0EB49F68F644231CE5D5F7D4EB3AE842D7E0

Function 00007FF7FD716CF0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: f039bda839f388d6c42fd6ae8ed7e2df3d73e91277c25e0a0a2126b7dbf806cb
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: C141B392C0D69A04EF95991845046BEA694BF1AFB0FD813B4CCF91B3C7ED0D659A82F0

Function 00007FF7FD71AE20 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7a7ebbd17873febb15e29de35626f23177de76f7dba359f1eda69606ccc1bea3
Instruction ID: 1281eda98b8273365be4de3f5c67584c8e6bb79d21ea9abdd9e7ed07e4122a3a
Opcode Fuzzy Hash: 7a7ebbd17873febb15e29de35626f23177de76f7dba359f1eda69606ccc1bea3
Instruction Fuzzy Hash: 1641E562718A5582EF04DF2AD914169B3A1F74CFD0F899137EE1D9BB95EE3CD0428390

Function 00007FF7FD719020 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea68013d769de6ed4293d7105a1dd55258b75c90095a7c81807ae7c67f935af
Instruction ID: 8f00ff9ce9511dba1e7e768233d9d9f6b1c391370bb9ba4aa51b05f6c1c60eba
Opcode Fuzzy Hash: 4ea68013d769de6ed4293d7105a1dd55258b75c90095a7c81807ae7c67f935af
Instruction Fuzzy Hash: 9131AB32B1CB8241E714AF25644013DA595BB8DBA4F944338EE7D577D5EF3CD10247A4

Function 00007FF7FD72A7E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47026fad3db46e1691e12129f37de500b9ca6af24d2cbfa86880e77cbf706e66
Instruction ID: f147af4afcbefb255055e135975daa222b679060d66bf7d1c8da023e07c95fb0
Opcode Fuzzy Hash: 47026fad3db46e1691e12129f37de500b9ca6af24d2cbfa86880e77cbf706e66
Instruction Fuzzy Hash: DDF0C87172C2958EDB96DF28A41262977E0F70C3C4FD08439D59C87B44E67C80508FA4

Function 00007FF7FD70C8A0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0095cffb8fe81db1077c877ec2d194bac0958fa6bcac770c2119ba444bc36b37
Instruction ID: 5dbe0f5fc1edcb2d9693643025153f5bba325b3344a16c38db9998dd4a0f4992
Opcode Fuzzy Hash: 0095cffb8fe81db1077c877ec2d194bac0958fa6bcac770c2119ba444bc36b37
Instruction Fuzzy Hash: 3BA0016190C892D0F744AB00A955025A2B0FB68302F900032D02D4A0E0BF2CA40086F4

Function 00007FF7FD704C40 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704C50
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704C62
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704C99
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CAB
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CC4
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CD6
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CEF
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D01
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D1D
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D2F
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D4B
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D5D
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D79
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D8B
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DA7
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DB9
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DD5
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DE7

Strings

Py_InitializeFromConfig, xrefs: 00007FF7FD704D13, 00007FF7FD704D35
PySys_SetObject, xrefs: 00007FF7FD7052A5, 00007FF7FD7052C7
PyEval_EvalCode, xrefs: 00007FF7FD704FC5, 00007FF7FD704FE7
PyErr_NormalizeException, xrefs: 00007FF7FD704F0D, 00007FF7FD704F2F
PyConfig_Read, xrefs: 00007FF7FD704DF9, 00007FF7FD704E1B
PyConfig_SetString, xrefs: 00007FF7FD704E55, 00007FF7FD704E77
PyUnicode_Decode, xrefs: 00007FF7FD705301, 00007FF7FD705323
Failed to get address for %hs, xrefs: 00007FF7FD704C71
PyUnicode_FromFormat, xrefs: 00007FF7FD70535D, 00007FF7FD70537F
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7FD7051ED, 00007FF7FD70520F
PyErr_Fetch, xrefs: 00007FF7FD704EDF, 00007FF7FD704F01
PyErr_Print, xrefs: 00007FF7FD704F69, 00007FF7FD704F8B
PyObject_SetAttrString, xrefs: 00007FF7FD705191, 00007FF7FD7051B3
PyRun_SimpleStringFlags, xrefs: 00007FF7FD70521B, 00007FF7FD70523D
PyMarshal_ReadObjectFromString, xrefs: 00007FF7FD70507D, 00007FF7FD70509F
PyUnicode_Replace, xrefs: 00007FF7FD7053E7, 00007FF7FD705409
PyObject_CallFunctionObjArgs, xrefs: 00007FF7FD705135, 00007FF7FD705157
PyConfig_SetWideStringList, xrefs: 00007FF7FD704E83, 00007FF7FD704EA5
PyConfig_SetBytesString, xrefs: 00007FF7FD704E27, 00007FF7FD704E49
Py_Finalize, xrefs: 00007FF7FD704CE5, 00007FF7FD704D07
PyUnicode_Join, xrefs: 00007FF7FD7053B9, 00007FF7FD7053DB
Py_DecodeLocale, xrefs: 00007FF7FD704C8F, 00007FF7FD704CB1
PyUnicode_AsUTF8, xrefs: 00007FF7FD7052D3, 00007FF7FD7052F5
PyConfig_InitIsolatedConfig, xrefs: 00007FF7FD704DCB, 00007FF7FD704DED
PyImport_AddModule, xrefs: 00007FF7FD704FF3, 00007FF7FD705015
PyImport_ExecCodeModule, xrefs: 00007FF7FD705021, 00007FF7FD705043
PyErr_Occurred, xrefs: 00007FF7FD704F3B, 00007FF7FD704F5D
Py_ExitStatusException, xrefs: 00007FF7FD704CBA, 00007FF7FD704CDC
PyErr_Clear, xrefs: 00007FF7FD704EB1, 00007FF7FD704ED3
PyStatus_Exception, xrefs: 00007FF7FD705249, 00007FF7FD70526B
PyConfig_Clear, xrefs: 00007FF7FD704D9D, 00007FF7FD704DBF
PyErr_Restore, xrefs: 00007FF7FD704F97, 00007FF7FD704FB9
Py_IsInitialized, xrefs: 00007FF7FD704D41, 00007FF7FD704D63
Py_DecRef, xrefs: 00007FF7FD704C46, 00007FF7FD704C68
PyUnicode_DecodeFSDefault, xrefs: 00007FF7FD70532F, 00007FF7FD705351
PyObject_GetAttrString, xrefs: 00007FF7FD705163, 00007FF7FD705185
PySys_GetObject, xrefs: 00007FF7FD705277, 00007FF7FD705299
PyImport_ImportModule, xrefs: 00007FF7FD70504F, 00007FF7FD705071
PyMem_RawFree, xrefs: 00007FF7FD7050AB, 00007FF7FD7050CD
Py_PreInitialize, xrefs: 00007FF7FD704D6F, 00007FF7FD704D91
PyObject_CallFunction, xrefs: 00007FF7FD705107, 00007FF7FD705129
PyModule_GetDict, xrefs: 00007FF7FD7050D9, 00007FF7FD7050FB
PyUnicode_FromString, xrefs: 00007FF7FD70538B, 00007FF7FD7053AD
PyObject_Str, xrefs: 00007FF7FD7051BF, 00007FF7FD7051E1
GetProcAddress, xrefs: 00007FF7FD704C78

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
Instruction ID: 28a1e314e712ede0e68939b810a41d86cb5f6213bbca18fae4efc7ea0043d564
Opcode Fuzzy Hash: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
Instruction Fuzzy Hash: F122916090DB8791FB15BB61B848575A3A0EF4C746FD4143AD42E0E2E4FF3DA5498AF0

Function 00007FF7FD707610 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7FD707CF7,FFFFFFFF,00000000,?,00007FF7FD703101), ref: 00007FF7FD70766C

Strings

%.*s, xrefs: 00007FF7FD70774C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7FD707719
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7FD7077B3
CreateDirectory, xrefs: 00007FF7FD7077BC
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7FD7076DD
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7FD707680
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7FD707643
\, xrefs: 00007FF7FD7076A1

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 2001182103-930877121
Opcode ID: c12f537dd095d990c73456ab9bcad2fdb505f4a02d1bedcb9a56ce5ba8a3e8b7
Instruction ID: 4df10b6a029dad2a82eb32dee194bf57fa7079a27a832405124219d1e9df8a4f
Opcode Fuzzy Hash: c12f537dd095d990c73456ab9bcad2fdb505f4a02d1bedcb9a56ce5ba8a3e8b7
Instruction Fuzzy Hash: 47515411A2D68251FB50BB25DC596BAF261EF8C780FC41431DA2E4E6D5FF6CE50486F0

Function 00007FF7FD707500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7FD70753F
GetWindowLongPtrW.USER32 ref: 00007FF7FD7075BF
ShutdownBlockReasonCreate.USER32 ref: 00007FF7FD7075D2
GetLastError.KERNEL32 ref: 00007FF7FD7075DC
SetWindowLongPtrW.USER32 ref: 00007FF7FD7075F3

Strings

Needs to remove its temporary files., xrefs: 00007FF7FD7075C5

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
Instruction ID: 83bf51aeb1dfdcc260396b753f30cc3ed872983b30a3849875821b2e6d8a99e4
Opcode Fuzzy Hash: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
Instruction Fuzzy Hash: EC219461B0CA8281E755AB7AE8491B9A350EF8CB91F984130DA3D4B3D5FF2CD58186F0

Function 00007FF7FD717250 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD717293
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD717680
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71791C

Strings

:, xrefs: 00007FF7FD71744C
p, xrefs: 00007FF7FD7173BD
-, xrefs: 00007FF7FD717329
p, xrefs: 00007FF7FD717345
f, xrefs: 00007FF7FD7173B5

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction ID: f23239b3411519cffa4509816755ab36cc54160950d6be5b3d2ddcc0766ab673
Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction Fuzzy Hash: 86127261E0C153C6FB24BA149044679F661FB48761FD44336E6AA4EAC6EB3CE584CBF0

Function 00007FF7FD7105A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7105E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7109A8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD710C47

Strings

p, xrefs: 00007FF7FD7106EA
p, xrefs: 00007FF7FD710685
f, xrefs: 00007FF7FD71082D
f, xrefs: 00007FF7FD710678
f, xrefs: 00007FF7FD7106E2

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction ID: f6468c7b0b21293b0b683593fffd5599a02256ef431df77997ebe6f2329752f4
Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction Fuzzy Hash: 97127061A0C14386FB207E1590647BAF651FB48764FC84236D6EA4A6C4EE3CF480ABF0

Function 00007FF7FD701030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FD701078
fread, xrefs: 00007FF7FD7011DD
fseek, xrefs: 00007FF7FD7010B3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FD7010AC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FD7011D6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FD7010E8
malloc, xrefs: 00007FF7FD7010EF

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: f2c9d26524041bef20f921cc6e3fdb5c5879003b506dd9f92652499c6f6409df
Instruction ID: 931058005638c5516f8421513dd04b8f0c8a94ee4bbf268d131dde5ec47be665
Opcode Fuzzy Hash: f2c9d26524041bef20f921cc6e3fdb5c5879003b506dd9f92652499c6f6409df
Instruction Fuzzy Hash: F5411A22A0C69246EB04FB11D8096A9A2A1BB48BD4FD44532ED6C8F7D5EF3CE50587F0

Function 00007FF7FD701450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FD70147F
fread, xrefs: 00007FF7FD7015C6
fseek, xrefs: 00007FF7FD7014C5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FD7014BE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FD7015BF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FD7014F8
malloc, xrefs: 00007FF7FD7014FF

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 81307100bf7e543c33610dbc99917dcd7d9181fd79fca9210e70da8259a9990b
Instruction ID: fc0db9cbff0ebee5199825b99c32ed35cfc8582a55a740c53fca3264b67018d0
Opcode Fuzzy Hash: 81307100bf7e543c33610dbc99917dcd7d9181fd79fca9210e70da8259a9990b
Instruction Fuzzy Hash: 0A413B22A0C69286EB01EB2198455B9A3A1FB4C794FC44532ED6D4FAD5FF3CE50587F0

Function 00007FF7FD70DF98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7FD70DFF5

Part of subcall function 00007FF7FD70EF4C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7FD70EF8F
Part of subcall function 00007FF7FD70EF4C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7FD70EFB4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7FD70E0CD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7FD70E31B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FD70E428

Strings

csm, xrefs: 00007FF7FD70E076
csm, xrefs: 00007FF7FD70E00F
csm, xrefs: 00007FF7FD70E0F0

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
Instruction ID: 11025f51feea3aa97def8ac7f692933489ddcdab083d0035b8e1b3a12738a277
Opcode Fuzzy Hash: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
Instruction Fuzzy Hash: A8D1A43290C74186EB20AB25D8443ADB7A0FB49788F904135EE6D5BBD5EF39E081C7E0

Function 00007FF7FD702310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD702360
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD70241A

Strings

<FormatMessageW failed.>, xrefs: 00007FF7FD702427
%ls: , xrefs: 00007FF7FD7023D9
%ls, xrefs: 00007FF7FD702448
[PYI-%d:ERROR] , xrefs: 00007FF7FD702368

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentFormatMessageProcess
String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
API String ID: 27993502-4247535189
Opcode ID: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
Instruction ID: 901e3893b60f4ea8bda44ef90a3f9cd5b1fcc12df0d1430d20a3c413d0bf3cd9
Opcode Fuzzy Hash: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
Instruction Fuzzy Hash: 88319223B0C68141E720A725AC146AAA265FF88B95F800135EF5D9BAD9FF3CD546C7E0

Function 00007FF7FD70D258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D2DD
GetLastError.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D2EB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D315
FreeLibrary.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D383
GetProcAddress.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D38F

Strings

api-ms-, xrefs: 00007FF7FD70D2FD

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
Instruction ID: 61b603c0ec47f33942c5f3e5b41cd17155b0f3c007f9595abfc191618f32bbc5
Opcode Fuzzy Hash: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
Instruction Fuzzy Hash: 44319F21A0EB4181EF11AB02AC082B5A298FB4CBA0F894535DD2D4F7D4FF7CE44586F4

Function 00007FF7FD7057A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7FD705807
ucrtbase.dll, xrefs: 00007FF7FD70581D
LoadLibrary, xrefs: 00007FF7FD7058EE
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7FD705847
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7FD705896
Failed to load Python DLL '%ls'., xrefs: 00007FF7FD7058E7

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 57f2e03855a98cc957638366e02885260eb86ee0512a8128b0f554b17f515a16
Instruction ID: d6c7600dbf152ed7073cd35ef33d8455504d46ae353ed3756458e60980fcc467
Opcode Fuzzy Hash: 57f2e03855a98cc957638366e02885260eb86ee0512a8128b0f554b17f515a16
Instruction Fuzzy Hash: D7413F21A1CA8691EB11FB10E8581E9A325FB48344FC00536EA6D4B6D5FF3CE605C7F0

