Edit tour

Windows Analysis Report
Nexus-Executor.exe

Overview

General Information

Sample name:	Nexus-Executor.exe
Analysis ID:	1570764
MD5:	1d5119509128d468dd629fff653a096a
SHA1:	0715e35d06c94694373a199ac21f66535180a9b0
SHA256:	9f1f4b08d76117c87c2002659333897e28dd90bad5fd1179ae4f16cb01b3f63c
Tags:	exeuser-aachum
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file contains section with special chars

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Nexus-Executor.exe (PID: 1488 cmdline: "C:\Users\user\Desktop\Nexus-Executor.exe" MD5: 1D5119509128D468DD629FFF653A096A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Nexus-Executor.exe PID: 1488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Nexus-Executor.exe.1f78419f1d0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T02:10:58.062907+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	104.26.9.59	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Nexus-Executor.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Nexus-Executor.exe	ReversingLabs: Detection: 39%
Source: Nexus-Executor.exe	Virustotal: Detection: 28%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Nexus-Executor.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_000001F784117750 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,CryptUnprotectData,

0_2_000001F784117750

Source: unknown

HTTPS traffic detected: 104.26.9.59:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: Nexus-Executor.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb source: Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb/''GCTL source: Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_000001F78407F46A Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileA,type_info::_name_internal_method,type_info::_name_internal_method,type_info::_name_internal_method,

0_2_000001F78407F46A

Source: Joe Sandbox View

IP Address: 104.26.9.59 104.26.9.59

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 104.26.9.59:443

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43Host: api.myip.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43Host: api.myip.com

Source: global traffic

DNS traffic detected: DNS query: api.myip.com

Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://https/:://websocketpp.processorGeneric
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000003.2071030448.000001F784542000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000002.4473521839.000001F783F86000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2098071917.000001F784542000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000002.4475106509.000001F784542000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/Russia
Source: Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
Source: Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage(Hold
Source: Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.26.9.59:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AB1C20 OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

0_2_00007FF762AB1C20

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AB1D70 OpenClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,CloseClipboard,

0_2_00007FF762AB1D70

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AB1C20 OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

0_2_00007FF762AB1C20

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AE0330 GetClientRect,QueryPerformanceCounter,GetForegroundWindow,ClientToScreen,SetCursorPos,GetCursorPos,ScreenToClient,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00007FF762AE0330
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AE0D02 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00007FF762AE0D02

System Summary

PE file contains section with special chars

Source: Nexus-Executor.exe	Static PE information: section name: "hR
Source: Nexus-Executor.exe	Static PE information: section name: b)b

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AE3B90 PostQuitMessage,GetWindowRect,SetWindowPos,NtdllDefWindowProc_A,

0_2_00007FF762AE3B90

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AE0330	0_2_00007FF762AE0330
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AE4320	0_2_00007FF762AE4320
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADFCE0	0_2_00007FF762ADFCE0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADF2F0	0_2_00007FF762ADF2F0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADEA60	0_2_00007FF762ADEA60
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AC6BC0	0_2_00007FF762AC6BC0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A9FBB0	0_2_00007FF762A9FBB0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ABDB50	0_2_00007FF762ABDB50
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADCB40	0_2_00007FF762ADCB40
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A97390	0_2_00007FF762A97390
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADA370	0_2_00007FF762ADA370
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A96CB0	0_2_00007FF762A96CB0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ABBD10	0_2_00007FF762ABBD10
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AE0D02	0_2_00007FF762AE0D02
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AB54F0	0_2_00007FF762AB54F0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AC7CE0	0_2_00007FF762AC7CE0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AB6C90	0_2_00007FF762AB6C90
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AAE1C0	0_2_00007FF762AAE1C0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AAFA00	0_2_00007FF762AAFA00
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AD2A00	0_2_00007FF762AD2A00
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AC59E0	0_2_00007FF762AC59E0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ABB1E0	0_2_00007FF762ABB1E0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ACF9E0	0_2_00007FF762ACF9E0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADC310	0_2_00007FF762ADC310
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AAC250	0_2_00007FF762AAC250
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AAF250	0_2_00007FF762AAF250
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AA5A30	0_2_00007FF762AA5A30
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADBA80	0_2_00007FF762ADBA80
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ABC270	0_2_00007FF762ABC270
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ABBFC0	0_2_00007FF762ABBFC0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A9DFB0	0_2_00007FF762A9DFB0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AC97F0	0_2_00007FF762AC97F0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A99730	0_2_00007FF762A99730
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AD6090	0_2_00007FF762AD6090
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ACCDD0	0_2_00007FF762ACCDD0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ADE5B0	0_2_00007FF762ADE5B0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A99E10	0_2_00007FF762A99E10
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AC25F0	0_2_00007FF762AC25F0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AD0DE0	0_2_00007FF762AD0DE0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ABAD40	0_2_00007FF762ABAD40
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762ACD530	0_2_00007FF762ACD530
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762A95D90	0_2_00007FF762A95D90
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AA6EC0	0_2_00007FF762AA6EC0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AB96B0	0_2_00007FF762AB96B0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AA46F0	0_2_00007FF762AA46F0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AB7EF0	0_2_00007FF762AB7EF0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AA4620	0_2_00007FF762AA4620
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_00007FF762AAD620	0_2_00007FF762AAD620
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_000001F784142720	0_2_000001F784142720
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_000001F7840A3841	0_2_000001F7840A3841
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: 0_2_000001F78406BA30	0_2_000001F78406BA30

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: String function: 00007FF762AB1F40 appears 40 times
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: String function: 00007FF762AA85B0 appears 36 times
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: String function: 00007FF762AED440 appears 867 times

Source: Nexus-Executor.exe	Static PE information: Resource name: None type: DOS executable (COM)
Source: Nexus-Executor.exe	Static PE information: Resource name: None type: COM executable for DOS

Source: Nexus-Executor.exe

Static PE information: Section: bbbb ZLIB complexity 0.999211485373886

Source: classification engine

Classification label: mal84.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_000001F7841610E0 CreateToolhelp32Snapshot,Process32NextW,Concurrency::details::WorkQueue::IsStructuredEmpty,Concurrency::details::WorkQueue::IsStructuredEmpty,Process32NextW,

0_2_000001F7841610E0

Source: C:\Users\user\Desktop\Nexus-Executor.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Z5NK383E.htm

Jump to behavior

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Nexus-Executor.exe, 00000000.00000003.2948614208.000001F785FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE segments (id INTEGER PRIMARY KEY,name VARCHAR,url_id INTEGER NON NULL)ue BLOB);
Source: Nexus-Executor.exe, 00000000.00000003.2074176431.000001F7860C7000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899108132.000001F785EBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Nexus-Executor.exe	ReversingLabs: Detection: 39%
Source: Nexus-Executor.exe	Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: xinput1_4.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Nexus-Executor.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Nexus-Executor.exe

Static file information: File size 1393194 > 1048576

Source: Nexus-Executor.exe

Static PE information: Raw size of bbbb is bigger than: 0x100000 < 0x142a00

Source: Nexus-Executor.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb source: Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb/''GCTL source: Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Unpacked PE file: 0.2.Nexus-Executor.exe.7ff762a90000.1.unpack "hR:EW;bbbb:EW;Unknown_Section2:W; vs "hR:ER;bbbb:ER;Unknown_Section2:W;

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762ADF7A0 QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00007FF762ADF7A0

Source: initial sample

Static PE information: section where entry point is pointing to: bbbb

Source: Nexus-Executor.exe	Static PE information: section name: "hR
Source: Nexus-Executor.exe	Static PE information: section name: bbbb
Source: Nexus-Executor.exe	Static PE information: section name: b)b

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_000001F784094970 push es; ret

0_2_000001F78409497F

Source: Nexus-Executor.exe

Static PE information: section name: bbbb entropy: 7.999837452913593

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Window / User API: threadDelayed 5644			Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Window / User API: foregroundWindowGot 1645			Jump to behavior

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Nexus-Executor.exe

0_2_000001F78407F46A

Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsdvboxserviceu
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtrayx64dbgh
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Nexus-Executor.exe, 00000000.00000002.4473521839.000001F783FB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0`
Source: Nexus-Executor.exe, 00000000.00000002.4473521839.000001F783FC7000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000002.4473521839.000001F78401A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-gaVGAuthServicevmwaretrayv
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: wiresharkvmwareuseri
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: uuuYqeMuuqMuup_vuuuuuuuuuuuuuuuuuuuvuuuuuuuueuuuuuuWwSuu~L
Source: Nexus-Executor.exe, 00000000.00000003.2194689343.000001F785FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AEC0F8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF762AEC0F8

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762ADF7A0 QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00007FF762ADF7A0

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AEC0F8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF762AEC0F8

Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,		0_2_00007FF762ADF7A0
Source: C:\Users\user\Desktop\Nexus-Executor.exe	Code function: GetKeyboardLayout,GetLocaleInfoA,		0_2_00007FF762AE105B

Source: C:\Users\user\Desktop\Nexus-Executor.exe

Code function: 0_2_00007FF762AEC388 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF762AEC388

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Nexus-Executor.exe	String found in binary or memory: Electrum
Source: Nexus-Executor.exe	String found in binary or memory: ElectronCash
Source: Nexus-Executor.exe	String found in binary or memory: \com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Nexus-Executor.exe	String found in binary or memory: \Exodus\exodus.wallet
Source: Nexus-Executor.exe	String found in binary or memory: \Ethereum\keystore
Source: Nexus-Executor.exe	String found in binary or memory: Exodus
Source: Nexus-Executor.exe	String found in binary or memory: Ethereum
Source: Nexus-Executor.exe	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: Nexus-Executor.exe	String found in binary or memory: \Ethereum\keystore
Source: Nexus-Executor.exe, 00000000.00000003.2173839625.000001F785E8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Nexus-Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 0.2.Nexus-Executor.exe.1f78419f1d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Nexus-Executor.exe PID: 1488, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Input Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Nexus-Executor.exe	39%	ReversingLabs	Win64.Trojan.Generic
Nexus-Executor.exe	28%	Virustotal		Browse
Nexus-Executor.exe	100%	Avira	HEUR/AGEN.1314582
Nexus-Executor.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://https://https/:://websocketpp.processorGeneric	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.myip.com	104.26.9.59	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.myip.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://https://https/:://websocketpp.processorGeneric	Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage	Nexus-Executor.exe, Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.myip.com/Russia	Nexus-Executor.exe, 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp	false		high
https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage(Hold	Nexus-Executor.exe, 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.ecosia.org/newtab/	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	Nexus-Executor.exe, 00000000.00000003.2072386317.000001F786012000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2073645280.000001F786013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Nexus-Executor.exe, 00000000.00000003.2544425137.000001F786078000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2499043392.000001F785FB3000.00000004.00000020.00020000.00000000.sdmp, Nexus-Executor.exe, 00000000.00000003.2899822876.000001F786117000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.9.59	api.myip.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570764
Start date and time:	2024-12-08 02:10:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Nexus-Executor.exe
Detection:	MAL
Classification:	mal84.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 84% Number of executed functions: 28 Number of non-executed functions: 150
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:11:33	API Interceptor	18116473x Sleep call for process: Nexus-Executor.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.9.59	Fortexternal.exe	Get hash	malicious	Unknown	Browse
	Fortexternal.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse
	ZoomInstaller.exe	Get hash	malicious	Unknown	Browse
	ZoomInstaller.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse
	5zFCjSBLvw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.myip.com	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	172.67.75.163
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	172.67.75.163
	file.exe	Get hash	malicious	Unknown	Browse	104.26.8.59
	file.exe	Get hash	malicious	LummaC, Ailurophile Stealer, Amadey, LummaC Stealer, Stealc	Browse	104.26.9.59
	file.exe	Get hash	malicious	Ailurophile Stealer	Browse	104.26.8.59
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	installer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Xeno Executor.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Delta.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.36.51
	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.24.90
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	8.44.96.113
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Xeno Executor.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.9.59
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	104.26.9.59
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.9.59
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	104.26.9.59
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.9.59
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.9.59
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.9.59
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.9.59
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.9.59
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	104.26.9.59

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.942923120547586
TrID:	Win64 Executable GUI (202006/5) 93.51% Win64 Executable (generic) (12005/4) 5.56% DOS Executable Generic (2002/1) 0.93% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Nexus-Executor.exe
File size:	1'393'194 bytes
MD5:	1d5119509128d468dd629fff653a096a
SHA1:	0715e35d06c94694373a199ac21f66535180a9b0
SHA256:	9f1f4b08d76117c87c2002659333897e28dd90bad5fd1179ae4f16cb01b3f63c
SHA512:	945c1e903b1aa399cd7818513700777b523cc3d01221306a483515b5d08e6b56f1249367c3b493b63c6e0106b4f926a5f8a6b8673b269e1a49189ea313b5cb47
SSDEEP:	24576:YZ9Piz+Jlb6Bl3W3ILsBPEUEEl5ulQYbg/leHYuYQAOKlHk:YX6yr6L3KIYCaY5gOYyak
TLSH:	2255122FB7806BA6D435C073CB9BC359B33192909136CF2B1A828D5F65A905A7717F2C
File Content Preview:	MZ......................@.0.72.UPX!._0x0020b79..........................!..L.!This program cannot be run in DOS mode....$........z...............c.......................................c................................t.............Rich...................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1406a3ca0
Entrypoint Section:	bbbb
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67533378 [Fri Dec 6 17:25:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bd2500bb87e3a94d2777b94c3c55a684