Function 00007FF7FD71C050 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FD71C05F
FlsGetValue.KERNEL32 ref: 00007FF7FD71C074
FlsSetValue.KERNEL32 ref: 00007FF7FD71C095
FlsSetValue.KERNEL32 ref: 00007FF7FD71C0C2
FlsSetValue.KERNEL32 ref: 00007FF7FD71C0D3
FlsSetValue.KERNEL32 ref: 00007FF7FD71C0E4
SetLastError.KERNEL32 ref: 00007FF7FD71C0FF

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: e7139c608495b6cc1a84a8bfc675465f329191e7723f0f4090e60134c6f5fe20
Instruction ID: 1f2262d8574c668218dc419f7a88186d1d0d291c9adf4ff1ec0ce512ee82e3de
Opcode Fuzzy Hash: e7139c608495b6cc1a84a8bfc675465f329191e7723f0f4090e60134c6f5fe20
Instruction Fuzzy Hash: 3E216D20A0C28342FB6573A15A4513DD2A28F4CBB1FE44734D83D1EADAFE2CB84196F0

Function 00007FF7FD728FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7FD72900D
GetLastError.KERNEL32 ref: 00007FF7FD729019
CloseHandle.KERNEL32 ref: 00007FF7FD729031
CreateFileW.KERNEL32 ref: 00007FF7FD72905C
WriteConsoleW.KERNEL32 ref: 00007FF7FD72907B

Strings

CONOUT$, xrefs: 00007FF7FD72903D

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
Instruction ID: 784e7812ef32c67b126900247ed3e0d5dc9c53784f290c959fe91f2bca3e466a
Opcode Fuzzy Hash: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
Instruction Fuzzy Hash: D011662171CA8186E750AB52E845325E2A0FB8CBE5F944235D96D8B7D4FF7CD4048BF4

Function 00007FF7FD7079B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(FFFFFFFF,?,?,00000000,00007FF7FD708706), ref: 00007FF7FD7079E2
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707A39

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707AC8
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707B34
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707B45
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707B5A

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b9b63f54144ba03940088346b196338d5c2960aef7cb953cd42f14819606a153
Instruction ID: 69c9437358bbc28c3f8c2e099fe7e0b7f484eb874f7f3a6a50ee3277ff9005c9
Opcode Fuzzy Hash: b9b63f54144ba03940088346b196338d5c2960aef7cb953cd42f14819606a153
Instruction Fuzzy Hash: 94419061A0D68241EB20AB15A8446AAB294FB4CB84F850135DF6D5B7C5EF3CD901C7F0

Function 00007FF7FD71C1C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C1D7
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C20D
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C23A
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C24B
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C25C
SetLastError.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C277

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: e5d0e0b2483b94c830670df23095a0090442b6ded93498b747c7c2b5f10a7ded
Instruction ID: dc08ec67b2fe1190f779230a3e949a21292ec1d930c6a7a0c2279a840eb4d40d
Opcode Fuzzy Hash: e5d0e0b2483b94c830670df23095a0090442b6ded93498b747c7c2b5f10a7ded
Instruction Fuzzy Hash: 7A113B21A0C28283FB5477A1564513DE1929F4DBB1FA84735D83E1EAE6FE2CB80196F0

Function 00007FF7FD71A9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FD71A9E5
GetProcAddress.KERNEL32 ref: 00007FF7FD71A9FB
FreeLibrary.KERNEL32 ref: 00007FF7FD71AA22

Strings

CorExitProcess, xrefs: 00007FF7FD71A9F4
mscoree.dll, xrefs: 00007FF7FD71A9DC

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
Instruction ID: 2e343f518bb2c2cacdf38a5db0c255ba264dfa471910f7a7292d74c1f9cf84bb
Opcode Fuzzy Hash: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
Instruction Fuzzy Hash: 56F04F61A1D64681EB14AB24A4453799360EF4D766FD40636CA7E8A2E4FF2CD049C7F0

Function 00007FF7FD72A5D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FD72A600
_set_statfp.LIBCMT ref: 00007FF7FD72A61B
_set_statfp.LIBCMT ref: 00007FF7FD72A637
_set_statfp.LIBCMT ref: 00007FF7FD72A673

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 11fe5f08a8730e3ad6872d84c95a3f8c178c7c466d1e8dccd09e18c2aaa0d639
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 92119132E5CA8301F7643124E492376A150EF5C776F840638EA7E0E6DAFF2CA84549F0

Function 00007FF7FD71C290 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C2AF
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C2CE
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C2F6
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C307
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C318

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4c0fa632bc3d25f8cfe32bfb71e005cd32ee7c68f5f62eb397e319b19a1c4257
Instruction ID: ec76db401d2b0598ad2548b8fff8ce0031df2120c09a1a4a22288bb015a88822
Opcode Fuzzy Hash: 4c0fa632bc3d25f8cfe32bfb71e005cd32ee7c68f5f62eb397e319b19a1c4257
Instruction Fuzzy Hash: 9B119D61E0C24242FB5873A5954117DE1929F4D7B0FD85334E83D1EAD6FE2CB80286F1

Function 00007FF7FD71C124 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7FD71C135
FlsSetValue.KERNEL32 ref: 00007FF7FD71C154
FlsSetValue.KERNEL32 ref: 00007FF7FD71C17C
FlsSetValue.KERNEL32 ref: 00007FF7FD71C18D
FlsSetValue.KERNEL32 ref: 00007FF7FD71C19E

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ab190e4c0c65978bdf5c45b911499c804a34fb74ba3fc2279b8fd75855a785a8
Instruction ID: 062a01f8bf02326b07360338d835002d8f8a25e0365fef17e04ac1e43abca949
Opcode Fuzzy Hash: ab190e4c0c65978bdf5c45b911499c804a34fb74ba3fc2279b8fd75855a785a8
Instruction Fuzzy Hash: 62114891A4C24342FBA872A1481217DD1924F4E731FE84738D83E1E2D2FD2CB801A6F0

Function 00007FF7FD7085B0 Relevance: 7.5, APIs: 5, Instructions: 36sleepthreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF7FD70851C
GetCurrentProcessId.KERNEL32 ref: 00007FF7FD70852F
GetWindowThreadProcessId.USER32 ref: 00007FF7FD70853F
ShowWindow.USER32 ref: 00007FF7FD708556
Sleep.KERNEL32 ref: 00007FF7FD708565

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowSleepThread
String ID:
API String ID: 3908687701-0
Opcode ID: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
Instruction ID: 263d0b5092bea26605da3f7bf6d8514b7e7172dc4cf933a48c3995851ba61098
Opcode Fuzzy Hash: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
Instruction Fuzzy Hash: 9F014F20E1CB8282EB54BB21B889139E260EF4CB81F945134D96F4B6D8FF3CD94186F0

Function 00007FF7FD716F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD716F9C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7170C6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71717C

Strings

verbose, xrefs: 00007FF7FD716F70

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction ID: 6eecc9bd3dc4a8cec9167708cc1ececf1f24fec098a653d0eaa507135c9e7a0c
Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction Fuzzy Hash: 0B91BF32A0C746C1E721AE24D85077DB2A5AB48B64FD44336DA6D4B3D6EE3CE44683F1

Function 00007FF7FD720E38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD721117

Part of subcall function 00007FF7FD718978: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD718995

Strings

UTF-16LEUNICODE, xrefs: 00007FF7FD7210B5
UTF-8, xrefs: 00007FF7FD721096
ccs, xrefs: 00007FF7FD721052

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
Instruction ID: 1b2f5469fbf9167354d944e6c61dca903404e662225698fb6305abf17287c9d7
Opcode Fuzzy Hash: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
Instruction Fuzzy Hash: C781AD32E0C2C285F7746E258194278A7A0FB19B46FD54034DE299F2D5FB3DB841AAF1

Function 00007FF7FD70CBD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FD70CC03
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7FD70CC9A
RtlUnwindEx.KERNEL32 ref: 00007FF7FD70CCF4

Strings

csm, xrefs: 00007FF7FD70CC81

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
Instruction ID: a4418b60c804ab29cba366d4062c8f6be8fc779f63b374e0ea2f64afaafd0d3e
Opcode Fuzzy Hash: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
Instruction Fuzzy Hash: 4C51A132A1D6028ADB14AB16D84867DA791EF48B84F908131DA6D4B7C8FF7CE84187E0

Function 00007FF7FD70E818 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FD70E840
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7FD70E928

Strings

csm, xrefs: 00007FF7FD70E862
csm, xrefs: 00007FF7FD70E97A

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
Instruction ID: 626020ef3f1a5ea1dfa5f30e7d00cafe253801fb06dca39886e33b30531a2607
Opcode Fuzzy Hash: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
Instruction Fuzzy Hash: 1251A07291C34286EB64AA15D848379B790FB88B84F985135DAAC4BBC1DF3DE450C7E1

Function 00007FF7FD70E468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7FD70E4C7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7FD70E513

Strings

RCC, xrefs: 00007FF7FD70E4E3
MOC, xrefs: 00007FF7FD70E4DB

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
Instruction ID: d9894dce2eec81f348ae4ee0ec3c7c86b491016bf5a7a58b50d22e204a58008d
Opcode Fuzzy Hash: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
Instruction Fuzzy Hash: 8461933290C7C581D7609B15E8443AAF7A0FB89794F444625EBAC07BD5EF7CE090CBA0

Function 00007FF7FD707260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7FD7028EC,FFFFFFFF,00000000,00007FF7FD70336A), ref: 00007FF7FD707372

Strings

%s%c, xrefs: 00007FF7FD7072E4
%.*s, xrefs: 00007FF7FD70732B
\, xrefs: 00007FF7FD7072D7

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 8483aebf73e132e5a1e11bd86e0dae461c6ec9d36d7fd58fe1f5dbf943300de9
Instruction ID: e6135dda728a0069b51be73b81e53c0a7ecb8952c2dd9167d352b75127d6e8d1
Opcode Fuzzy Hash: 8483aebf73e132e5a1e11bd86e0dae461c6ec9d36d7fd58fe1f5dbf943300de9
Instruction Fuzzy Hash: 7631992161D9C545F721A711A8147AAE358EB8CBA0F940631EEBD4B7C5FF2CD24587F0

Function 00007FF7FD702220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF7FD70866F), ref: 00007FF7FD70226E

Strings

[PYI-%d:%ls] , xrefs: 00007FF7FD702276
%ls, xrefs: 00007FF7FD7022E5
WARNING, xrefs: 00007FF7FD70227D

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: %ls$WARNING$[PYI-%d:%ls]
API String ID: 2050909247-3372507544
Opcode ID: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
Instruction ID: bf70645ed1d24a434ec17ac43b8a5808eca8c3b6fe79659a703b53399c6c8169
Opcode Fuzzy Hash: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
Instruction Fuzzy Hash: 6821B62261D78141E710AB90F8556EAB365FB887C0F800135EE9D5B6DAEF3CD115C7E0

Function 00007FF7FD71D4A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7FD71D51F
WriteFile.KERNEL32 ref: 00007FF7FD71D7E7
WriteFile.KERNEL32 ref: 00007FF7FD71D82D
GetLastError.KERNEL32 ref: 00007FF7FD71D8E3

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
Instruction ID: 81e34b51c192aef3205bd27d7eda9cfeeddf97bd1fc60ab394ceaa54b233f30b
Opcode Fuzzy Hash: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
Instruction Fuzzy Hash: 6FD1F972B0C64189E710DF75D4402AC7771F7497A8B944235CE6D6BBD9EE38D406CBA0

Function 00007FF7FD720BFC Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FD720CEC
_get_daylight.LIBCMT ref: 00007FF7FD720CFD
_get_daylight.LIBCMT ref: 00007FF7FD720D0E
_isindst.LIBCMT ref: 00007FF7FD720DD9

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
Instruction ID: d6af8c722f15c1bdd77c791e4b793f8b843f5a530a1bc167ed8381b25c8da64d
Opcode Fuzzy Hash: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
Instruction Fuzzy Hash: 22510972F091918AEB18EF3499552BCA761EB0835AF900135ED2D5AAD5FB38B441CBF0

Function 00007FF7FD716738 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7FD71676B
GetFileInformationByHandle.KERNEL32 ref: 00007FF7FD7167CD
GetLastError.KERNEL32 ref: 00007FF7FD71685E
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD716670), ref: 00007FF7FD7168AA

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
Instruction ID: 26c5658c5b8e1093aaa60afe7329535bbb01c27147147779242c3aed8f5413c1
Opcode Fuzzy Hash: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
Instruction Fuzzy Hash: D5517E22E0C6518AF714EF71D4403BEA3B1AB48B68F908634DE195B689EF38D54187F0

Function 00007FF7FD726D8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD7229D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD722A03

_get_daylight.LIBCMT ref: 00007FF7FD726EA4
_get_daylight.LIBCMT ref: 00007FF7FD726EB5

Strings

?, xrefs: 00007FF7FD726E35

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 44877219fa58a3c80076740d489941753dcdf7d4d18713102933f3384318ca38
Instruction ID: c5fc97f0c8b104025bb5f6a373925b5f602352ba797f73b140bc04d86cf94a19
Opcode Fuzzy Hash: 44877219fa58a3c80076740d489941753dcdf7d4d18713102933f3384318ca38
Instruction Fuzzy Hash: DD41FA12E0C2C146FB25B725D44137ED651EB987B5F94423AEE6C0AAD5FE3CD4418BE0

Function 00007FF7FD719F50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD719F82

Part of subcall function 00007FF7FD71B464: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
Part of subcall function 00007FF7FD71B464: GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FD70C165), ref: 00007FF7FD719FA0

Strings

C:\Users\user\Desktop\799Ox3XqxO.exe, xrefs: 00007FF7FD719F8E

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\799Ox3XqxO.exe
API String ID: 3580290477-3898320094
Opcode ID: 2a2f06ea51d58fd39cad35a47b9855af257a0ebd26d3c321afc8fcfaab6f6b1a
Instruction ID: d47f352b14b7c2570b1b04981355274854f52eacbf00d9d96ed37d8ebe451e8d
Opcode Fuzzy Hash: 2a2f06ea51d58fd39cad35a47b9855af257a0ebd26d3c321afc8fcfaab6f6b1a
Instruction Fuzzy Hash: 76418E36A0CB1285EB15FF21A4400B8A2A5FB497A4FC44136E96D4BBD5FF39E44282F0

Function 00007FF7FD71DB38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7FD71DC4F
GetLastError.KERNEL32 ref: 00007FF7FD71DC71

Strings

U, xrefs: 00007FF7FD71DBFB

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
Instruction ID: db5524688b31f951c0450553a22a820bb663fd3003cd8719759a2051db8ea9cd
Opcode Fuzzy Hash: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
Instruction Fuzzy Hash: FB41D62271C68185D720AF25E4443B9A761F788794F804531EE5E8B798EF7CD541CBE0

Function 00007FF7FD702020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FD701B4A), ref: 00007FF7FD702070