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFEBE355h]
dec eax
lea edi, dword ptr [esi-00561000h]
push edi
mov eax, 006A1D9Dh
push eax
dec eax
mov ecx, esp
dec eax
mov edx, edi
dec eax
mov edi, esi
mov esi, 00141C93h
push ebp
dec eax
mov ebp, esp
inc esp
mov ecx, dword ptr [ecx]
dec ecx
mov eax, edx
dec eax
mov edx, esi
dec eax
lea esi, dword ptr [edi+02h]
push esi
mov al, byte ptr [edi]
dec edx
mov cl, al
and al, 07h
shr cl, 00000003h
dec eax
mov ebx, FFFFFD00h
dec eax
shl ebx, cl
mov cl, al
dec eax
lea ebx, dword ptr [esp+ebx*2-00000E78h]
dec eax
and ebx, FFFFFFC0h
push 00000000h
dec eax
cmp esp, ebx
jne 00007F3648DE433Bh
push ebx
dec eax
lea edi, dword ptr [ebx+08h]
mov cl, byte ptr [esi-01h]
dec edx
mov byte ptr [edi+02h], al
mov al, cl
shr cl, 00000004h
mov byte ptr [edi+01h], cl
and al, 0Fh
mov byte ptr [edi], al
dec eax
lea ecx, dword ptr [edi-04h]
push eax
inc ecx
push edi
dec eax
lea eax, dword ptr [edi+04h]
inc ebp
xor edi, edi
inc ecx
push esi
inc ecx
mov esi, 00000001h
inc ecx
push ebp
inc ebp
xor ebp, ebp
inc ecx
push esp
push ebp
push ebx
dec eax
sub esp, 48h
dec eax
mov dword ptr [esp+38h], ecx
dec eax
mov dword ptr [esp+20h], eax
mov eax, 00000001h
dec eax
mov dword ptr [esp+40h], esi
dec esp
mov dword ptr [esp+30h], eax
mov ebx, eax
inc esp
mov dword ptr [esp+2Ch], ecx
movzx ecx, byte ptr [edi+02h]
shl ebx, cl
mov ecx, ebx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[IMP] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6b5eb0	0x4c0	b)b
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a5000	0x10eb0	b)b
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x374000	0x43bc	"hR
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6b6370	0x20	b)b
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6a4880	0x28	bbbb
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6a48b0	0x140	bbbb
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
"hR	0x1000	0x561000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bbbb	0x562000	0x143000	0x142a00	80d84fc3e7f6b67e27be7615a2010610	False	0.999211485373886	data	7.999837452913593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
b)b	0x6a5000	0x12000	0x11400	0ebb83e4c065739382942bc7e69fdaf9	False	0.2616621376811594	data	3.947360720361499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
None	0x6b5cec	0x2e	data			1.108695652173913
RT_RCDATA	0x389d18	0x3201	empty			0
RT_RCDATA	0x38cf1c	0x3201	empty			0
RT_RCDATA	0x390120	0x3201	empty			0
RT_RCDATA	0x393324	0x3201	empty			0
RT_RCDATA	0x396528	0x3201	empty			0
RT_RCDATA	0x39972c	0x3201	empty			0
RT_RCDATA	0x39c930	0x3201	empty			0
RT_RCDATA	0x39fb34	0x3201	empty			0
RT_RCDATA	0x3a2d38	0x3201	empty			0
RT_RCDATA	0x3a5f3c	0x3201	empty			0
RT_RCDATA	0x3a9140	0x3201	empty			0
RT_RCDATA	0x3ac344	0x3201	empty			0
RT_RCDATA	0x3af548	0x3201	empty			0
RT_RCDATA	0x3b274c	0x3201	empty			0
RT_RCDATA	0x3b5950	0x3201	empty			0
RT_RCDATA	0x3b8b54	0x3201	empty			0
RT_RCDATA	0x3bbd58	0x3201	empty			0
RT_RCDATA	0x3bef5c	0x3201	empty			0
RT_RCDATA	0x3c2160	0x3201	empty			0
RT_RCDATA	0x3c5364	0x3201	empty			0
RT_RCDATA	0x3c8568	0x3201	empty			0
RT_RCDATA	0x3cb76c	0x3201	empty			0
RT_RCDATA	0x3ce970	0x3201	empty			0
RT_RCDATA	0x3d1b74	0x22	empty			0
RT_RCDATA	0x3d1b98	0x77	empty			0
RT_RCDATA	0x3d1c10	0x3201	empty			0
RT_RCDATA	0x3d4e14	0x3201	empty			0
RT_RCDATA	0x3d8018	0x3201	empty			0
RT_RCDATA	0x3db21c	0x3201	empty			0
RT_RCDATA	0x3de420	0x3201	empty			0
RT_RCDATA	0x3e1624	0x3201	empty			0
RT_RCDATA	0x3e4828	0x3201	empty			0
RT_RCDATA	0x3e7a2c	0x68b	empty			0
RT_RCDATA	0x3e80b8	0xf	empty			0
RT_RCDATA	0x3e80c8	0x3201	empty			0
RT_RCDATA	0x3eb2cc	0x3201	empty			0
RT_RCDATA	0x3ee4d0	0xda443	empty			0
RT_RCDATA	0x4c8914	0x3201	empty			0
RT_RCDATA	0x4cbb18	0x3201	empty			0
RT_RCDATA	0x4ced1c	0x4d8a	empty			0
RT_RCDATA	0x4d3aa8	0x3201	empty			0
RT_RCDATA	0x4d6cac	0x3201	empty			0
RT_RCDATA	0x4d9eb0	0x3201	empty			0
RT_RCDATA	0x4dd0b4	0x3201	empty			0
RT_RCDATA	0x4e02b8	0x3201	empty			0
RT_RCDATA	0x4e34bc	0x3201	empty			0
RT_RCDATA	0x4e66c0	0x3201	empty			0
RT_RCDATA	0x4e98c4	0x3201	empty			0
RT_RCDATA	0x4ecac8	0x55	empty			0
RT_RCDATA	0x4ecb20	0x3201	empty			0
RT_RCDATA	0x4efd24	0x9e	empty			0
RT_RCDATA	0x4efdc4	0x1f2	empty			0
RT_RCDATA	0x4effb8	0x3201	empty			0
RT_RCDATA	0x4f31bc	0x3201	empty			0
RT_RCDATA	0x4f63c0	0x3201	empty			0
RT_RCDATA	0x4f95c4	0x3201	empty			0
RT_RCDATA	0x4fc7c8	0x3201	empty			0
RT_RCDATA	0x4ff9cc	0x7d	empty			0
RT_RCDATA	0x4ffa4c	0x7d	empty			0
RT_RCDATA	0x4ffacc	0x7d	empty			0
RT_RCDATA	0x4ffb4c	0x7d	empty			0
RT_RCDATA	0x4ffbcc	0x7d	empty			0
RT_RCDATA	0x4ffc4c	0x7d	empty			0
RT_RCDATA	0x4ffccc	0x7d	empty			0
RT_RCDATA	0x4ffd4c	0x7d	empty			0
RT_RCDATA	0x4ffdcc	0x7d	empty			0
RT_RCDATA	0x4ffe4c	0x7d	empty			0
RT_RCDATA	0x4ffecc	0x7d	empty			0
RT_RCDATA	0x4fff4c	0x7d	empty			0
RT_RCDATA	0x4fffcc	0x7d	empty			0
RT_RCDATA	0x50004c	0x7d	empty			0
RT_RCDATA	0x5000cc	0x7d	empty			0
RT_RCDATA	0x50014c	0x7d	empty			0
RT_RCDATA	0x5001cc	0x7d	empty			0
RT_RCDATA	0x50024c	0x7d	empty			0
RT_RCDATA	0x5002cc	0x7d	empty			0
RT_RCDATA	0x50034c	0x7d	empty			0
RT_RCDATA	0x5003cc	0x7d	empty			0
RT_RCDATA	0x50044c	0x3201	empty			0
RT_RCDATA	0x503650	0x3201	empty			0
RT_RCDATA	0x506854	0x3201	empty			0
RT_RCDATA	0x509a58	0x3201	empty			0
RT_RCDATA	0x50cc5c	0x3201	empty			0
RT_RCDATA	0x50fe60	0x3201	empty			0
RT_RCDATA	0x513064	0x3201	empty			0
RT_RCDATA	0x516268	0x3201	empty			0
RT_RCDATA	0x51946c	0x3201	empty			0
RT_RCDATA	0x51c670	0x3201	empty			0
RT_RCDATA	0x51f874	0x3201	empty			0
RT_RCDATA	0x522a78	0x3201	empty			0
RT_RCDATA	0x525c7c	0x3201	empty			0
RT_RCDATA	0x528e80	0x3201	empty			0
RT_RCDATA	0x52c084	0x3201	empty			0
RT_RCDATA	0x52f288	0x3201	empty			0
RT_RCDATA	0x53248c	0x3201	empty			0
RT_RCDATA	0x535690	0x3201	empty			0
RT_RCDATA	0x538894	0x3201	empty			0
RT_RCDATA	0x53ba98	0x3201	empty			0
RT_RCDATA	0x53ec9c	0x3201	empty			0
RT_RCDATA	0x541ea0	0x3201	empty			0
RT_RCDATA	0x5450a4	0x3201	empty			0
RT_RCDATA	0x5482a8	0x3201	empty			0
RT_RCDATA	0x54b4ac	0x3201	empty			0
RT_RCDATA	0x54e6b0	0x3201	empty			0
RT_RCDATA	0x5518b4	0x3201	empty			0
RT_RCDATA	0x554ab8	0x3201	empty			0
RT_RCDATA	0x557cbc	0x3201	empty			0
RT_RCDATA	0x55aec0	0x3201	empty			0
RT_RCDATA	0x55e0c4	0x3201	empty			0
RT_RCDATA	0x5612c8	0x3201	empty			0
RT_RCDATA	0x5644cc	0x3201	data			1.0008593078665728
RT_RCDATA	0x5676d0	0x3201	data			1.0008593078665728
RT_RCDATA	0x56a8d4	0x3201	data			1.0008593078665728
RT_RCDATA	0x56dad8	0x3201	data			1.0008593078665728
RT_RCDATA	0x570cdc	0x3201	data			1.0008593078665728
RT_RCDATA	0x573ee0	0x3201	data			1.0008593078665728
RT_RCDATA	0x5770e4	0x3201	data			1.0008593078665728
RT_RCDATA	0x57a2e8	0x3201	data			1.0008593078665728
RT_RCDATA	0x57d4ec	0x3201	data			1.0008593078665728
RT_RCDATA	0x5806f0	0x3201	data			1.0008593078665728
RT_RCDATA	0x5838f4	0x3201	data			1.0008593078665728
RT_RCDATA	0x586af8	0x3201	data			1.0008593078665728
RT_RCDATA	0x589cfc	0x3201	data			1.0008593078665728
RT_RCDATA	0x58cf00	0x3201	data			1.0008593078665728
RT_RCDATA	0x590104	0x3201	data			1.0008593078665728
RT_RCDATA	0x593308	0x3201	data			1.0008593078665728
RT_RCDATA	0x59650c	0x3201	data			1.0008593078665728
RT_RCDATA	0x599710	0x3201	data			1.0008593078665728
RT_RCDATA	0x59c914	0x3201	Dyalog APL external workspace version -15.-68			1.0008593078665728
RT_RCDATA	0x59fb18	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x5a2d1c	0x3201	Novell LANalyzer capture file			1.0008593078665728
RT_RCDATA	0x5a5f20	0x3201	data			1.0008593078665728
RT_RCDATA	0x5a9124	0x3201	data			1.0008593078665728
RT_RCDATA	0x5ac328	0x3201	data			1.0008593078665728
RT_RCDATA	0x5af52c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5b2730	0x3201	data			1.0008593078665728
RT_RCDATA	0x5b5934	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x5b8b38	0x3201	data			1.0008593078665728
RT_RCDATA	0x5bbd3c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5bef40	0x3201	data			1.0008593078665728
RT_RCDATA	0x5c2144	0x3201	data			1.0008593078665728
RT_RCDATA	0x5c5348	0x3201	data			1.0008593078665728
RT_RCDATA	0x5c854c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5cb750	0x3201	data			1.0008593078665728
RT_RCDATA	0x5ce954	0x3201	data			1.0008593078665728
RT_RCDATA	0x5d1b58	0x3201	data			1.0008593078665728
RT_RCDATA	0x5d4d5c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5d7f60	0x3201	data			1.0008593078665728
RT_RCDATA	0x5db164	0x3201	data			1.0008593078665728
RT_RCDATA	0x5de368	0x3201	data			1.0008593078665728
RT_RCDATA	0x5e156c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5e4770	0x3201	data			1.0008593078665728
RT_RCDATA	0x5e7974	0x3201	data			1.0008593078665728
RT_RCDATA	0x5eab78	0x3201	data			1.0008593078665728
RT_RCDATA	0x5edd7c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f0f80	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f4184	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f7388	0x3201	data			1.0008593078665728
RT_RCDATA	0x5fa58c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5fd790	0x3201	data			1.0008593078665728
RT_RCDATA	0x600994	0x3201	data			1.0008593078665728
RT_RCDATA	0x603b98	0x3201	data			1.0008593078665728
RT_RCDATA	0x606d9c	0x3201	data			1.0008593078665728
RT_RCDATA	0x609fa0	0x3201	data			1.0008593078665728
RT_RCDATA	0x60d1a4	0x3201	data			1.0008593078665728
RT_RCDATA	0x6103a8	0x3201	data			1.0008593078665728
RT_RCDATA	0x6135ac	0x3201	data			1.0008593078665728
RT_RCDATA	0x6167b0	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x6199b4	0x3201	data			1.0008593078665728
RT_RCDATA	0x61cbb8	0x3201	data			1.0008593078665728
RT_RCDATA	0x61fdbc	0x3201	data			1.0008593078665728
RT_RCDATA	0x622fc0	0x3201	data			1.0008593078665728
RT_RCDATA	0x6261c4	0x3201	data			1.0008593078665728
RT_RCDATA	0x6293c8	0x3201	data			1.0008593078665728
RT_RCDATA	0x62c5cc	0x3201	data			1.0008593078665728
RT_RCDATA	0x62f7d0	0x3201	data			1.0008593078665728
RT_RCDATA	0x6329d4	0x3201	data			1.0008593078665728
RT_RCDATA	0x635bd8	0x3201	data			1.0008593078665728
RT_RCDATA	0x638ddc	0x3201	data			1.0008593078665728
RT_RCDATA	0x63bfe0	0x3201	data			1.0008593078665728
RT_RCDATA	0x63f1e4	0x3201	data			1.0008593078665728
RT_RCDATA	0x6423e8	0x3201	data			1.0008593078665728
RT_RCDATA	0x6455ec	0x3201	data			1.0008593078665728
RT_RCDATA	0x6487f0	0x3201	data			1.0008593078665728
RT_RCDATA	0x64b9f4	0x3201	data			1.0008593078665728
RT_RCDATA	0x64ebf8	0x3201	data			1.0008593078665728
RT_RCDATA	0x651dfc	0x3201	data			1.0008593078665728
RT_RCDATA	0x655000	0x3201	data			1.0008593078665728
RT_RCDATA	0x658204	0x3201	data			1.0008593078665728
RT_RCDATA	0x65b408	0x3201	data			1.0008593078665728
RT_RCDATA	0x65e60c	0x3201	data			1.0008593078665728
RT_RCDATA	0x661810	0x3201	data			1.0008593078665728
RT_RCDATA	0x664a14	0x3201	data			1.0008593078665728
RT_RCDATA	0x667c18	0x3201	data			1.0008593078665728
RT_RCDATA	0x66ae1c	0x3201	data			1.0008593078665728
RT_RCDATA	0x66e020	0x3201	data			1.0008593078665728
RT_RCDATA	0x671224	0x3201	data			1.0008593078665728
RT_RCDATA	0x674428	0x3201	data			1.0008593078665728
RT_RCDATA	0x67762c	0x3201	data			1.0008593078665728
RT_RCDATA	0x67a830	0x3201	data			1.0008593078665728
RT_RCDATA	0x67da34	0x3201	data			1.0008593078665728
RT_RCDATA	0x680c38	0x3201	data			1.0008593078665728
RT_RCDATA	0x683e3c	0x3201	data			1.0008593078665728
RT_RCDATA	0x687040	0x3201	data			1.0008593078665728
RT_RCDATA	0x68a244	0x3201	data			1.0008593078665728