Strings

%s: %s, xrefs: 00007FF7FD7020EF
[PYI-%d:ERROR] , xrefs: 00007FF7FD702078

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$[PYI-%d:ERROR]
API String ID: 2050909247-3704582800
Opcode ID: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
Instruction ID: a37fc773940d8a35aeec994099a8d4c99b1679801d6041550aa112e0e5b98871
Opcode Fuzzy Hash: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
Instruction Fuzzy Hash: 3B21D223B1C68145E720A761AC056E6A255BF8CBD4FC04132FE9D9B7CAEF3CD146C2A0

Function 00007FF7FD720828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FD720868
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FD7208BA

Strings

:, xrefs: 00007FF7FD72087E

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 63a6ade40322badb627163fbf2393635adbd874265b659678e6569f8a285a25d
Instruction ID: e143cca435b75a45f551fe0b28b4d4857af0a1a26ce04a152529058e4676bf09
Opcode Fuzzy Hash: 63a6ade40322badb627163fbf2393635adbd874265b659678e6569f8a285a25d
Instruction Fuzzy Hash: F8219C22A0C2D181EB20AB21D44826EA3A1FB8CB45FC54135DA6D4B6C5FF7CE9458BF0

Function 00007FF7FD701E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7FD701B79), ref: 00007FF7FD701E9E

Strings

ERROR, xrefs: 00007FF7FD701EAD
[PYI-%d:%s] , xrefs: 00007FF7FD701EA6

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$[PYI-%d:%s]
API String ID: 2050909247-3005936843
Opcode ID: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
Instruction ID: 58ce827c1fda71f11ee0f914a93c8cde63fc8e7fb3f7d911f5a49df69eb8050a
Opcode Fuzzy Hash: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
Instruction Fuzzy Hash: CB11843261D78141E720AB51B8455EAB364EB887C4F800135FE9D477D9EF7CD15586A0

Function 00007FF7FD702140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7FD7028DA,FFFFFFFF,00000000,00007FF7FD70336A), ref: 00007FF7FD70218E

Strings

WARNING, xrefs: 00007FF7FD70219D
[PYI-%d:%s] , xrefs: 00007FF7FD702196

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: WARNING$[PYI-%d:%s]
API String ID: 2050909247-3752221249
Opcode ID: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
Instruction ID: f9746601a4a8d761ceb87c7671e7a5dd141715180220bfb691c9ef0ef97e1e9b
Opcode Fuzzy Hash: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
Instruction Fuzzy Hash: 4711843261D78141E720AB51B8455EAB354EB887C4F800135FE9D477D9EF7CD15587A0

Function 00007FF7FD70F2D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7FD70F328
RaiseException.KERNEL32 ref: 00007FF7FD70F369

Strings

csm, xrefs: 00007FF7FD70F356

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
Instruction ID: 1406273dc3b8572dfe3f7c38aed0a5d1878900b4732064037b125ef326123ecd
Opcode Fuzzy Hash: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
Instruction Fuzzy Hash: A7115E3260CB8082EB209B15F844269F7E4FB88B94F584230EE9D0B794EF3CD5518BA0

Function 00007FF7FD7219AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7219DC
GetDriveTypeW.KERNEL32 ref: 00007FF7FD721A1C

Strings

:, xrefs: 00007FF7FD721A05

Memory Dump Source

Source File: 00000000.00000002.2264364772.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000000.00000002.2264334229.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264410846.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264509623.00007FF7FD744000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2264668167.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
Instruction ID: a6610d72e25e4463ab83d5676c7babcc3483b4e9846cc3a1b268b075bf4ab9a3
Opcode Fuzzy Hash: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
Instruction Fuzzy Hash: 4B01712291C28286E721BF60946227EA3A0FF4C705FC05536D96D8A6D5FF2CE544CAF4

Analysis Process: 799Ox3XqxO.exePID: 6468, Parent PID: 6664COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF7FD727BD4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD727908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD727949
Part of subcall function 00007FF7FD727908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7279C7
Part of subcall function 00007FF7FD727908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD727A18

CreateFileW.KERNELBASE ref: 00007FF7FD727CDA
CreateFileW.KERNEL32 ref: 00007FF7FD727D2A
GetLastError.KERNEL32 ref: 00007FF7FD727D5A
GetFileType.KERNELBASE ref: 00007FF7FD727D6F
GetLastError.KERNEL32 ref: 00007FF7FD727D79
CloseHandle.KERNEL32 ref: 00007FF7FD727DAC
CloseHandle.KERNEL32 ref: 00007FF7FD727F0F
CreateFileW.KERNEL32 ref: 00007FF7FD727F44
GetLastError.KERNEL32 ref: 00007FF7FD727F53

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
Instruction ID: 499752a41a6a50ceef8625cbd51d5fabddf0125e94f55a1d7201da7d6b6abc8a
Opcode Fuzzy Hash: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
Instruction Fuzzy Hash: 4FC1C032B2CA8185EB10EF64D5802BC7761E74DBA8B811229DA2E5B7D4EF38D455C7E0

Function 00007FF7FD708840 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7FD708873
FindClose.KERNELBASE ref: 00007FF7FD708882

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
Instruction ID: 7deff5693d7dc9c63736dd1d1517b42b836c8fdb6df488e8b0ba2046baedc36f
Opcode Fuzzy Hash: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
Instruction Fuzzy Hash: 45F0CD22A1C64186F760AB50B85D366F351FB88324F800335D57E0A6D4EF3CD0098BE0

Function 00007FF7FD701000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 527COMMON

Download Yara Rule

Strings

pyi-python-flag, xrefs: 00007FF7FD702EA0
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7FD703250
MEI, xrefs: 00007FF7FD702CF3
minimize-late, xrefs: 00007FF7FD702FE8
_PYI_SPLASH_IPC, xrefs: 00007FF7FD702DE4, 00007FF7FD70333C
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7FD702D9E
Failed to load splash screen resources!, xrefs: 00007FF7FD7032CC
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7FD703043
Failed to convert DLL search path!, xrefs: 00007FF7FD703222
minimize-early, xrefs: 00007FF7FD702FAE
hide-late, xrefs: 00007FF7FD702FCB
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7FD702EFC
_PYI_ARCHIVE_FILE, xrefs: 00007FF7FD702C92, 00007FF7FD702DC0
pyi-contents-directory, xrefs: 00007FF7FD702F58
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7FD703158
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7FD703302
Failed to start splash screen!, xrefs: 00007FF7FD70331B
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7FD702D31
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7FD702C43, 00007FF7FD702C6F
Py_GIL_DISABLED, xrefs: 00007FF7FD702EBE
pkg, xrefs: 00007FF7FD702D7E
Could not create temporary directory!, xrefs: 00007FF7FD703105
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7FD70317B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7FD7032ED
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7FD702DCC, 00007FF7FD70311A, 00007FF7FD7033A0
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7FD702DD8, 00007FF7FD702DF0, 00007FF7FD702E5C
hide-early, xrefs: 00007FF7FD702F91
Failed to remove temporary directory: %s, xrefs: 00007FF7FD7033F8
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7FD7030A5
pyi-hide-console, xrefs: 00007FF7FD702F7D
pyi-runtime-tmpdir, xrefs: 00007FF7FD702F33
VCRUNTIME140.dll, xrefs: 00007FF7FD7031F7

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-3325264605
Opcode ID: 8c01cde04d708fa74f8b1b3f14dfcf17190f57a78b7d7f64537a0b9715b8da6c
Instruction ID: 9f70bcfd7c3f41548fe9506e947afc0cfbfe334988926b605270116e333a4dc8
Opcode Fuzzy Hash: 8c01cde04d708fa74f8b1b3f14dfcf17190f57a78b7d7f64537a0b9715b8da6c
Instruction Fuzzy Hash: E2423F21A0C68291FB25B72098592FAE651AF5D784FC44036DA7E4E2D6FF2CE549C3F0

Function 00007FF7FD701930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD7073D0: _fread_nolock.LIBCMT ref: 00007FF7FD70747A

_fread_nolock.LIBCMT ref: 00007FF7FD7019FB

Part of subcall function 00007FF7FD702020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FD701B4A), ref: 00007FF7FD702070

Strings

MEI, xrefs: 00007FF7FD701971
Could not allocate memory for archive structure!, xrefs: 00007FF7FD701A41
fseek, xrefs: 00007FF7FD7019D5
Failed to read cookie!, xrefs: 00007FF7FD701A0B
calloc, xrefs: 00007FF7FD701A48
fread, xrefs: 00007FF7FD701A12, 00007FF7FD701B3C
Failed to seek to cookie position!, xrefs: 00007FF7FD7019CE
malloc, xrefs: 00007FF7FD701B02
Error on file., xrefs: 00007FF7FD701B6D
Could not allocate buffer for TOC!, xrefs: 00007FF7FD701AFB
Could not read full TOC!, xrefs: 00007FF7FD701B35

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 531dcde783486bd9d936179a055b76b2e001926834c0dd1f6eb6704f2b1bf224
Instruction ID: e0a5c45d094e3411d8b8287047ec9bc05fbeebd07b8c41a03e24920d1e651064
Opcode Fuzzy Hash: 531dcde783486bd9d936179a055b76b2e001926834c0dd1f6eb6704f2b1bf224
Instruction Fuzzy Hash: DC816F32A0C68285E710EB24D4592B9A3A1EB4C744FC04136E9AD8B7D5FF3CE5458BF0

Function 00007FF7FD701450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FD7014F8
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FD7015BF
fseek, xrefs: 00007FF7FD7014C5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FD70147F
fread, xrefs: 00007FF7FD7015C6
malloc, xrefs: 00007FF7FD7014FF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FD7014BE

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3b8d481942262510a1f68063d80a5416ba41a1189ff83d4fb074291329d9d0dc
Instruction ID: fc0db9cbff0ebee5199825b99c32ed35cfc8582a55a740c53fca3264b67018d0
Opcode Fuzzy Hash: 3b8d481942262510a1f68063d80a5416ba41a1189ff83d4fb074291329d9d0dc
Instruction Fuzzy Hash: 0A413B22A0C69286EB01EB2198455B9A3A1FB4C794FC44532ED6D4FAD5FF3CE50587F0

Function 00007FF7FD7011F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7FD70129A
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7FD7013FE
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7FD701256
malloc, xrefs: 00007FF7FD7012A1, 00007FF7FD7012D6
1.3.1, xrefs: 00007FF7FD701229
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7FD7012CF

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 0d99a5b3e486c3566c128d074988a137d00be30e99573bd0a73511d0b0d660e1
Instruction ID: ed15ccd2a3e0f8b807b541f1ff7372d72d2d9a67b611032ec8929554f9ebe59a
Opcode Fuzzy Hash: 0d99a5b3e486c3566c128d074988a137d00be30e99573bd0a73511d0b0d660e1
Instruction Fuzzy Hash: 5B51A022A0C68245EB20BB11A8543BAE291FB48794F944135ED6D8B7D5FF3CE405C7F0

Function 00007FF7FD71FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7FD720316,?,?,-00000018,00007FF7FD71BC5B,?,?,?,00007FF7FD71BB52,?,?,?,00007FF7FD716EFE), ref: 00007FF7FD7200F8
GetProcAddress.KERNEL32(?,?,?,00007FF7FD720316,?,?,-00000018,00007FF7FD71BC5B,?,?,?,00007FF7FD71BB52,?,?,?,00007FF7FD716EFE), ref: 00007FF7FD720104

Strings

api-ms-, xrefs: 00007FF7FD720042
ext-ms-, xrefs: 00007FF7FD720055

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
Instruction ID: f90abe54904e0062abc9ea4ae4ff047cc815a776d6e68d39e045a2277b9c90e2
Opcode Fuzzy Hash: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
Instruction Fuzzy Hash: 7C41DC22B1DA8241FB22AB16A804675A291FB0DBA1FC44135CD2D8F3D8FE7DE44596F0

Function 00007FF7FD702A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7FD702BC5), ref: 00007FF7FD702AA1
GetLastError.KERNEL32(?,00007FF7FD702BC5), ref: 00007FF7FD702AAB

Part of subcall function 00007FF7FD702310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD702360
Part of subcall function 00007FF7FD702310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD70241A

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF7FD702AF9
Failed to obtain executable path., xrefs: 00007FF7FD702AB3
Failed to convert executable path to UTF-8., xrefs: 00007FF7FD702B50
\\?\, xrefs: 00007FF7FD702B1A
GetModuleFileNameW, xrefs: 00007FF7FD702ABA

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 4002088556-2863816727
Opcode ID: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
Instruction ID: dbaa86a840a33224792de4bcb75f9b9886a32a2c83d1e5d58ed8969de2b7b465
Opcode Fuzzy Hash: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
Instruction Fuzzy Hash: 9C213562B1C58281FB60BB24EC593B69250AF4C355FC00136E56E8E5D5FF2CE50487F4

Function 00007FF7FD71C95C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71CD89

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 90e38381b044602f979f053f91eac3826e7a60585fbaa009b45ea18fb2fea8f5
Instruction ID: 88a693ca1fb38e44803c2bcebb9e8540d98ab898e63780fd9ab99abcbdb8d007
Opcode Fuzzy Hash: 90e38381b044602f979f053f91eac3826e7a60585fbaa009b45ea18fb2fea8f5
Instruction Fuzzy Hash: BCC1093290C78281E721AB5590052BDEB60FB89BA0FE54335DA6D0B7D1EE7CE85587F0

Function 00007FF7FD7057A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF7FD7058E7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7FD705807
ucrtbase.dll, xrefs: 00007FF7FD70581D
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7FD705896
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7FD705847
LoadLibrary, xrefs: 00007FF7FD7058EE

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 7a55adeaadc319c70d2ba838d1fcf91999e9c466860aec4aa2ab7dbe0270684a
Instruction ID: d6c7600dbf152ed7073cd35ef33d8455504d46ae353ed3756458e60980fcc467
Opcode Fuzzy Hash: 7a55adeaadc319c70d2ba838d1fcf91999e9c466860aec4aa2ab7dbe0270684a
Instruction Fuzzy Hash: D7413F21A1CA8691EB11FB10E8581E9A325FB48344FC00536EA6D4B6D5FF3CE605C7F0

Function 00007FF7FD7165E4 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD716611
CreateFileW.KERNELBASE ref: 00007FF7FD716650
CloseHandle.KERNEL32 ref: 00007FF7FD716685

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
Instruction ID: b7e448ddda7af2e75b30735a1bad40ba6b49c2a64017569bbe7a0426dff67f22
Opcode Fuzzy Hash: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
Instruction Fuzzy Hash: E9419562D1C78283E754AB20951037EA260FB99774F509334E66C0BAD5FF6CA5E087F0

Function 00007FF7FD71A968 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7FD71A964), ref: 00007FF7FD71A979
TerminateProcess.KERNEL32(?,?,?,00007FF7FD71A964), ref: 00007FF7FD71A984
ExitProcess.KERNEL32 ref: 00007FF7FD71A993