RT_RCDATA	0x68d448	0x3201	data			1.0008593078665728
RT_RCDATA	0x69064c	0x3201	data			1.0008593078665728
RT_RCDATA	0x693850	0x3201	OpenPGP Secret Key			1.0008593078665728
RT_RCDATA	0x696a54	0x3201	data			1.0008593078665728
RT_MANIFEST	0x6b5d20	0x2	data			5.0
RT_MANIFEST	0x6b5d28	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143
None	0x699de4	0x148	data			1.0335365853658536
None	0x699f2c	0x144	data			1.0339506172839505
None	0x69a070	0x114	data			1.039855072463768
None	0x69a184	0xc8	data			1.055
None	0x69a24c	0x16c	data			1.0302197802197801
None	0x69a3b8	0x11a	data			1.0390070921985815
None	0x69a4d4	0xce	data			1.0533980582524272
None	0x69a5a4	0xae	data			1.0632183908045978
None	0x69a654	0xcc	DOS executable (COM)			1.053921568627451
None	0x69a720	0xa8	data			1.0654761904761905
None	0x69a7c8	0x10a	data			1.0413533834586466
None	0x69a8d4	0xcc	data			1.053921568627451
None	0x69a9a0	0x114	data			1.039855072463768
None	0x69aab4	0x134	data			1.0357142857142858
None	0x69abe8	0xdc	data			1.05
None	0x69acc4	0x84	data			1.0833333333333333
None	0x69ad48	0xa0	data			1.06875
None	0x69ade8	0x64	COM executable for DOS			1.11
None	0x69ae4c	0xd2	data			1.0523809523809524
None	0x69af20	0x10c	data			1.041044776119403
None	0x69b02c	0x11a	data			1.0390070921985815
None	0x69b148	0xde	data			1.0495495495495495
None	0x69b228	0x18a	data			1.0279187817258884
None	0x69b3b4	0xac	data			1.063953488372093
None	0x69b460	0x150	data			1.0327380952380953
None	0x69b5b0	0x182	data			1.028497409326425
None	0x69b734	0x104	data			1.0423076923076924
None	0x69b838	0xea	data			1.047008547008547
None	0x69b924	0xc0	data			1.0572916666666667
None	0x69b9e4	0x116	data			1.039568345323741
None	0x69bafc	0x94	OpenPGP Public Key			1.0743243243243243
None	0x69bb90	0x180	data			1.0286458333333333
None	0x69bd10	0x16a	data			1.0303867403314917
None	0x69be7c	0x13a	data			1.035031847133758
None	0x69bfb8	0xd2	data			1.0523809523809524
None	0x69c08c	0x130	data			1.0361842105263157
None	0x69c1bc	0x84	data			1.0833333333333333
None	0x69c240	0xb2	data			1.0617977528089888
None	0x69c2f4	0xf2	data			1.0454545454545454
None	0x69c3e8	0xcc	data			1.053921568627451
None	0x69c4b4	0x96	data			1.0733333333333333
None	0x69c54c	0x13a	data			1.035031847133758
None	0x69c688	0x100	data			1.04296875
None	0x69c788	0xf8	data			1.0443548387096775
None	0x69c880	0x10a	data			1.0413533834586466
None	0x69c98c	0xd2	data			1.0523809523809524
None	0x69ca60	0x8c	data			1.0785714285714285
None	0x69caec	0xbe	data			1.0578947368421052
None	0x69cbac	0x114	data			1.039855072463768
None	0x69ccc0	0x7a	data			1.0901639344262295
None	0x69cd3c	0x90	data			1.0763888888888888
None	0x69cdcc	0x112	data			1.0401459854014599
None	0x69cee0	0x138	data			1.0352564102564104
None	0x69d018	0x12c	data			1.0366666666666666
None	0x69d144	0x9a	data			1.0714285714285714
None	0x69d1e0	0x12c	OpenPGP Secret Key			1.0366666666666666
None	0x69d30c	0xbe	data			1.0578947368421052
None	0x69d3cc	0xf8	data			1.0443548387096775
None	0x69d4c4	0x56	data			1.127906976744186
None	0x69d51c	0xe2	data			1.0486725663716814
None	0x69d600	0x140	data			1.034375
None	0x69d740	0xb8	data			1.059782608695652
None	0x69d7f8	0x128	data			1.037162162162162
None	0x69d920	0xe8	data			1.0474137931034482
None	0x69da08	0x9c	data			1.0705128205128205
None	0x69daa4	0x12e	data			1.0364238410596027
None	0x69dbd4	0xb0	data			1.0625
None	0x69dc84	0xf2	data			1.0454545454545454
None	0x69dd78	0xd4	data			1.0518867924528301
None	0x69de4c	0xf6	data			1.0447154471544715
None	0x69df44	0x11e	data			1.0384615384615385
None	0x69e064	0xc4	data			1.0561224489795917
None	0x69e128	0x10a	data			1.0413533834586466
None	0x69e234	0x90	data			1.0763888888888888
None	0x69e2c4	0xc0	data			1.0572916666666667
None	0x69e384	0x11c	data			1.0387323943661972
None	0x69e4a0	0x132	data			1.0359477124183007
None	0x69e5d4	0x128	data			1.037162162162162
None	0x69e6fc	0x72	data			1.0964912280701755
None	0x69e770	0x96	data			1.0733333333333333
None	0x69e808	0xcc	data			1.053921568627451
None	0x69e8d4	0xfa	data			1.044
None	0x69e9d0	0xa8	data			1.0654761904761905
None	0x69ea78	0xc0	data			1.0572916666666667
None	0x69eb38	0xde	data			1.0495495495495495
None	0x69ec18	0x10e	OpenPGP Secret Key			1.0407407407407407
None	0x69ed28	0x98	data			1.0723684210526316
None	0x69edc0	0x17a	data			1.029100529100529
None	0x69ef3c	0xd6	data			1.0514018691588785
None	0x69f014	0x9a	data			1.0714285714285714
None	0x69f0b0	0xf0	data			1.0458333333333334
None	0x69f1a0	0xea	data			1.047008547008547
None	0x69f28c	0x98	data			1.0723684210526316
None	0x69f324	0x78	data			1.0916666666666666
None	0x69f39c	0xf4	data			1.0450819672131149
None	0x69f490	0x120	data			1.0381944444444444
None	0x69f5b0	0xaa	data			1.0647058823529412
None	0x69f65c	0xc4	data			1.0561224489795917
None	0x69f720	0xc6	data			1.0555555555555556
None	0x69f7e8	0x66	data			1.107843137254902
None	0x69f850	0xec	data			1.0466101694915255
None	0x69f93c	0x134	data			1.0357142857142858
None	0x69fa70	0x5a	data			1.1222222222222222
None	0x69facc	0x8c	data			1.0785714285714285
None	0x69fb58	0xe4	data			1.0482456140350878
None	0x69fc3c	0x172	data			1.0297297297297296
None	0x69fdb0	0x11a	data			1.0390070921985815
None	0x69fecc	0xec	data			1.0466101694915255
None	0x69ffb8	0xe6	data			1.0478260869565217
None	0x6a00a0	0xb8	data			1.059782608695652
None	0x6a0158	0x128	data			1.037162162162162
None	0x6a0280	0x114	data			1.039855072463768
None	0x6a0394	0x132	data			1.0359477124183007
None	0x6a04c8	0xfe	data			1.0433070866141732
None	0x6a05c8	0x80	OpenPGP Secret Key			1.0859375
None	0x6a0648	0xca	data			1.0544554455445545
None	0x6a0714	0xdc	data			1.05
None	0x6a07f0	0x154	data			1.0323529411764707

Imports

DLL	Import
api-ms-win-crt-heap-l1-1-0.dll	free
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll	cosf
api-ms-win-crt-runtime-l1-1-0.dll	exit
api-ms-win-crt-stdio-l1-1-0.dll	fseek
api-ms-win-crt-string-l1-1-0.dll	strcmp
api-ms-win-crt-utility-l1-1-0.dll	qsort
d3d9.dll	Direct3DCreate9
IMM32.dll	ImmGetContext
KeRNeL32.dlL	LoadLibraryA, DeleteAtom, GetProcAddress, VirtualProtect
MSVCP140.dll	_Query_perf_counter
OLE32.Dll	CoTaskMemFree
SHELL32.dll	ShellExecuteA
USER32.dll	SetCursor
VCRUNTIME140.dll	memcpy
VCRUNTIME140_1.dll	__CxxFrameHandler4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T02:10:58.062907+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	104.26.9.59	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 02:10:55.792361021 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:55.792408943 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:55.792552948 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:55.801534891 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:55.801551104 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:57.030889034 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:57.030961990 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:57.687709093 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:57.687725067 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:57.688004971 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:57.688128948 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:57.691318035 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:57.735323906 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:58.062921047 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:58.062983990 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:58.062990904 CET	443	49704	104.26.9.59	192.168.2.5
Dec 8, 2024 02:10:58.063034058 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:58.064325094 CET	49704	443	192.168.2.5	104.26.9.59
Dec 8, 2024 02:10:58.064341068 CET	443	49704	104.26.9.59	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 02:10:55.544616938 CET	49221	53	192.168.2.5	1.1.1.1
Dec 8, 2024 02:10:55.772116899 CET	53	49221	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 02:10:55.544616938 CET	192.168.2.5	1.1.1.1	0x4de	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 02:10:55.772116899 CET	1.1.1.1	192.168.2.5	0x4de	No error (0)	api.myip.com	104.26.9.59	A (IP address)	IN (0x0001)	false
Dec 8, 2024 02:10:55.772116899 CET	1.1.1.1	192.168.2.5	0x4de	No error (0)	api.myip.com	104.26.8.59	A (IP address)	IN (0x0001)	false
Dec 8, 2024 02:10:55.772116899 CET	1.1.1.1	192.168.2.5	0x4de	No error (0)	api.myip.com	172.67.75.163	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.myip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.9.59	443	1488	C:\Users\user\Desktop\Nexus-Executor.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 01:10:57 UTC	182	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43 Host: api.myip.com
2024-12-08 01:10:58 UTC	777	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 01:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=82U0AHGo07uGnJ4ghDoxCK6Xs7Z9M0O7iOR4L3oDbFX8%2BFatuRRVB7FjqfXLSihlm7jscYCr%2BjFqlX6LGxSVAzIDZTGcOsb6LST5qVvk1YjLWOfQ1koUppbtLsYD8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8e0f39f5341ac-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1741&min_rtt=1736&rtt_var=662&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=820&delivery_rate=1639528&cwnd=252&unsent_bytes=0&cid=f8393dd680f1e335&ts=1036&x=0"
2024-12-08 01:10:58 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.228","country":"United States","cc":"US"}
2024-12-08 01:10:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:10:53
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\Nexus-Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Nexus-Executor.exe"
Imagebase:	0x7ff762a90000
File size:	1'393'194 bytes
MD5 hash:	1D5119509128D468DD629FFF653A096A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	9%
Signature Coverage:	25.8%
Total number of Nodes:	708
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF762AE4320 Relevance: 37.6, APIs: 7, Strings: 14, Instructions: 888
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHBrowseForFolder.SHELL32 ref: 00007FF762AE4705
SHGetPathFromIDList.SHELL32 ref: 00007FF762AE4732
CoTaskMemFree.OLE32 ref: 00007FF762AE4806
RemoveDirectoryA.KERNEL32 ref: 00007FF762AE4E7E
CreateDirectoryA.KERNEL32 ref: 00007FF762AE4E8E
MessageBoxA.USER32 ref: 00007FF762AE4EB3
ExitProcess.KERNEL32 ref: 00007FF762AE562A

Strings

C:\Users\user\Desktop\Nexus-Executor, xrefs: 00007FF762AE4740, 00007FF762AE4753, 00007FF762AE476F, 00007FF762AE47C7, 00007FF762AE4DB9, 00007FF762AE4E77, 00007FF762AE4E87
Loader, xrefs: 00007FF762AE4843, 00007FF762AE4FB2
continue, xrefs: 00007FF762AE5604
Fail, xrefs: 00007FF762AE4E9E
Nexus-Executor, xrefs: 00007FF762AE47A8
Install, xrefs: 00007FF762AE4E60
..., xrefs: 00007FF762AE46A9
Nexus-Executor, xrefs: 00007FF762AE4817, 00007FF762AE4F86
P, xrefs: 00007FF762AE46F2
installation..., xrefs: 00007FF762AE547A
destinatinal folder, xrefs: 00007FF762AE4D51
Failed to create setup directory, xrefs: 00007FF762AE4EA5
f, xrefs: 00007FF762AE43FE
choose install folder, xrefs: 00007FF762AE46E3

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Directory$BrowseCreateExitFolderFreeFromListMessagePathProcessRemoveTask
String ID: Loader$...$C:\Users\user\Desktop\Nexus-Executor$Fail$Failed to create setup directory$Install$Nexus-Executor$Nexus-Executor$P$choose install folder$continue$destinatinal folder$f$installation...
API String ID: 3810817069-333357129
Opcode ID: 2796e0ceb44c481c8094ebbb64c5a86d0a9228671a5d5b6b18e5b6bea70cc40e
Instruction ID: e7425f1baa8382dc21d264e844a27e94aa1c25514f18cf5929288545073998a4
Opcode Fuzzy Hash: 2796e0ceb44c481c8094ebbb64c5a86d0a9228671a5d5b6b18e5b6bea70cc40e
Instruction Fuzzy Hash: 14A2623191D686D5EBA0EB22E4507AAF360FF88340F844236DE8D57AA5DFBCE145CB50

Function 00007FF762ADF7A0 Relevance: 36.9, APIs: 7, Strings: 14, Instructions: 150
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF762ADF803
QueryPerformanceCounter.KERNEL32 ref: 00007FF762ADF819
GetKeyboardLayout.USER32 ref: 00007FF762ADF910
GetLocaleInfoA.KERNEL32 ref: 00007FF762ADF92C
LoadLibraryA.KERNEL32 ref: 00007FF762ADF9C5
GetProcAddress.KERNEL32 ref: 00007FF762ADF9FD
GetProcAddress.KERNEL32 ref: 00007FF762ADFA11

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762ADF94E
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF762ADF7E7
io.BackendPlatformUserData == nullptr && "Already initialized a platform backend!", xrefs: 00007FF762ADF7EE
xinput1_3.dll, xrefs: 00007FF762ADF983
xinput1_1.dll, xrefs: 00007FF762ADF9A7
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF762ADF7C3
XInputGetState, xrefs: 00007FF762ADFA03
xinput9_1_0.dll, xrefs: 00007FF762ADF98F
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762ADF7BC
i >= 0 && i < Size, xrefs: 00007FF762ADF955
xinput1_2.dll, xrefs: 00007FF762ADF99B
imgui_impl_win32, xrefs: 00007FF762ADF8D0
XInputGetCapabilities, xrefs: 00007FF762ADF9EF
xinput1_4.dll, xrefs: 00007FF762ADF977