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
Instruction ID: 32e70b4a6a652c37e0a88e2c7585c07c4bde0663bdef17c01ab2d2f1dd6e864e
Opcode Fuzzy Hash: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
Instruction Fuzzy Hash: ABD06710B1C68642EB543B70585627992519F8C722F821539C86A0B7D7FD2DA48A4AF0

Function 00007FF7FD70F694 Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD70F6D8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD70F7CF

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction ID: 36e1b701b3d4cc9521b446dfd8a4fea18f4a0564c9283707ea00f7ea6182fe7b
Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
Instruction Fuzzy Hash: 8851E621A0D2D146E728BA2598046B9E290BF48BA4F944735DE7D0B7D9EF3CE40186F1

Function 00007FF7FD70C1FC Relevance: 3.1, APIs: 2, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FD70C3DC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FD70C3F0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FD70C225
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FD70C293

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
Instruction ID: 1c1133063985f774e05a631c8056a45a3c1c577e0c3e007176c8fc8cdee1cf94
Opcode Fuzzy Hash: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
Instruction Fuzzy Hash: 19316A21A0C24282EB14BB65981A3BDE391AF4D784FC85035E96D4F2D7FF6CB50582F1

Function 00007FF7FD71D318 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7FD71D391
GetFileType.KERNELBASE ref: 00007FF7FD71D3A7

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
Instruction ID: 00270ecd4eba496267221a2af04cc0b4316b248147b61beafd089faa8adecbcb
Opcode Fuzzy Hash: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
Instruction Fuzzy Hash: 1F318431A1CB45C1DB64AB1585501B9A650FB49BB0FA40339DB7E0B3E0DF38E451D7E1

Function 00007FF7FD71D034 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7FD71D020,?,?,?,?,?,00007FF7FD71D129), ref: 00007FF7FD71D080
GetLastError.KERNEL32(?,?,?,?,?,00007FF7FD71D020,?,?,?,?,?,00007FF7FD71D129), ref: 00007FF7FD71D08A

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
Instruction ID: 5ca269bf5c257229a356f60190d75828a16e5b34b53ad1ce3995e9d58436d373
Opcode Fuzzy Hash: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
Instruction Fuzzy Hash: 7011B261B0CA8281DB10AB25A444069E761EB49BF4FD40331EA7D0F7E9EE7CD0558BE4

Function 00007FF7FD71B464 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
Instruction ID: e32c1d82496bdf2b5c545196a2e82ec8e3e6db7e7070fcf3d3c16725148b77a1
Opcode Fuzzy Hash: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
Instruction Fuzzy Hash: C9E0BF51E0D64282FF1A7BB1944507891619F4D751FC49634D92D8F2E2FE2C654546F0

Function 00007FF7FD71BA60 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7FD71B8DD,?,?,00000000,00007FF7FD71B992), ref: 00007FF7FD71BACE
GetLastError.KERNEL32(?,?,?,00007FF7FD71B8DD,?,?,00000000,00007FF7FD71B992), ref: 00007FF7FD71BAD8

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
Instruction ID: 31cae1a55a4bbb8f94690d569d7dc8b6bc166755dd84a53da5eedba9eccf3879
Opcode Fuzzy Hash: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
Instruction Fuzzy Hash: 1A21CF20B0C68241FB607321A48127D92929F8DBB4F845334DA3E4FBC6FE6CA44943F0

Function 00007FF7FD71CDAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71CDD4

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca67b63ad487b7dd06d77dc7b625cd7cf40d94e9b0d9a023c4747a6b48452177
Instruction ID: d462622a77c316c6311ee0fe2ffe1d02452251d470e90a7009381ae524022b15
Opcode Fuzzy Hash: ca67b63ad487b7dd06d77dc7b625cd7cf40d94e9b0d9a023c4747a6b48452177
Instruction Fuzzy Hash: E141D43290C24183EB24AA59A44117DF7A1FB5EB64FA01335D6AE4B6D4EF2CE442C7F1

Function 00007FF7FD7073D0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7FD70747A

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 3836321a0a16135062b8c0ccd45892703e8665109b071da587cfb5a1db906ef9
Instruction ID: 595fb4949831f31c56e7839db0599b98725ec4961ad19a980ac483ce863404ee
Opcode Fuzzy Hash: 3836321a0a16135062b8c0ccd45892703e8665109b071da587cfb5a1db906ef9
Instruction Fuzzy Hash: C3219121B0C69245EB50AA1268093BAEA51BF49BD8FC84030EE5D0F7C6EF7CE40182F0

Function 00007FF7FD71C83C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71C8C2

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
Instruction ID: 1874e1e62920cb51ab2789a3da0acd322e70abbba00b7217121570305375cd5e
Opcode Fuzzy Hash: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
Instruction Fuzzy Hash: 87316E32E1C65285E716BB55844137CE6A0AB48B74F910339EA3D0B3D2EE7CE44183F0

Function 00007FF7FD71A899 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FD71A8C7

Part of subcall function 00007FF7FD71A9C0: GetModuleHandleExW.KERNEL32 ref: 00007FF7FD71A9E5
Part of subcall function 00007FF7FD71A9C0: GetProcAddress.KERNEL32 ref: 00007FF7FD71A9FB
Part of subcall function 00007FF7FD71A9C0: FreeLibrary.KERNEL32 ref: 00007FF7FD71AA22

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
Instruction ID: f51550ef1ae19fd323ce58dc28774f2799e8cb111d82a3bcba3ce4b4fb5d4d4e
Opcode Fuzzy Hash: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
Instruction Fuzzy Hash: B9219132A087458AEB15AF64C4403AC73B4EB08328F850736D67D0AAC5FF38D585C7E0

Function 00007FF7FD716F54 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD716EB9

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction ID: 1175ed36321ba83ee18a507c0d93e2d084e6b98fa44ddd5b612d070baa94187f
Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
Instruction Fuzzy Hash: 25114C22A1C64181EB61BF51D40027EE264BF49BA0FC44235EA5C5BAD6EF3CD45487F0

Function 00007FF7FD7275C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7275E7

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
Instruction ID: f94bad5914bfd4860e1e8f43864d102a393537647fee07b1f05ccc8605d7126d
Opcode Fuzzy Hash: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
Instruction Fuzzy Hash: A321C83260CA8187D7619F19D540379F2A0EB89B95F940234D66D4B6D5FF3CD4018BA0

Function 00007FF7FD70F914 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD70F968

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction ID: 6e263c743d9dfc581ca4e7d8622d679adb19af1857f0b7a3c83b772577bb8519
Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
Instruction Fuzzy Hash: 3E018E21A1C78240EB04EB529800069E6A4BF89FE0F884731DE7C5BBDAEF3CD00187E0

Function 00007FF7FD7084C0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

LoadLibraryExW.KERNELBASE(?,00007FF7FD7058B6,00000000,00007FF7FD70272E), ref: 00007FF7FD7084E2

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 23c3e83c88c6dd3b1e5c72de45a30bd43877c4c0a868aa4986197d83ba81d9e2
Instruction ID: 83bf44c80bb6bc8dfb53da134096339763476e6c44c92442176d6e79fe640487
Opcode Fuzzy Hash: 23c3e83c88c6dd3b1e5c72de45a30bd43877c4c0a868aa4986197d83ba81d9e2
Instruction Fuzzy Hash: D2D08611F2854141EB54B767794552595519B8DBC0F888034DE1C4BB95EC3CD0450B90

Function 00007FF7FD70C3DC Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FD70C3F0

Part of subcall function 00007FF7FD70CE18: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF7FD70CE20
Part of subcall function 00007FF7FD70CE18: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF7FD70CE25

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
Instruction ID: 855094d4f2fff5e2e21cec269c9e8530e55516d705620108742697b773732d16
Opcode Fuzzy Hash: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
Instruction Fuzzy Hash: A5E09220D1D24282FF653A61184A2BDC6481F2E348FD01478E97A9A1C7BF0D256B21F2

Function 00007FF7FD7084A0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,?,00007FF7FD702A4F), ref: 00007FF7FD7084A4

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 619dae96cde275b0d6223e4d0e56230bff5b4496291d67a9e86111295c3b59ba
Instruction ID: 71f6f312377fba2a950ed2ac99c4e54a6e20dbe7d139ffd4a5df8d9de385696b
Opcode Fuzzy Hash: 619dae96cde275b0d6223e4d0e56230bff5b4496291d67a9e86111295c3b59ba
Instruction Fuzzy Hash: 14B01220FED48B819A0437798C4F43412509768703FD00220C006C52D0EC0C00DA4AB0

Function 00007FF7FD71E6C4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7FD710268,?,?,?,00007FF7FD7118D2,?,?,?,?,?,00007FF7FD714595), ref: 00007FF7FD71E702

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
Instruction ID: 1abc99e339aca3182b96eb5a722bb2e9f904b3268cc114b615b44c28488ed686
Opcode Fuzzy Hash: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
Instruction Fuzzy Hash: 9CF0F821E1D24285FB697AB259052B9A1909F4D7B1FD84730D93E8E2C2FE2DA48086F0

Non-executed Functions

Function 00007FF7FD708020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

SetConsoleCtrlHandler.KERNEL32(FFFFFFFF,00000000,?,00007FF7FD7033B4), ref: 00007FF7FD70807B
GetStartupInfoW.KERNEL32 ref: 00007FF7FD708096

Part of subcall function 00007FF7FD71B384: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71B398

Part of subcall function 00007FF7FD719658: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7196BF

GetCommandLineW.KERNEL32 ref: 00007FF7FD708126
CreateProcessW.KERNEL32 ref: 00007FF7FD70815E
GetLastError.KERNEL32 ref: 00007FF7FD708168

Part of subcall function 00007FF7FD702310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD702360
Part of subcall function 00007FF7FD702310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD70241A

RegisterClassW.USER32 ref: 00007FF7FD7081C0
GetLastError.KERNEL32 ref: 00007FF7FD7081CB
CreateWindowExW.USER32 ref: 00007FF7FD708215
GetLastError.KERNEL32 ref: 00007FF7FD708227
WaitForSingleObject.KERNEL32 ref: 00007FF7FD708242
GetLastError.KERNEL32 ref: 00007FF7FD708255
PeekMessageW.USER32 ref: 00007FF7FD708279
TranslateMessage.USER32 ref: 00007FF7FD708287
DispatchMessageW.USER32 ref: 00007FF7FD708291
PeekMessageW.USER32 ref: 00007FF7FD7082AC
WaitForSingleObject.KERNEL32 ref: 00007FF7FD7082BE
WaitForSingleObject.KERNEL32 ref: 00007FF7FD7082D9
TerminateProcess.KERNEL32 ref: 00007FF7FD7082EF
GetLastError.KERNEL32 ref: 00007FF7FD7082F9
WaitForSingleObject.KERNEL32 ref: 00007FF7FD708307
DestroyWindow.USER32 ref: 00007FF7FD708444
GetExitCodeProcess.KERNEL32 ref: 00007FF7FD708459
CloseHandle.KERNEL32 ref: 00007FF7FD708462
CloseHandle.KERNEL32 ref: 00007FF7FD70846F

Strings

CreateProcessW, xrefs: 00007FF7FD708177
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7FD708194
Failed to create child process!, xrefs: 00007FF7FD708170
PyInstaller Onefile Hidden Window, xrefs: 00007FF7FD7081D5

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 4208240515-3165540532
Opcode ID: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
Instruction ID: 2d9d528642599ff2b6a066c96a2bb83a9b823fc030445e316efef986448dbe22
Opcode Fuzzy Hash: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
Instruction Fuzzy Hash: 2BD15431A0CA8286EB10AF74E8552A9B760FB48759F900235DA6D4BAD5FF3CD145CBF0

Function 00007FF7FD707800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,00007FF7FD707F59,00007FF7FD7033DA), ref: 00007FF7FD70786B
RemoveDirectoryW.KERNEL32 ref: 00007FF7FD7078EE
DeleteFileW.KERNEL32 ref: 00007FF7FD70790D
FindNextFileW.KERNEL32 ref: 00007FF7FD70791B
FindClose.KERNEL32 ref: 00007FF7FD70792C
RemoveDirectoryW.KERNEL32 ref: 00007FF7FD707935

Strings

%s\*, xrefs: 00007FF7FD707832

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
Instruction ID: 470e8bde98ca2c917ec2a044185a2294cf6382406cdbbb71d78f5c796f33dc54
Opcode Fuzzy Hash: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
Instruction Fuzzy Hash: FA415121A1C59285EB30BB20A8486B9B361FB98755FD00632D96D4B6D4FF2CD64AC7F0

Function 00007FF7FD70C6FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FD70C718
RtlCaptureContext.KERNEL32 ref: 00007FF7FD70C745
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FD70C75F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FD70C7A0
IsDebuggerPresent.KERNEL32 ref: 00007FF7FD70C7F4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD70C811
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD70C81C

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
Instruction ID: 113234ed137e241269a6534296a1dd3fd3703fdf065f89fd8c52af5a254b113f
Opcode Fuzzy Hash: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
Instruction Fuzzy Hash: 7A311F72609B8186EB609F60E8447EDA364FB88745F44403ADA5D4BBD4EF38D548CBB4

Function 00007FF7FD726E70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FD726EB5

Part of subcall function 00007FF7FD726808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72681C

Part of subcall function 00007FF7FD71B464: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
Part of subcall function 00007FF7FD71B464: GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

Part of subcall function 00007FF7FD71B844: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FD71B823,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71B84D
Part of subcall function 00007FF7FD71B844: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FD71B823,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71B872

_get_daylight.LIBCMT ref: 00007FF7FD726EA4

Part of subcall function 00007FF7FD726868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72687C

_get_daylight.LIBCMT ref: 00007FF7FD72711A
_get_daylight.LIBCMT ref: 00007FF7FD72712B
_get_daylight.LIBCMT ref: 00007FF7FD72713C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FD72737C), ref: 00007FF7FD727163

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0173cbac813c15378d40c9e56499cd14d87a7a7d5cd8bcf6202161c05a5fa724
Instruction ID: 151e6b468e8f0044dc3e91e789674155c5561b5b5f00bcf8526cb5f6e7c80011
Opcode Fuzzy Hash: 0173cbac813c15378d40c9e56499cd14d87a7a7d5cd8bcf6202161c05a5fa724
Instruction Fuzzy Hash: 2ED1A066A0C29286EB20FF25D5501B9B261EF4D795FC04136EA2D4B6D5FE3CE4418BF0

Function 00007FF7FD71B558 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FD71B5D1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FD71B5E9
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FD71B624
IsDebuggerPresent.KERNEL32 ref: 00007FF7FD71B65D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD71B667
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FD71B672

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
Instruction ID: 897af98fd1ffa7003629338d6853c8d9c69d3194cbf15181e19992c94e1c67aa
Opcode Fuzzy Hash: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
Instruction Fuzzy Hash: 5D31853260CB8186D720DF24E8402AE73A4FB89754F900136EA9D47B98FF3CC145CBA0