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: AddressPerformanceProcQuery$CounterFrequencyInfoKeyboardLayoutLibraryLoadLocale
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$XInputGetCapabilities$XInputGetState$i >= 0 && i < Size$imgui_impl_win32$io.BackendPlatformUserData == nullptr && "Already initialized a platform backend!"$xinput1_1.dll$xinput1_2.dll$xinput1_3.dll$xinput1_4.dll$xinput9_1_0.dll
API String ID: 2839060773-805143068
Opcode ID: c0cd0a30def10a826129bf9a140cdbbcde0c23294fc851b4d240245f1bddf609
Instruction ID: c51e0993ebd9f7d6750c734075baef5161b1b00abb56eb32b7790e1069df084c
Opcode Fuzzy Hash: c0cd0a30def10a826129bf9a140cdbbcde0c23294fc851b4d240245f1bddf609
Instruction Fuzzy Hash: 66717E32A08F82D2DB94DF15E8406A9B3A5FB94B84F84513ACE8D43764EFBCE156C310

Function 00007FF762AE0330 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 182
keyboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32 ref: 00007FF762AE03B0
QueryPerformanceCounter.KERNEL32 ref: 00007FF762AE03EC
GetForegroundWindow.USER32 ref: 00007FF762AE0445
ClientToScreen.USER32 ref: 00007FF762AE047D
SetCursorPos.USER32 ref: 00007FF762AE048F
GetCursorPos.USER32 ref: 00007FF762AE04A9
ScreenToClient.USER32 ref: 00007FF762AE04BB
GetKeyState.USER32 ref: 00007FF762AE04FD
GetKeyState.USER32 ref: 00007FF762AE0544
GetKeyState.USER32 ref: 00007FF762AE058B
GetKeyState.USER32 ref: 00007FF762AE05D2

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AE0380
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF762AE035A, 00007FF762AE0431
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF762AE0387
bd != nullptr && "Context or backend not initialized? Did you call ImGui_ImplWin32_Init()?", xrefs: 00007FF762AE0361
bd->hWnd != 0, xrefs: 00007FF762AE0438

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: State$Client$CursorScreen$CounterForegroundPerformanceQueryRectWindow
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$bd != nullptr && "Context or backend not initialized? Did you call ImGui_ImplWin32_Init()?"$bd->hWnd != 0
API String ID: 1576454153-990843061
Opcode ID: 7959d9425d8ed27d20723f75cacdc1de561572c0acbd32c942e8bf78f96d5c61
Instruction ID: 02ab61a655a498617bc28506f17fa711fdcd55e0c505bf086e56a946cb8e0f2d
Opcode Fuzzy Hash: 7959d9425d8ed27d20723f75cacdc1de561572c0acbd32c942e8bf78f96d5c61
Instruction Fuzzy Hash: F991F331E08686D6FFA1EB25D444B79E3A0EF91784F888135DE8D16594CFECE482DB20

Function 00007FF762ADF2F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762ADF4C2
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ADF57D

Strings

, xrefs: 00007FF762ADF3DD
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762ADF319
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF762ADF320

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C610F020F61310
String ID: $C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"
API String ID: 310658293-1764846569
Opcode ID: 08d9d5ea9ef73e9ee21c9a9719e887cff1e7b3ffbb7639eb600bbac3b29985d2
Instruction ID: 35035b97a698b606f81f14e502354d4b154b843a5161f5def3ad28b626d65ee8
Opcode Fuzzy Hash: 08d9d5ea9ef73e9ee21c9a9719e887cff1e7b3ffbb7639eb600bbac3b29985d2
Instruction Fuzzy Hash: 3E919032705A81C6EB50DF25D4507AEB7A5FB88B88F844136DE4E87B64DFB8D445C710

Function 00007FF762AE3B90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_A.NTDLL ref: 00007FF762AE3DD0

Strings

E, xrefs: 00007FF762AE3D76

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: NtdllProc_Window
String ID: E
API String ID: 4255912815-3568589458
Opcode ID: f71ada217520157a8222c974fd66714a8a8b4378b5c258b324b72a7210dee7ba
Instruction ID: f8871a137b70389b3431bede8eab4119b06cb7e8ff9d75ec0efa62df194e017e
Opcode Fuzzy Hash: f71ada217520157a8222c974fd66714a8a8b4378b5c258b324b72a7210dee7ba
Instruction Fuzzy Hash: 53513131A0C782DAEBA09B15E4447BAF7A0FB85750F900535EACD82AA4DFFDD446DB10

Function 000001F78407F46A Relevance: 8.0, APIs: 5, Instructions: 519
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78407F47B
FindFirstFileA.KERNEL32 ref: 000001F78407F48B

Part of subcall function 000001F784055180: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784055217

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$FileFindFirst
String ID:
API String ID: 2113789597-0
Opcode ID: 36f8d388834b13250c1cd56afc24a702a3d02f2d48f31d1d6ce06cf885ec64b2
Instruction ID: 0dc62952390df613c1446996a4e5db854c562dcfce7360de595f03a0f7c839aa
Opcode Fuzzy Hash: 36f8d388834b13250c1cd56afc24a702a3d02f2d48f31d1d6ce06cf885ec64b2
Instruction Fuzzy Hash: C312DA3111CB498EE765EF24C499BEBB7E1FBD8340F404A6EA08AD31D2DE709944CB42

Function 000001F7841610E0 Relevance: 7.7, APIs: 5, Instructions: 166
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001F78416110D
Process32NextW.KERNEL32 ref: 000001F78416118F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7841611FC
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784161235
Process32NextW.KERNEL32 ref: 000001F7841612DE

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyNextProcess32Queue::StructuredWork$CreateSnapshotToolhelp32
String ID:
API String ID: 2993956496-0
Opcode ID: e5cb6cc2a9d3f2d857daf4add4d4784c79b02a268af29c56eed9b1a154788f6c
Instruction ID: f48cc5ac65b0a01c3c350f63bc0ee609ba163eabce035424aa2d91b894fb0b2f
Opcode Fuzzy Hash: e5cb6cc2a9d3f2d857daf4add4d4784c79b02a268af29c56eed9b1a154788f6c
Instruction Fuzzy Hash: 4851293051CB898BE3A5EF64C449BEBB7E1FBD4340F504A6DA08AD32E1DE709904CB42

Function 00007FF762ADEA60 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762ADED6F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762ADECA2, 00007FF762ADEE41, 00007FF762ADEE8F
i >= 0 && i < Size, xrefs: 00007FF762ADECA9, 00007FF762ADEE48, 00007FF762ADEE96

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 2490902527-1817040388
Opcode ID: b1eec2181c1e359eb28f9bbcb687503fb88331483defa231dfb92dd7bb477368
Instruction ID: c4cc6d31be2078af38ed9ba5aaf55a61df8eaa08b4f9f220e59deed3c1ec447e
Opcode Fuzzy Hash: b1eec2181c1e359eb28f9bbcb687503fb88331483defa231dfb92dd7bb477368
Instruction Fuzzy Hash: 97028936604B85C6DB60DF26D444AAEB7B5FB88B88F818626DF8D47764CF78D445CB00

Function 000001F784117750 Relevance: 4.7, APIs: 3, Instructions: 164encryptionCOMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7841177E6
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F784117864
CryptUnprotectData.CRYPT32 ref: 000001F7841178BD

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$CryptDataUnprotect
String ID:
API String ID: 3418212865-0
Opcode ID: 51fe853a7d2b22d5b21b9f7a4f3a10a826fa85b530eb29a0291643d65522cfaf
Instruction ID: a6492cef9d2430a6c24dd749da1fe3f088577a0049d78d95ef6a41f4be6c8edd
Opcode Fuzzy Hash: 51fe853a7d2b22d5b21b9f7a4f3a10a826fa85b530eb29a0291643d65522cfaf
Instruction Fuzzy Hash: AC518A7051CB898FE7A4EF28C4597EAB7E1FB98341F50496DA08DD32A1DB749884CB42