Function 00007FF7FD722AE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD722B30
FindFirstFileExW.KERNEL32 ref: 00007FF7FD722C3A

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: b6a193d294c3b32593d30be4cab4f407475a0a4c133e91729be199528772a0a4
Instruction ID: 1d391cdef616565b30caaee0f5a4bbceb2dcaae77f2b74c46949499722adfc3f
Opcode Fuzzy Hash: b6a193d294c3b32593d30be4cab4f407475a0a4c133e91729be199528772a0a4
Instruction Fuzzy Hash: 05B19522B1D6D241EB64AB2198042B9A251EB4CBE5F845136DE6D0FBD5FE3CE441CBF0

Function 00007FF7FD7270EC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FD72711A

Part of subcall function 00007FF7FD726868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72687C

_get_daylight.LIBCMT ref: 00007FF7FD72712B

Part of subcall function 00007FF7FD726808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72681C

_get_daylight.LIBCMT ref: 00007FF7FD72713C

Part of subcall function 00007FF7FD726838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD72684C

Part of subcall function 00007FF7FD71B464: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
Part of subcall function 00007FF7FD71B464: GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FD72737C), ref: 00007FF7FD727163

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: f3046009ef5eb4ee2f9f04adf13bbb5e89ae69c332d55b3385a3975d24ee77c8
Instruction ID: d267011627ff845c13a4e910dd11ac9ad3a18bf7eca4683a3fa2de0eb60a092e
Opcode Fuzzy Hash: f3046009ef5eb4ee2f9f04adf13bbb5e89ae69c332d55b3385a3975d24ee77c8
Instruction Fuzzy Hash: 5D515022A0C68286E711FF21D9815A9B661FB4D785FC05136EA6D4B6D6FF3CE4408BF0

Function 00007FF7FD704C40 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704C50
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704C62
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704C99
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CAB
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CC4
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CD6
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704CEF
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D01
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D1D
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D2F
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D4B
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D5D
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D79
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704D8B
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DA7
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DB9
GetProcAddress.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DD5
GetLastError.KERNEL32(?,00007FF7FD70590F,00000000,00007FF7FD70272E), ref: 00007FF7FD704DE7

Strings

PyMarshal_ReadObjectFromString, xrefs: 00007FF7FD70507D, 00007FF7FD70509F
PyObject_CallFunctionObjArgs, xrefs: 00007FF7FD705135, 00007FF7FD705157
PyErr_Fetch, xrefs: 00007FF7FD704EDF, 00007FF7FD704F01
Py_DecRef, xrefs: 00007FF7FD704C46, 00007FF7FD704C68
PyConfig_SetBytesString, xrefs: 00007FF7FD704E27, 00007FF7FD704E49
PyConfig_Read, xrefs: 00007FF7FD704DF9, 00007FF7FD704E1B
PyObject_GetAttrString, xrefs: 00007FF7FD705163, 00007FF7FD705185
Py_IsInitialized, xrefs: 00007FF7FD704D41, 00007FF7FD704D63
PyUnicode_Decode, xrefs: 00007FF7FD705301, 00007FF7FD705323
PyErr_Restore, xrefs: 00007FF7FD704F97, 00007FF7FD704FB9
PyImport_ImportModule, xrefs: 00007FF7FD70504F, 00007FF7FD705071
Failed to get address for %hs, xrefs: 00007FF7FD704C71
Py_Finalize, xrefs: 00007FF7FD704CE5, 00007FF7FD704D07
PyUnicode_Replace, xrefs: 00007FF7FD7053E7, 00007FF7FD705409
PyStatus_Exception, xrefs: 00007FF7FD705249, 00007FF7FD70526B
Py_PreInitialize, xrefs: 00007FF7FD704D6F, 00007FF7FD704D91
PyErr_Occurred, xrefs: 00007FF7FD704F3B, 00007FF7FD704F5D
PyConfig_Clear, xrefs: 00007FF7FD704D9D, 00007FF7FD704DBF
GetProcAddress, xrefs: 00007FF7FD704C78
PyConfig_InitIsolatedConfig, xrefs: 00007FF7FD704DCB, 00007FF7FD704DED
PyErr_Print, xrefs: 00007FF7FD704F69, 00007FF7FD704F8B
PyMem_RawFree, xrefs: 00007FF7FD7050AB, 00007FF7FD7050CD
PyEval_EvalCode, xrefs: 00007FF7FD704FC5, 00007FF7FD704FE7
PyConfig_SetString, xrefs: 00007FF7FD704E55, 00007FF7FD704E77
PySys_GetObject, xrefs: 00007FF7FD705277, 00007FF7FD705299
PyUnicode_FromString, xrefs: 00007FF7FD70538B, 00007FF7FD7053AD
PyObject_CallFunction, xrefs: 00007FF7FD705107, 00007FF7FD705129
PyImport_ExecCodeModule, xrefs: 00007FF7FD705021, 00007FF7FD705043
PyRun_SimpleStringFlags, xrefs: 00007FF7FD70521B, 00007FF7FD70523D
PySys_SetObject, xrefs: 00007FF7FD7052A5, 00007FF7FD7052C7
PyErr_NormalizeException, xrefs: 00007FF7FD704F0D, 00007FF7FD704F2F
PyUnicode_FromFormat, xrefs: 00007FF7FD70535D, 00007FF7FD70537F
PyModule_GetDict, xrefs: 00007FF7FD7050D9, 00007FF7FD7050FB
PyUnicode_Join, xrefs: 00007FF7FD7053B9, 00007FF7FD7053DB
PyConfig_SetWideStringList, xrefs: 00007FF7FD704E83, 00007FF7FD704EA5
PyObject_SetAttrString, xrefs: 00007FF7FD705191, 00007FF7FD7051B3
PyErr_Clear, xrefs: 00007FF7FD704EB1, 00007FF7FD704ED3
Py_InitializeFromConfig, xrefs: 00007FF7FD704D13, 00007FF7FD704D35
PyImport_AddModule, xrefs: 00007FF7FD704FF3, 00007FF7FD705015
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7FD7051ED, 00007FF7FD70520F
PyUnicode_AsUTF8, xrefs: 00007FF7FD7052D3, 00007FF7FD7052F5
PyUnicode_DecodeFSDefault, xrefs: 00007FF7FD70532F, 00007FF7FD705351
Py_ExitStatusException, xrefs: 00007FF7FD704CBA, 00007FF7FD704CDC
PyObject_Str, xrefs: 00007FF7FD7051BF, 00007FF7FD7051E1
Py_DecodeLocale, xrefs: 00007FF7FD704C8F, 00007FF7FD704CB1

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
Instruction ID: 28a1e314e712ede0e68939b810a41d86cb5f6213bbca18fae4efc7ea0043d564
Opcode Fuzzy Hash: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
Instruction Fuzzy Hash: F122916090DB8791FB15BB61B848575A3A0EF4C746FD4143AD42E0E2E4FF3DA5498AF0

Function 00007FF7FD706B00 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FD706B17
GetLastError.KERNEL32 ref: 00007FF7FD706B29
GetProcAddress.KERNEL32 ref: 00007FF7FD706B65
GetLastError.KERNEL32 ref: 00007FF7FD706B77
GetProcAddress.KERNEL32 ref: 00007FF7FD706B90
GetLastError.KERNEL32 ref: 00007FF7FD706BA2
GetProcAddress.KERNEL32 ref: 00007FF7FD706BBB
GetLastError.KERNEL32 ref: 00007FF7FD706BCD
GetProcAddress.KERNEL32 ref: 00007FF7FD706BE9
GetLastError.KERNEL32 ref: 00007FF7FD706BFB
GetProcAddress.KERNEL32 ref: 00007FF7FD706C17
GetLastError.KERNEL32 ref: 00007FF7FD706C29
GetProcAddress.KERNEL32 ref: 00007FF7FD706C45
GetLastError.KERNEL32 ref: 00007FF7FD706C57
GetProcAddress.KERNEL32 ref: 00007FF7FD706C73
GetLastError.KERNEL32 ref: 00007FF7FD706C85
GetProcAddress.KERNEL32 ref: 00007FF7FD706CA1
GetLastError.KERNEL32 ref: 00007FF7FD706CB3

Strings

Tcl_SetVar2, xrefs: 00007FF7FD706E91, 00007FF7FD706EB3
Tcl_FinalizeThread, xrefs: 00007FF7FD706C0D, 00007FF7FD706C2F
Tcl_Init, xrefs: 00007FF7FD706B10, 00007FF7FD706B2F
Tcl_GetString, xrefs: 00007FF7FD706EED, 00007FF7FD706F0F
Tcl_JoinThread, xrefs: 00007FF7FD706CC5, 00007FF7FD706CE7
Tcl_MutexLock, xrefs: 00007FF7FD706CF3, 00007FF7FD706D15
Tk_GetNumMainWindows, xrefs: 00007FF7FD7070E7, 00007FF7FD707109
Tcl_EvalEx, xrefs: 00007FF7FD707001, 00007FF7FD707023
Failed to get address for %hs, xrefs: 00007FF7FD706B38
Tcl_Free, xrefs: 00007FF7FD70708B, 00007FF7FD7070AD
Tcl_NewByteArrayObj, xrefs: 00007FF7FD706F49, 00007FF7FD706F6B
Tcl_MutexFinalize, xrefs: 00007FF7FD706D4F, 00007FF7FD706D71
Tcl_Finalize, xrefs: 00007FF7FD706BDF, 00007FF7FD706C01
Tcl_ConditionFinalize, xrefs: 00007FF7FD706D7D, 00007FF7FD706D9F
Tcl_CreateInterp, xrefs: 00007FF7FD706B5B, 00007FF7FD706B7D
Tcl_EvalObjv, xrefs: 00007FF7FD70702F, 00007FF7FD707051
Tcl_EvalFile, xrefs: 00007FF7FD706FD3, 00007FF7FD706FF5
GetProcAddress, xrefs: 00007FF7FD706B3F
Tcl_GetCurrentThread, xrefs: 00007FF7FD706C97, 00007FF7FD706CB9
Tcl_MutexUnlock, xrefs: 00007FF7FD706D21, 00007FF7FD706D43
Tcl_Alloc, xrefs: 00007FF7FD70705D, 00007FF7FD70707F
Tcl_SetVar2Ex, xrefs: 00007FF7FD706F77, 00007FF7FD706F99
Tcl_DoOneEvent, xrefs: 00007FF7FD706BB1, 00007FF7FD706BD3
Tk_Init, xrefs: 00007FF7FD7070B9, 00007FF7FD7070DB
Tcl_CreateThread, xrefs: 00007FF7FD706C69, 00007FF7FD706C8B
Tcl_CreateObjCommand, xrefs: 00007FF7FD706EBF, 00007FF7FD706EE1
Tcl_DeleteInterp, xrefs: 00007FF7FD706C3B, 00007FF7FD706C5D
Tcl_GetVar2, xrefs: 00007FF7FD706E63, 00007FF7FD706E85
Tcl_FindExecutable, xrefs: 00007FF7FD706B86, 00007FF7FD706BA8
Tcl_NewStringObj, xrefs: 00007FF7FD706F1B, 00007FF7FD706F3D
Tcl_ThreadQueueEvent, xrefs: 00007FF7FD706E07, 00007FF7FD706E29
Tcl_ConditionWait, xrefs: 00007FF7FD706DD9, 00007FF7FD706DFB
Tcl_GetObjResult, xrefs: 00007FF7FD706FA5, 00007FF7FD706FC7
Tcl_ConditionNotify, xrefs: 00007FF7FD706DAB, 00007FF7FD706DCD
Tcl_ThreadAlert, xrefs: 00007FF7FD706E35, 00007FF7FD706E57

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
Instruction ID: 7f266ebe30288b17c36cadf16c9371c57985ed7b96e763a3ba8e9b0ddd78ffd2
Opcode Fuzzy Hash: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
Instruction Fuzzy Hash: 2702A36490DB8791FB25BB25A818579E3A0EF0DB46FD41135D82E0E2E4FF3CA54986F0

Function 00007FF7FD707610 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7FD707CF7,FFFFFFFF,00000000,?,00007FF7FD703101), ref: 00007FF7FD70766C

Strings

LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7FD707643
CreateDirectory, xrefs: 00007FF7FD7077BC
%.*s, xrefs: 00007FF7FD70774C
\, xrefs: 00007FF7FD7076A1
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7FD7077B3
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7FD707680
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7FD707719
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7FD7076DD

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 2001182103-930877121
Opcode ID: cbe9cd6458bf822e1a1f7cd27d90bebd40b50bd1448e24244982f0440f8cb230
Instruction ID: 4df10b6a029dad2a82eb32dee194bf57fa7079a27a832405124219d1e9df8a4f
Opcode Fuzzy Hash: cbe9cd6458bf822e1a1f7cd27d90bebd40b50bd1448e24244982f0440f8cb230
Instruction Fuzzy Hash: 47515411A2D68251FB50BB25DC596BAF261EF8C780FC41431DA2E4E6D5FF6CE50486F0

Function 00007FF7FD7015E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FD7017BF
fseek, xrefs: 00007FF7FD7016C1
Failed to create symbolic link %s!, xrefs: 00007FF7FD701602
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7FD7017AA
fwrite, xrefs: 00007FF7FD7017B1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FD701682
fread, xrefs: 00007FF7FD7017C6
fopen, xrefs: 00007FF7FD701643
malloc, xrefs: 00007FF7FD701729
Failed to extract %s: failed to open target file!, xrefs: 00007FF7FD70163C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FD7016BA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7FD701722

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: ecdec6dd7a33d2879f0514bed92b1e474227b66e4ecf225115ab226c903ff667
Instruction ID: a6ad6a246c3e7ccd8b46b1e42bd98fc9fc7534a5b4a27681700919a6bac09a36
Opcode Fuzzy Hash: ecdec6dd7a33d2879f0514bed92b1e474227b66e4ecf225115ab226c903ff667
Instruction Fuzzy Hash: 6F515C22A0C68242EB15BB1198141A9A3A1BF5C794FC44136EE2C4F7D6FF3CE54587F0

Function 00007FF7FD707500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7FD70753F
GetWindowLongPtrW.USER32 ref: 00007FF7FD7075BF
ShutdownBlockReasonCreate.USER32 ref: 00007FF7FD7075D2
GetLastError.KERNEL32 ref: 00007FF7FD7075DC
SetWindowLongPtrW.USER32 ref: 00007FF7FD7075F3

Strings

Needs to remove its temporary files., xrefs: 00007FF7FD7075C5

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
Instruction ID: 83bf51aeb1dfdcc260396b753f30cc3ed872983b30a3849875821b2e6d8a99e4
Opcode Fuzzy Hash: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
Instruction Fuzzy Hash: EC219461B0CA8281E755AB7AE8491B9A350EF8CB91F984130DA3D4B3D5FF2CD58186F0

Function 00007FF7FD717250 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD717293
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD717680
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71791C

Strings

p, xrefs: 00007FF7FD717345
-, xrefs: 00007FF7FD717329
p, xrefs: 00007FF7FD7173BD
:, xrefs: 00007FF7FD71744C
f, xrefs: 00007FF7FD7173B5

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction ID: f23239b3411519cffa4509816755ab36cc54160950d6be5b3d2ddcc0766ab673
Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
Instruction Fuzzy Hash: 86127261E0C153C6FB24BA149044679F661FB48761FD44336E6AA4EAC6EB3CE584CBF0

Function 00007FF7FD7105A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7105E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7109A8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD710C47

Strings

p, xrefs: 00007FF7FD7106EA
f, xrefs: 00007FF7FD71082D
f, xrefs: 00007FF7FD710678
p, xrefs: 00007FF7FD710685
f, xrefs: 00007FF7FD7106E2

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction ID: f6468c7b0b21293b0b683593fffd5599a02256ef431df77997ebe6f2329752f4
Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
Instruction Fuzzy Hash: 97127061A0C14386FB207E1590647BAF651FB48764FC84236D6EA4A6C4EE3CF480ABF0

Function 00007FF7FD701030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FD7010E8
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FD7011D6
fseek, xrefs: 00007FF7FD7010B3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FD701078
fread, xrefs: 00007FF7FD7011DD
malloc, xrefs: 00007FF7FD7010EF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FD7010AC

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 798f68e46d4f1aa0b7662e9f415dccc912c57f629369d76511aaada00c82cc3e
Instruction ID: 931058005638c5516f8421513dd04b8f0c8a94ee4bbf268d131dde5ec47be665
Opcode Fuzzy Hash: 798f68e46d4f1aa0b7662e9f415dccc912c57f629369d76511aaada00c82cc3e
Instruction Fuzzy Hash: F5411A22A0C69246EB04FB11D8096A9A2A1BB48BD4FD44532ED6C8F7D5EF3CE50587F0

Function 00007FF7FD707CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF7FD703101), ref: 00007FF7FD707D44
GetCurrentProcessId.KERNEL32(?,00007FF7FD703101), ref: 00007FF7FD707D4A
CreateDirectoryW.KERNEL32(?,00007FF7FD703101), ref: 00007FF7FD707D8C

Part of subcall function 00007FF7FD707E70: GetEnvironmentVariableW.KERNEL32(00007FF7FD702C4F), ref: 00007FF7FD707EA7
Part of subcall function 00007FF7FD707E70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FD707EC9

Part of subcall function 00007FF7FD719174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71918D

Strings

TMP, xrefs: 00007FF7FD707CDC, 00007FF7FD707DE3
TMP, xrefs: 00007FF7FD707D02
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7FD707D1C
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7FD707DBE
_MEI%d, xrefs: 00007FF7FD707D52

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 365913792-1339014028
Opcode ID: fc67a987217e40b5ad979417d55bde384dc353a3eb7d5f0f4a4332e900270273
Instruction ID: 010a26c14590d229e4d024c52508480d22db0de15eaad9a4f8e4af0dd4d3770e
Opcode Fuzzy Hash: fc67a987217e40b5ad979417d55bde384dc353a3eb7d5f0f4a4332e900270273
Instruction Fuzzy Hash: 7A418E21A1D68240EB24F72299592B9E251AF4DB90FC00235E92D4F7E6FF3CE94586F0

Function 00007FF7FD70DF98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7FD70DFF5

Part of subcall function 00007FF7FD70EF4C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7FD70EF8F
Part of subcall function 00007FF7FD70EF4C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7FD70EFB4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7FD70E0CD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7FD70E31B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FD70E428

Strings

csm, xrefs: 00007FF7FD70E00F
csm, xrefs: 00007FF7FD70E0F0
csm, xrefs: 00007FF7FD70E076

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
Instruction ID: 11025f51feea3aa97def8ac7f692933489ddcdab083d0035b8e1b3a12738a277
Opcode Fuzzy Hash: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
Instruction Fuzzy Hash: A8D1A43290C74186EB20AB25D8443ADB7A0FB49788F904135EE6D5BBD5EF39E081C7E0

Function 00007FF7FD702310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD702360
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD702AC6,?,00007FF7FD702BC5), ref: 00007FF7FD70241A

Strings

%ls: , xrefs: 00007FF7FD7023D9
<FormatMessageW failed.>, xrefs: 00007FF7FD702427
%ls, xrefs: 00007FF7FD702448
[PYI-%d:ERROR] , xrefs: 00007FF7FD702368

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentFormatMessageProcess
String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
API String ID: 27993502-4247535189
Opcode ID: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
Instruction ID: 901e3893b60f4ea8bda44ef90a3f9cd5b1fcc12df0d1430d20a3c413d0bf3cd9
Opcode Fuzzy Hash: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
Instruction Fuzzy Hash: 88319223B0C68141E720A725AC146AAA265FF88B95F800135EF5D9BAD9FF3CD546C7E0

Function 00007FF7FD70D258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D2DD
GetLastError.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D2EB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D315
FreeLibrary.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D383
GetProcAddress.KERNEL32(?,?,?,00007FF7FD70D50A,?,?,?,00007FF7FD70D1FC,?,?,?,00007FF7FD70CDF9), ref: 00007FF7FD70D38F

Strings

api-ms-, xrefs: 00007FF7FD70D2FD

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
Instruction ID: 61b603c0ec47f33942c5f3e5b41cd17155b0f3c007f9595abfc191618f32bbc5
Opcode Fuzzy Hash: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
Instruction Fuzzy Hash: 44319F21A0EB4181EF11AB02AC082B5A298FB4CBA0F894535DD2D4F7D4FF7CE44586F4

Function 00007FF7FD707BB0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7FD707BD0
OpenProcessToken.ADVAPI32 ref: 00007FF7FD707BE3
GetTokenInformation.ADVAPI32 ref: 00007FF7FD707C08
GetLastError.KERNEL32 ref: 00007FF7FD707C12
GetTokenInformation.ADVAPI32 ref: 00007FF7FD707C52
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FD707C6E
CloseHandle.KERNEL32 ref: 00007FF7FD707C86

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 2bc3961b58cf50d24fb6d4fb88d1ab5404f4b9a8b6d34b736b61f848e7f87ba7
Instruction ID: 8a61ffa45dfe13b6730fb17bb4f64fcce3d16e891375c2f054d9af8657005e85
Opcode Fuzzy Hash: 2bc3961b58cf50d24fb6d4fb88d1ab5404f4b9a8b6d34b736b61f848e7f87ba7
Instruction Fuzzy Hash: 8D215531A0CA8251EB10AB55A84453AF3A5EB897A0F900235D67D4BAE4FF6CD4458BF0

Function 00007FF7FD71C050 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FD71C05F
FlsGetValue.KERNEL32 ref: 00007FF7FD71C074
FlsSetValue.KERNEL32 ref: 00007FF7FD71C095
FlsSetValue.KERNEL32 ref: 00007FF7FD71C0C2
FlsSetValue.KERNEL32 ref: 00007FF7FD71C0D3
FlsSetValue.KERNEL32 ref: 00007FF7FD71C0E4
SetLastError.KERNEL32 ref: 00007FF7FD71C0FF

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7e861b1c13b2d150705a6a4d04516104d82a3e3d825180b95c5380022c1757db
Instruction ID: 1f2262d8574c668218dc419f7a88186d1d0d291c9adf4ff1ec0ce512ee82e3de
Opcode Fuzzy Hash: 7e861b1c13b2d150705a6a4d04516104d82a3e3d825180b95c5380022c1757db
Instruction Fuzzy Hash: 3E216D20A0C28342FB6573A15A4513DD2A28F4CBB1FE44734D83D1EADAFE2CB84196F0

Function 00007FF7FD728FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7FD72900D
GetLastError.KERNEL32 ref: 00007FF7FD729019
CloseHandle.KERNEL32 ref: 00007FF7FD729031
CreateFileW.KERNEL32 ref: 00007FF7FD72905C
WriteConsoleW.KERNEL32 ref: 00007FF7FD72907B

Strings

CONOUT$, xrefs: 00007FF7FD72903D

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
Instruction ID: 784e7812ef32c67b126900247ed3e0d5dc9c53784f290c959fe91f2bca3e466a
Opcode Fuzzy Hash: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
Instruction Fuzzy Hash: D011662171CA8186E750AB52E845325E2A0FB8CBE5F944235D96D8B7D4FF7CD4048BF4

Function 00007FF7FD7079B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(FFFFFFFF,?,?,00000000,00007FF7FD708706), ref: 00007FF7FD7079E2
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707A39

Part of subcall function 00007FF7FD708950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD703A04,00000000,00007FF7FD701965), ref: 00007FF7FD708989

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707AC8
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707B34
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707B45
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FD708706), ref: 00007FF7FD707B5A

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 085495254006ee1cdc3c832bee00d85fc27d841cf049dd36fd5940e5a83abb71
Instruction ID: 69c9437358bbc28c3f8c2e099fe7e0b7f484eb874f7f3a6a50ee3277ff9005c9
Opcode Fuzzy Hash: 085495254006ee1cdc3c832bee00d85fc27d841cf049dd36fd5940e5a83abb71
Instruction Fuzzy Hash: 94419061A0D68241EB20AB15A8446AAB294FB4CB84F850135DF6D5B7C5EF3CD901C7F0

Function 00007FF7FD7085C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD707BB0: GetCurrentProcess.KERNEL32 ref: 00007FF7FD707BD0
Part of subcall function 00007FF7FD707BB0: OpenProcessToken.ADVAPI32 ref: 00007FF7FD707BE3
Part of subcall function 00007FF7FD707BB0: GetTokenInformation.ADVAPI32 ref: 00007FF7FD707C08
Part of subcall function 00007FF7FD707BB0: GetLastError.KERNEL32 ref: 00007FF7FD707C12
Part of subcall function 00007FF7FD707BB0: GetTokenInformation.ADVAPI32 ref: 00007FF7FD707C52
Part of subcall function 00007FF7FD707BB0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FD707C6E
Part of subcall function 00007FF7FD707BB0: CloseHandle.KERNEL32 ref: 00007FF7FD707C86

LocalFree.KERNEL32(00000000,00007FF7FD703099), ref: 00007FF7FD70864C
LocalFree.KERNEL32 ref: 00007FF7FD708655

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7FD708637
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7FD708622
S-1-3-4, xrefs: 00007FF7FD708601
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7FD708663

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
Instruction ID: b89d9aa516b181c6e34923d3431d811568ea5c2f630c031b736bc0a049d5200a
Opcode Fuzzy Hash: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
Instruction Fuzzy Hash: 1B214F21A0C68281E750BB50E8193EAE261EB8C780FD54135EA6D4B7D6FF3CD94487F0

Function 00007FF7FD71C1C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C1D7
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C20D
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C23A
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C24B
FlsSetValue.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C25C
SetLastError.KERNEL32(?,?,?,00007FF7FD715E51,?,?,?,?,00007FF7FD71B392,?,?,?,?,00007FF7FD7180CB), ref: 00007FF7FD71C277

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ac59ac31d7f732554de99c3fa9d4ab545aa66469dac59f93124fa2137bdd3152
Instruction ID: dc08ec67b2fe1190f779230a3e949a21292ec1d930c6a7a0c2279a840eb4d40d
Opcode Fuzzy Hash: ac59ac31d7f732554de99c3fa9d4ab545aa66469dac59f93124fa2137bdd3152
Instruction Fuzzy Hash: 7A113B21A0C28283FB5477A1564513DE1929F4DBB1FA84735D83E1EAE6FE2CB80196F0

Function 00007FF7FD71A9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FD71A9E5
GetProcAddress.KERNEL32 ref: 00007FF7FD71A9FB
FreeLibrary.KERNEL32 ref: 00007FF7FD71AA22

Strings

mscoree.dll, xrefs: 00007FF7FD71A9DC
CorExitProcess, xrefs: 00007FF7FD71A9F4

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
Instruction ID: 2e343f518bb2c2cacdf38a5db0c255ba264dfa471910f7a7292d74c1f9cf84bb
Opcode Fuzzy Hash: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
Instruction Fuzzy Hash: 56F04F61A1D64681EB14AB24A4453799360EF4D766FD40636CA7E8A2E4FF2CD049C7F0

Function 00007FF7FD72A5D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FD72A600
_set_statfp.LIBCMT ref: 00007FF7FD72A61B
_set_statfp.LIBCMT ref: 00007FF7FD72A637
_set_statfp.LIBCMT ref: 00007FF7FD72A673

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 11fe5f08a8730e3ad6872d84c95a3f8c178c7c466d1e8dccd09e18c2aaa0d639
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 92119132E5CA8301F7643124E492376A150EF5C776F840638EA7E0E6DAFF2CA84549F0

Function 00007FF7FD71C290 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C2AF
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C2CE
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C2F6
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C307
FlsSetValue.KERNEL32(?,?,?,00007FF7FD71B4E7,?,?,00000000,00007FF7FD71B782,?,?,?,?,?,00007FF7FD71B70E), ref: 00007FF7FD71C318

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7deb42c8f0324a16aa6e6d98ee2ae7cc2d1f88d9baa526aad775adab58b08f58
Instruction ID: ec76db401d2b0598ad2548b8fff8ce0031df2120c09a1a4a22288bb015a88822
Opcode Fuzzy Hash: 7deb42c8f0324a16aa6e6d98ee2ae7cc2d1f88d9baa526aad775adab58b08f58
Instruction Fuzzy Hash: 9B119D61E0C24242FB5873A5954117DE1929F4D7B0FD85334E83D1EAD6FE2CB80286F1

Function 00007FF7FD71C124 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7FD71C135
FlsSetValue.KERNEL32 ref: 00007FF7FD71C154
FlsSetValue.KERNEL32 ref: 00007FF7FD71C17C
FlsSetValue.KERNEL32 ref: 00007FF7FD71C18D
FlsSetValue.KERNEL32 ref: 00007FF7FD71C19E

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d8a93f30c514b9ca08edce8a37f6d9cc5fb21c897957857cccbf80552a5a1f13
Instruction ID: 062a01f8bf02326b07360338d835002d8f8a25e0365fef17e04ac1e43abca949
Opcode Fuzzy Hash: d8a93f30c514b9ca08edce8a37f6d9cc5fb21c897957857cccbf80552a5a1f13
Instruction Fuzzy Hash: 62114891A4C24342FBA872A1481217DD1924F4E731FE84738D83E1E2D2FD2CB801A6F0

Function 00007FF7FD7085B0 Relevance: 7.5, APIs: 5, Instructions: 36sleepthreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF7FD70851C
GetCurrentProcessId.KERNEL32 ref: 00007FF7FD70852F
GetWindowThreadProcessId.USER32 ref: 00007FF7FD70853F
ShowWindow.USER32 ref: 00007FF7FD708556
Sleep.KERNEL32 ref: 00007FF7FD708565