Function 00007FF762ADFCE0 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547d032ff03bed76e8d98501336aec72c7838b5fcf6afd06ef48b4c17f1abeb4
Instruction ID: 60bb5d31760892d7ff018c8a4e479bcc201f955d255d9dc12843b1506150bef9
Opcode Fuzzy Hash: 547d032ff03bed76e8d98501336aec72c7838b5fcf6afd06ef48b4c17f1abeb4
Instruction Fuzzy Hash: 16022D02D286BAC5FB92A6364441BFEA3918F6A344F5C8733ED59379D5DFDC6482C220

Function 00007FF762AE26C0 Relevance: 15.5, APIs: 10, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF762AE2818

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 13e46143c9bb452854fa26b528ea7cbc2fb7775d90ecdede2900193578d89e51
Instruction ID: b9e1746dd1315fd1e1033312ab0f48ce2db537709d9223549e8492486ea705ae
Opcode Fuzzy Hash: 13e46143c9bb452854fa26b528ea7cbc2fb7775d90ecdede2900193578d89e51
Instruction Fuzzy Hash: 8142B132609BC595DBA0AB15E8947AAB3A4FBC8B80F404536DACD47B69DFBCC045DB10

Function 00007FF762AE3DE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF762AE3E21
RegisterClassExA.USER32 ref: 00007FF762AE3E7A
GetSystemMetrics.USER32 ref: 00007FF762AE3E82
GetSystemMetrics.USER32 ref: 00007FF762AE3E9B
CreateWindowExA.USER32 ref: 00007FF762AE3F0D
ShowWindow.USER32 ref: 00007FF762AE3F26
UpdateWindow.USER32 ref: 00007FF762AE3F33

Strings

class001, xrefs: 00007FF762AE3E5A, 00007FF762AE3F04

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Window$MetricsSystem$ClassCreateHandleModuleRegisterShowUpdate
String ID: class001
API String ID: 3666473625-3656631403
Opcode ID: d0a26d07f94e715907fe1e9cd3793ffca38442d1c0a5227ed338969c9367bda1
Instruction ID: ca19499f5f5d3dff657e43ae94467d43665e3c8c0fc37fc9483558bec0b8f52d
Opcode Fuzzy Hash: d0a26d07f94e715907fe1e9cd3793ffca38442d1c0a5227ed338969c9367bda1
Instruction Fuzzy Hash: 70310C70909B42D6EB80AF20F85CB66B7A5FB84344F90413DE58D866A4CFFDE01AC750

Function 00007FF762AE6800 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00007FF762AE6A5D

Strings

v2.1.1 Setup, xrefs: 00007FF762AE6A13
v2.1.1 Setup!Before starting the installation, select the folder where the files will be installed, xrefs: 00007FF762AE69EE
FrghcZrah, xrefs: 00007FF762AE681B
A, xrefs: 00007FF762AE68E6
Welcome to , xrefs: 00007FF762AE69DA
Nexus-Executor, xrefs: 00007FF762AE69D3, 00007FF762AE6A1A

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Message
String ID: v2.1.1 Setup$ v2.1.1 Setup!Before starting the installation, select the folder where the files will be installed$A$FrghcZrah$Nexus-Executor$Welcome to
API String ID: 2030045667-3858696906
Opcode ID: ef12e5db93a373ac1250658159a1f333ca049569d580d89cb042698ec6e65b16
Instruction ID: ba7ea394ffc39ea971560c0b322a7955d663bda31f1e7d268ba1077b457b7d50
Opcode Fuzzy Hash: ef12e5db93a373ac1250658159a1f333ca049569d580d89cb042698ec6e65b16
Instruction Fuzzy Hash: 0B71632190DB82E1EFA0F715F4416AEE7A4EB84780F804435EACD43766DEECD146DB20

Function 00007FF762A9D4F0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762A9D7AB

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762A9D669, 00007FF762A9D6C7
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9D73D
off >= 4 && off < Buf.Size, xrefs: 00007FF762A9D670
p >= begin() && p < end(), xrefs: 00007FF762A9D6CE
it >= Data && it <= Data + Size, xrefs: 00007FF762A9D744

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$it >= Data && it <= Data + Size$off >= 4 && off < Buf.Size$p >= begin() && p < end()
API String ID: 2490902527-15920025
Opcode ID: 99790948f109f600e1c394ed64e3b1af4ee5b5b93923c2e74f6dfed6afc58ff6
Instruction ID: 15ae7f17aad12523a0712626a262b6b9bf903802a730c46536c16aa94cc74cbc
Opcode Fuzzy Hash: 99790948f109f600e1c394ed64e3b1af4ee5b5b93923c2e74f6dfed6afc58ff6
Instruction Fuzzy Hash: FF91E172B28A46C6EF94BF26D8409B8B360FB44B84B944135CE4E47794DFBCE891C720

Function 000001F784056FE0 Relevance: 6.7, APIs: 4, Instructions: 693
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F78405A110: char_traits.LIBCPMTD ref: 000001F78405A13D

std::_Fac_node::_Fac_node.LIBCPMTD ref: 000001F78405754F
CreateToolhelp32Snapshot.KERNEL32 ref: 000001F7840575C4
Process32FirstW.KERNEL32 ref: 000001F78405764B
Process32NextW.KERNEL32 ref: 000001F7840577AB

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Process32$CreateFac_nodeFac_node::_FirstNextSnapshotToolhelp32char_traitsstd::_
String ID:
API String ID: 4114415025-0
Opcode ID: 2cf1e73a0f9107235ddbfb485c3595bfcba21e3825775f53e0b531762a104419
Instruction ID: b23d0f864309b40795a918edc9e6706d9a1d4796dd048f4a6eb7b1fea0871be9
Opcode Fuzzy Hash: 2cf1e73a0f9107235ddbfb485c3595bfcba21e3825775f53e0b531762a104419
Instruction Fuzzy Hash: B1321B3221CA494BE755FF38C4697EBB2D2FB98340F9109BEA14AD31D2EE719944CB41

Function 000001F784139E50 Relevance: 4.7, APIs: 3, Instructions: 233fileCOMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F784139EF0

Part of subcall function 000001F784086A80: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784086AAB
Part of subcall function 000001F784086A80: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784086ABA

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784139F56
CreateFileA.KERNEL32 ref: 000001F784139F82

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFiletype_info::_name_internal_method
String ID:
API String ID: 645652700-0
Opcode ID: f64b6eb87d80957077a350099af48cbfcdfbf435f0acf51f21d504348669a5e4
Instruction ID: c1ed20b483ed68a7d38d930bdbd5061a522bcc1f3c00d9a4f3393185f23cfb20
Opcode Fuzzy Hash: f64b6eb87d80957077a350099af48cbfcdfbf435f0acf51f21d504348669a5e4
Instruction Fuzzy Hash: C781403061CB498FE794EF68D859BEAB7E1FB98350F404A6DA049C32D1DE79D845CB02

Function 000001F784054740 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405476C
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405477E

Part of subcall function 000001F7840553C0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840553DD

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840547BB

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 2bd40488f3e532a51d24b491183ad7726d9c7802e0b56b6519047ab1d83811bb
Instruction ID: 98155c9e6172c2a4d85f514dde2297741fb5d41d2103836ff2de541f70c6e5d6
Opcode Fuzzy Hash: 2bd40488f3e532a51d24b491183ad7726d9c7802e0b56b6519047ab1d83811bb
Instruction Fuzzy Hash: D031DC7052CB888FD794EF28C449BABF7E1FB94340F81496DB0C9D22A5DBB0A444CB42

Function 000001F78413A470 Relevance: 4.6, APIs: 3, Instructions: 80fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78413A4B6
CreateFileA.KERNEL32 ref: 000001F78413A4E5
ReadFile.KERNEL32 ref: 000001F