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Window$Process$ConsoleCurrentShowSleepThread
String ID:
API String ID: 3908687701-0
Opcode ID: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
Instruction ID: 263d0b5092bea26605da3f7bf6d8514b7e7172dc4cf933a48c3995851ba61098
Opcode Fuzzy Hash: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
Instruction Fuzzy Hash: 9F014F20E1CB8282EB54BB21B889139E260EF4CB81F945134D96F4B6D8FF3CD94186F0

Function 00007FF7FD716F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD716F9C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7170C6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD71717C

Strings

verbose, xrefs: 00007FF7FD716F70

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction ID: 6eecc9bd3dc4a8cec9167708cc1ececf1f24fec098a653d0eaa507135c9e7a0c
Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
Instruction Fuzzy Hash: 0B91BF32A0C746C1E721AE24D85077DB2A5AB48B64FD44336DA6D4B3D6EE3CE44683F1

Function 00007FF7FD720E38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD721117

Part of subcall function 00007FF7FD718978: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD718995

Strings

UTF-16LEUNICODE, xrefs: 00007FF7FD7210B5
ccs, xrefs: 00007FF7FD721052
UTF-8, xrefs: 00007FF7FD721096

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
Instruction ID: 1b2f5469fbf9167354d944e6c61dca903404e662225698fb6305abf17287c9d7
Opcode Fuzzy Hash: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
Instruction Fuzzy Hash: C781AD32E0C2C285F7746E258194278A7A0FB19B46FD54034DE299F2D5FB3DB841AAF1

Function 00007FF7FD70CBD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FD70CC03
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7FD70CC9A
RtlUnwindEx.KERNEL32 ref: 00007FF7FD70CCF4

Strings

csm, xrefs: 00007FF7FD70CC81

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
Instruction ID: a4418b60c804ab29cba366d4062c8f6be8fc779f63b374e0ea2f64afaafd0d3e
Opcode Fuzzy Hash: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
Instruction Fuzzy Hash: 4C51A132A1D6028ADB14AB16D84867DA791EF48B84F908131DA6D4B7C8FF7CE84187E0

Function 00007FF7FD70E818 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FD70E840
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7FD70E928

Strings

csm, xrefs: 00007FF7FD70E862
csm, xrefs: 00007FF7FD70E97A

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
Instruction ID: 626020ef3f1a5ea1dfa5f30e7d00cafe253801fb06dca39886e33b30531a2607
Opcode Fuzzy Hash: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
Instruction Fuzzy Hash: 1251A07291C34286EB64AA15D848379B790FB88B84F985135DAAC4BBC1DF3DE450C7E1

Function 00007FF7FD70E468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7FD70E4C7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7FD70E513

Strings

MOC, xrefs: 00007FF7FD70E4DB
RCC, xrefs: 00007FF7FD70E4E3

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
Instruction ID: d9894dce2eec81f348ae4ee0ec3c7c86b491016bf5a7a58b50d22e204a58008d
Opcode Fuzzy Hash: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
Instruction Fuzzy Hash: 8461933290C7C581D7609B15E8443AAF7A0FB89794F444625EBAC07BD5EF7CE090CBA0

Function 00007FF7FD707260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7FD7028EC,FFFFFFFF,00000000,00007FF7FD70336A), ref: 00007FF7FD707372

Strings

%s%c, xrefs: 00007FF7FD7072E4
\, xrefs: 00007FF7FD7072D7
%.*s, xrefs: 00007FF7FD70732B

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: edef38ff62529b20aa9e4dd174cb85ee92fdf6a12d4b4b11e6a9369b37dc6bc2
Instruction ID: e6135dda728a0069b51be73b81e53c0a7ecb8952c2dd9167d352b75127d6e8d1
Opcode Fuzzy Hash: edef38ff62529b20aa9e4dd174cb85ee92fdf6a12d4b4b11e6a9369b37dc6bc2
Instruction Fuzzy Hash: 7631992161D9C545F721A711A8147AAE358EB8CBA0F940631EEBD4B7C5FF2CD24587F0

Function 00007FF7FD702220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF7FD70866F), ref: 00007FF7FD70226E

Strings

%ls, xrefs: 00007FF7FD7022E5
WARNING, xrefs: 00007FF7FD70227D
[PYI-%d:%ls] , xrefs: 00007FF7FD702276

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: %ls$WARNING$[PYI-%d:%ls]
API String ID: 2050909247-3372507544
Opcode ID: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
Instruction ID: bf70645ed1d24a434ec17ac43b8a5808eca8c3b6fe79659a703b53399c6c8169
Opcode Fuzzy Hash: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
Instruction Fuzzy Hash: 6821B62261D78141E710AB90F8556EAB365FB887C0F800135EE9D5B6DAEF3CD115C7E0

Function 00007FF7FD71D4A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7FD71D51F
WriteFile.KERNEL32 ref: 00007FF7FD71D7E7
WriteFile.KERNEL32 ref: 00007FF7FD71D82D
GetLastError.KERNEL32 ref: 00007FF7FD71D8E3

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
Instruction ID: 81e34b51c192aef3205bd27d7eda9cfeeddf97bd1fc60ab394ceaa54b233f30b
Opcode Fuzzy Hash: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
Instruction Fuzzy Hash: 6FD1F972B0C64189E710DF75D4402AC7771F7497A8B944235CE6D6BBD9EE38D406CBA0

Function 00007FF7FD71DE60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD71DE4B), ref: 00007FF7FD71DF7C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD71DE4B), ref: 00007FF7FD71E007

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
Instruction ID: d9a2e701cc75d01f9cc4eda6418bbb43b6c794d713c30baaff5ffaec9be64f3e
Opcode Fuzzy Hash: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
Instruction Fuzzy Hash: D191D432F0C65285F750AB2594402BDABA0BB08BA8FD44239DE2E5B6C5EE3DD44187F0

Function 00007FF7FD720BFC Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FD720CEC
_get_daylight.LIBCMT ref: 00007FF7FD720CFD
_get_daylight.LIBCMT ref: 00007FF7FD720D0E
_isindst.LIBCMT ref: 00007FF7FD720DD9

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
Instruction ID: d6af8c722f15c1bdd77c791e4b793f8b843f5a530a1bc167ed8381b25c8da64d
Opcode Fuzzy Hash: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
Instruction Fuzzy Hash: 22510972F091918AEB18EF3499552BCA761EB0835AF900135ED2D5AAD5FB38B441CBF0

Function 00007FF7FD716738 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7FD71676B
GetFileInformationByHandle.KERNEL32 ref: 00007FF7FD7167CD
GetLastError.KERNEL32 ref: 00007FF7FD71685E
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD716670), ref: 00007FF7FD7168AA

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
Instruction ID: 26c5658c5b8e1093aaa60afe7329535bbb01c27147147779242c3aed8f5413c1
Opcode Fuzzy Hash: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
Instruction Fuzzy Hash: D5517E22E0C6518AF714EF71D4403BEA3B1AB48B68F908634DE195B689EF38D54187F0

Function 00007FF7FD70C5E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FD70C60C
GetCurrentThreadId.KERNEL32 ref: 00007FF7FD70C61A
GetCurrentProcessId.KERNEL32 ref: 00007FF7FD70C626
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FD70C636

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
Instruction ID: a8fdec2e11528bb3e9622c5b6d1424abfe28625492edbbc2e058f60056e5960c
Opcode Fuzzy Hash: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
Instruction Fuzzy Hash: E5111F22B5CB0189EB00DF60E8552A873A4FB1D759F841E31DA6D477A4EF78D15483E0

Function 00007FF7FD726D8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FD7229D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD722A03

_get_daylight.LIBCMT ref: 00007FF7FD726EA4
_get_daylight.LIBCMT ref: 00007FF7FD726EB5

Strings

?, xrefs: 00007FF7FD726E35

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: d0b5b4893435fc06bb44c0bfd3c4afae0be10aa3ee1d4f6c058f23408d263c6b
Instruction ID: c5fc97f0c8b104025bb5f6a373925b5f602352ba797f73b140bc04d86cf94a19
Opcode Fuzzy Hash: d0b5b4893435fc06bb44c0bfd3c4afae0be10aa3ee1d4f6c058f23408d263c6b
Instruction Fuzzy Hash: DD41FA12E0C2C146FB25B725D44137ED651EB987B5F94423AEE6C0AAD5FE3CD4418BE0

Function 00007FF7FD719F50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD719F82

Part of subcall function 00007FF7FD71B464: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B47A
Part of subcall function 00007FF7FD71B464: GetLastError.KERNEL32(?,?,?,00007FF7FD723F92,?,?,?,00007FF7FD723FCF,?,?,00000000,00007FF7FD724495,?,?,?,00007FF7FD7243C7), ref: 00007FF7FD71B484

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FD70C165), ref: 00007FF7FD719FA0

Strings

C:\Users\user\Desktop\799Ox3XqxO.exe, xrefs: 00007FF7FD719F8E

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\799Ox3XqxO.exe
API String ID: 3580290477-3898320094
Opcode ID: 6a4dbdaa8dd2b454c87b42bcae1ae77807c0d922a2c4c320371c355071f6a322
Instruction ID: d47f352b14b7c2570b1b04981355274854f52eacbf00d9d96ed37d8ebe451e8d
Opcode Fuzzy Hash: 6a4dbdaa8dd2b454c87b42bcae1ae77807c0d922a2c4c320371c355071f6a322
Instruction Fuzzy Hash: 76418E36A0CB1285EB15FF21A4400B8A2A5FB497A4FC44136E96D4BBD5FF39E44282F0

Function 00007FF7FD71DB38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7FD71DC4F
GetLastError.KERNEL32 ref: 00007FF7FD71DC71

Strings

U, xrefs: 00007FF7FD71DBFB

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
Instruction ID: db5524688b31f951c0450553a22a820bb663fd3003cd8719759a2051db8ea9cd
Opcode Fuzzy Hash: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
Instruction Fuzzy Hash: FB41D62271C68185D720AF25E4443B9A761F788794F804531EE5E8B798EF7CD541CBE0

Function 00007FF7FD702020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FD701B4A), ref: 00007FF7FD702070

Strings

%s: %s, xrefs: 00007FF7FD7020EF
[PYI-%d:ERROR] , xrefs: 00007FF7FD702078

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$[PYI-%d:ERROR]
API String ID: 2050909247-3704582800
Opcode ID: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
Instruction ID: a37fc773940d8a35aeec994099a8d4c99b1679801d6041550aa112e0e5b98871
Opcode Fuzzy Hash: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
Instruction Fuzzy Hash: 3B21D223B1C68145E720A761AC056E6A255BF8CBD4FC04132FE9D9B7CAEF3CD146C2A0

Function 00007FF7FD720828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FD720868
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FD7208BA

Strings

:, xrefs: 00007FF7FD72087E

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 329b1ba0e256b22385198653e79ab285c8b0391819b27a8993372820f1b36e2c
Instruction ID: e143cca435b75a45f551fe0b28b4d4857af0a1a26ce04a152529058e4676bf09
Opcode Fuzzy Hash: 329b1ba0e256b22385198653e79ab285c8b0391819b27a8993372820f1b36e2c
Instruction Fuzzy Hash: F8219C22A0C2D181EB20AB21D44826EA3A1FB8CB45FC54135DA6D4B6C5FF7CE9458BF0

Function 00007FF7FD701E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7FD701B79), ref: 00007FF7FD701E9E

Strings

ERROR, xrefs: 00007FF7FD701EAD
[PYI-%d:%s] , xrefs: 00007FF7FD701EA6

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$[PYI-%d:%s]
API String ID: 2050909247-3005936843
Opcode ID: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
Instruction ID: 58ce827c1fda71f11ee0f914a93c8cde63fc8e7fb3f7d911f5a49df69eb8050a
Opcode Fuzzy Hash: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
Instruction Fuzzy Hash: CB11843261D78141E720AB51B8455EAB364EB887C4F800135FE9D477D9EF7CD15586A0

Function 00007FF7FD702140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7FD7028DA,FFFFFFFF,00000000,00007FF7FD70336A), ref: 00007FF7FD70218E

Strings

WARNING, xrefs: 00007FF7FD70219D
[PYI-%d:%s] , xrefs: 00007FF7FD702196

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: CurrentProcess
String ID: WARNING$[PYI-%d:%s]
API String ID: 2050909247-3752221249
Opcode ID: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
Instruction ID: f9746601a4a8d761ceb87c7671e7a5dd141715180220bfb691c9ef0ef97e1e9b
Opcode Fuzzy Hash: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
Instruction Fuzzy Hash: 4711843261D78141E720AB51B8455EAB354EB887C4F800135FE9D477D9EF7CD15587A0

Function 00007FF7FD70F2D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7FD70F328
RaiseException.KERNEL32 ref: 00007FF7FD70F369

Strings

csm, xrefs: 00007FF7FD70F356

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
Instruction ID: 1406273dc3b8572dfe3f7c38aed0a5d1878900b4732064037b125ef326123ecd
Opcode Fuzzy Hash: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
Instruction Fuzzy Hash: A7115E3260CB8082EB209B15F844269F7E4FB88B94F584230EE9D0B794EF3CD5518BA0

Function 00007FF7FD7219AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7219DC
GetDriveTypeW.KERNEL32 ref: 00007FF7FD721A1C

Strings

:, xrefs: 00007FF7FD721A05

Memory Dump Source

Source File: 00000003.00000002.2260074931.00007FF7FD701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FD700000, based on PE: true

Associated: 00000003.00000002.2260047680.00007FF7FD700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260166762.00007FF7FD72D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD740000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260207609.00007FF7FD743000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2260269920.00007FF7FD746000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7fd700000_799Ox3XqxO.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
Instruction ID: a6610d72e25e4463ab83d5676c7babcc3483b4e9846cc3a1b268b075bf4ab9a3
Opcode Fuzzy Hash: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
Instruction Fuzzy Hash: 4B01712291C28286E721BF60946227EA3A0FF4C705FC05536D96D8A6D5FF2CE544CAF4

Analysis Process: INST.exePID: 4308, Parent PID: 6000COMMON

Execution Graph

Execution Coverage:	18.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.3%
Total number of Nodes:	93
Total number of Limit Nodes:	11

Executed Functions

Function 0636AFC8 Relevance: 13.3, APIs: 1, Strings: 6, Instructions: 1095
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cZtl^, xrefs: 0636BB1C, 0636BB21
C., xrefs: 0636B714, 0636B719
3Ztl^, xrefs: 0636BC62, 0636BC67
#Ztl^, xrefs: 0636BCB5, 0636BCBA
SZtl^, xrefs: 0636BB96, 0636BB9B
CZtl^, xrefs: 0636BBE9, 0636BBEE

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID: #Ztl^$3Ztl^$C.$CZtl^$SZtl^$cZtl^
API String ID: 0-2692191565
Opcode ID: e3800b9ad37d60fddb7954ba671d27c609017f6af083eb177038fade46d50e07
Instruction ID: 637c945ac52954f4cc438799e66bd7f58a879157bb9d58f0e963f63416e1a79b
Opcode Fuzzy Hash: e3800b9ad37d60fddb7954ba671d27c609017f6af083eb177038fade46d50e07
Instruction Fuzzy Hash: 46C2B174E012298FCBA5DF24D998B9DB7B2EF49300F1095E9E809A7354DB346E85CF90

Function 063683F8 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06368C5E
$jq, xrefs: 0636871D
$jq, xrefs: 06368B91
$jq, xrefs: 063687E1

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 9f0cdcc2b2e0acbeea39ed2782bcf0fb34d225c30f0edd052fd12e0a69d11aba
Instruction ID: 98147e3a9bd833f791bee0a58c3aef2d3442f3206409adf208054b245449c888
Opcode Fuzzy Hash: 9f0cdcc2b2e0acbeea39ed2782bcf0fb34d225c30f0edd052fd12e0a69d11aba
Instruction Fuzzy Hash: 6032D070E01228CFDB64DF65C894BDEBBB2BF49300F5081A9D50AAB255DB319E85CF94

Function 06361CD8 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06361F39
$jq, xrefs: 06361E73
$jq, xrefs: 06361F23
$jq, xrefs: 06361E89

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: d4ecc5f29ac274e6783cf5b567cc636454f4ebd1fc09271ee0f0e6b204056a76
Instruction ID: a11f621b0ce4f1393611d909325aeeaad3151e54d60ad932e2762083627c71c2
Opcode Fuzzy Hash: d4ecc5f29ac274e6783cf5b567cc636454f4ebd1fc09271ee0f0e6b204056a76
Instruction Fuzzy Hash: BAC1C770E01218CFDB64DFA5C99079EBBB2FF49300F608569D409AB259DB345E85CF94

Function 0636C768 Relevance: 2.9, Strings: 2, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 0636C9E8
1, xrefs: 0636CA6D

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 758e730a621e466b782a80c805d177c7ebbf322821bc923f900b2caa55c5422c
Instruction ID: ce01b8b93f031e824e146747d4fe83176728a51c9197dc77b1b3774d3ef8488d
Opcode Fuzzy Hash: 758e730a621e466b782a80c805d177c7ebbf322821bc923f900b2caa55c5422c
Instruction Fuzzy Hash: BCF1EE74E01328CFDB68CF65C894B9DBBB6BF89301F5081A9E50AA7254DB315E85CF90

Function 06367C68 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

$jq, xrefs: 06367E1C

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID: $jq
API String ID: 0-2886413773
Opcode ID: 567b86d63ec0ec4d57b285bb4422ea3642a7acb410ad37a9786d4fa94b59a5f6
Instruction ID: 70d25ec4b8fba62f8be45f63480056c0a723193332bb61768c5a0db461e28f1d
Opcode Fuzzy Hash: 567b86d63ec0ec4d57b285bb4422ea3642a7acb410ad37a9786d4fa94b59a5f6
Instruction Fuzzy Hash: 7E71F474E01218CFDB58DFA6D494AEDBBB2FF89304F609529E415AB358DB349845CF80

Function 06361348 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e22a1c39213ae355dc06da8d186902e69cc289f17bc4ce6537cb5650fb5e176
Instruction ID: 12d4d0e24b76bd088178029c40986fcb5af8312c3e4a79024487c95b62c1a494
Opcode Fuzzy Hash: 1e22a1c39213ae355dc06da8d186902e69cc289f17bc4ce6537cb5650fb5e176
Instruction Fuzzy Hash: 9522AE74E00229CFDB65DF69C994BD9BBB2BF49300F1081EAD549A7254EB319E85CF80

Function 0636A468 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6bc60673d70d90dcb8cd862aa23304cd69619488d64f1a4d408b3e71942fd1
Instruction ID: 57c61ca050ef850ea8173c5726a59e79552b290b7d3142ab72940c26b2b244d8
Opcode Fuzzy Hash: 1b6bc60673d70d90dcb8cd862aa23304cd69619488d64f1a4d408b3e71942fd1
Instruction Fuzzy Hash: 94910674D01219CFDBA4DFA9D984B9DBBB6BF49300F1081A9E409B7355DB30AA84CF91

Function 0244D0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0244D136
GetCurrentThread.KERNEL32 ref: 0244D173
GetCurrentProcess.KERNEL32 ref: 0244D1B0
GetCurrentThreadId.KERNEL32 ref: 0244D209

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c8e9d0b3cc2546cb2729f4694597a73823be7ad5a99c41340a77980fda0d696c
Instruction ID: a8511872bedd3ee6011e0ffe55d06d3221969dd9ec10a060da5f32d91456d0c6
Opcode Fuzzy Hash: c8e9d0b3cc2546cb2729f4694597a73823be7ad5a99c41340a77980fda0d696c
Instruction Fuzzy Hash: CA5138B0900349CFDB55DFAAD548BAEBFF1EF48304F24805AE519A7360DB389944CB65

Function 0244D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0244D136
GetCurrentThread.KERNEL32 ref: 0244D173
GetCurrentProcess.KERNEL32 ref: 0244D1B0
GetCurrentThreadId.KERNEL32 ref: 0244D209

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5cf878d11e91277cfd180cd15a466707ea479e6daf01b693ed9f5451cd7a6a72
Instruction ID: e8cf3aaa5deffc879905e07e472df13b4c0d96b5410891a0caab542df2bfc933
Opcode Fuzzy Hash: 5cf878d11e91277cfd180cd15a466707ea479e6daf01b693ed9f5451cd7a6a72
Instruction Fuzzy Hash: AE5149B0900349CFDB55DFAAD548BAEBBF5FF48304F248059E419A7360DB389944CB65

Function 0244AE30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0244B086

Strings

0Vp, xrefs: 0244AFE3
0Vp, xrefs: 0244AFBE

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: HandleModule
String ID: 0Vp$0Vp
API String ID: 4139908857-2715100958
Opcode ID: 194a58dab9cc3b0eed8bd8f29bf275a13af657148dfeb8378310b1daa37be7e0
Instruction ID: 7a2cb9c36f16aa0204873365a48a181ab988c4bf53761395a466087f39c76484
Opcode Fuzzy Hash: 194a58dab9cc3b0eed8bd8f29bf275a13af657148dfeb8378310b1daa37be7e0
Instruction Fuzzy Hash: A87113B0A40B158FE724DF2AD05475ABBF1FF88304F108A2ED49A97B50DB75E949CB90

Function 02445935 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 024459F1

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: efc44c799d6624416b82a335f5f7f9d7a6c5416ca12d30604416cfc7f8842491
Instruction ID: 9ebd3b78ea6562aeb652fbc16fd719eb85ba9f0a7ab5a8d50988c0c1b89434b1
Opcode Fuzzy Hash: efc44c799d6624416b82a335f5f7f9d7a6c5416ca12d30604416cfc7f8842491
Instruction Fuzzy Hash: 8041D3B0C00619CBDB25DFAAC8847DDBBB5FF49304F60806AD408AB255DB75694ACF50

Function 02444248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 024459F1

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b929ac410e01c5285d1b87c8a73999acc24364c029f021cc425fbda7c1e99f48
Instruction ID: cc96e4304c7e1829f3b1405a918ab383fa8fa02cd6cdbf6c792081fbe04f8905
Opcode Fuzzy Hash: b929ac410e01c5285d1b87c8a73999acc24364c029f021cc425fbda7c1e99f48
Instruction Fuzzy Hash: 5041C2B0C00619CBEB24DFAAC844B9DBBB5FF45304F60806AD408AB255DB756945CF90

Function 0244D2F9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0244D387

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 998e76c69210756222de9b537ab30b48d4b8a191d2e0be312061cf75fc3e0ab9
Instruction ID: 2db136d6fcb66ec2c5ec89e7365a69fb25e8ac9290c67c1a2013f03a3a5edd59
Opcode Fuzzy Hash: 998e76c69210756222de9b537ab30b48d4b8a191d2e0be312061cf75fc3e0ab9
Instruction Fuzzy Hash: A221E0B5900249DFDB10CFAAD584ADEBBF5FB48314F14801AE918A7310C378A940CFA0

Function 0244D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0244D387

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f5e4724ba275d8f5af6260fe69b7b5b9d8c2831d7c8eca67267f35df5b59662f
Instruction ID: 53ca11a6d7832c73b91ad6e2f42b3147a39c40395fa9b2afee2e0b3061540937
Opcode Fuzzy Hash: f5e4724ba275d8f5af6260fe69b7b5b9d8c2831d7c8eca67267f35df5b59662f
Instruction Fuzzy Hash: 2921E3B59002089FDB10CF9AD584ADEBBF8EB48314F14801AE918A3310C378A940CFA1

Function 0244B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0244B086

Memory Dump Source

Source File: 00000006.00000002.2223430725.0000000002440000.00000040.00000800.00020000.00000000.sdmp, Offset: 02440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2440000_INST.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 674cdca5b048500e79788be58b8343ffa47ac047d8cec07cb7b8e7985547442d
Instruction ID: c1fc594634f1f1f153cae881e9813df503d689f89d1a8c4feb8c6c2807931933
Opcode Fuzzy Hash: 674cdca5b048500e79788be58b8343ffa47ac047d8cec07cb7b8e7985547442d
Instruction Fuzzy Hash: 5511DFB5C007498FDB20DF9AC444A9EFBF4EB89214F10845AD569B7210C779A545CFA1

Function 006FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222543540.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6fd000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0336f6f558ef8302fdac5a75c65bb68d799fd647b9203fbd9e9da0f6d7d74c9e
Instruction ID: 8386e1207182b555f7ce432afa1a246db492c1677e5cc1dcb3ebd630adb6a798
Opcode Fuzzy Hash: 0336f6f558ef8302fdac5a75c65bb68d799fd647b9203fbd9e9da0f6d7d74c9e
Instruction Fuzzy Hash: 19210671504208DFDB05DF14D9C0B26BFA7FB98314F20C569DA090B356C33AF856D6A2

Function 0070D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222587010.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_70d000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571ae6245738571bc236bddbc56d22e631b68a18648ddcec138028a72baaacd0
Instruction ID: bf19341a3a6e8686abbdb7136caa5dce77b7722dd18989f0de806391bbc47810
Opcode Fuzzy Hash: 571ae6245738571bc236bddbc56d22e631b68a18648ddcec138028a72baaacd0
Instruction Fuzzy Hash: 8521D071604304DFDB24DFA4D984B26BBA5EB88314F20C669D94E4B296C37EDC06CA62

Function 006FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222543540.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6fd000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: b52dc6b876f8b7c7e35ca6e83d95e0528e33971e5ea008f7a3c1d6680377c8be
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 48110372404244DFCB02CF00D5C4B66BFB2FB94324F24C6A9D9090B756C33AE85ACBA2

Function 0070D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222587010.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_70d000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: fcd3456145899fa4b1c1bffa72712947a9b5a187615b224f86674311a9b7ca5b
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: F511BB75504380CFCB22CF54D5C4B15BBA2FB88314F24C6AAD8494B696C33AD80ACBA2

Function 006FD989 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222543540.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6fd000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd2f5245ca3f606b81b774d72dc3ac3ee38f9c5a174d2453e596e94085755d5
Instruction ID: 186f216e9000d35f11c50ac0a8b2b7e5ac4b74f6c3a47f04eff1875b001dc918
Opcode Fuzzy Hash: dbd2f5245ca3f606b81b774d72dc3ac3ee38f9c5a174d2453e596e94085755d5
Instruction Fuzzy Hash: 66012031005348D9D7105B56CD84777FF9EEF45320F18C516EE490A386C2B9A840C671

Function 006FD988 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2222543540.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6fd000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951bd14df35db651baded8d06e0919a334c4427a7e83f1f78c1589af69a816e6
Instruction ID: 1f7781979661c8b5f5ec3d3581640f900e53213d9fd32e7d97c33ce9097a3b11
Opcode Fuzzy Hash: 951bd14df35db651baded8d06e0919a334c4427a7e83f1f78c1589af69a816e6
Instruction Fuzzy Hash: 3CF06871405344AAE7108A16D8847A6FF99EF55724F18C55AEE484A386C2B96844CA71

Non-executed Functions

Function 06360040 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a4c906eadc33456eb19cc45a65e0cb49d593bbcee3ae6270c76e6be9744764
Instruction ID: 1fae2c1a547d0fabc1047daaf54f6e2b1058fefc88d37d9a25bd42371c695448
Opcode Fuzzy Hash: a7a4c906eadc33456eb19cc45a65e0cb49d593bbcee3ae6270c76e6be9744764
Instruction Fuzzy Hash: CCC19274E01218CFDB58DFA9C990A9EBBB2FF89300F1085AAD509AB369DB345D45CF50

Function 06364789 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a146ce161663f3590b5ed0950d818b09d8c6669eeea72eddc2b57db7b9afc32
Instruction ID: bb9f24ba07c2e0655662811bc3850157e2554c972386738c8532861b371e08c1
Opcode Fuzzy Hash: 6a146ce161663f3590b5ed0950d818b09d8c6669eeea72eddc2b57db7b9afc32
Instruction Fuzzy Hash: 01E09230C6610ECEEB108F62C5157FFF6B4AB42204F20D445D8117765ACB7046488FE5

Function 0636635C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2239375796.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6360000_INST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a940ced694ded1f0f04c6420554a7e65581a8fa9ecfe54b8844f9dcf52f70cfc
Instruction ID: 81e77d329a0e34c5d9c79eec801347a8382707dceaf43878c9d68cd00a06cb0a
Opcode Fuzzy Hash: a940ced694ded1f0f04c6420554a7e65581a8fa9ecfe54b8844f9dcf52f70cfc
Instruction Fuzzy Hash: 85F0C930D45219CFEB608F52DD5E7BDBA74AB07345F20A455E006735A4C7B44688CFCA

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 799Ox3XqxO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INST.exe.log

C:\Users\user\AppData\Local\Temp\INST.exe

C:\Users\user\AppData\Local\Temp\_MEI66642\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI66642\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI66642\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI66642\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI66642\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI66642\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI66642\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI66642\libcrypto-3.dll

C:\Users\user\AppData\Local\Temp\_MEI66642\python313.dll

C:\Users\user\AppData\Local\Temp\_MEI66642\select.pyd

C:\Users\user\AppData\Local\Temp\_MEI66642\unicodedata.pyd

Windows Analysis Report
799Ox3XqxO.exe

Function 00007FF7FD708020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Function 00007FF7FD727BD4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF7FD707800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Function 00007FF7FD701930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Function 00007FF7FD7015E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Function 00007FF7FD707CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Function 00007FF7FD7011F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Function 00007FF7FD71FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Function 00007FF7FD702A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Function 00007FF7FD71C95C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF7FD707BB0 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre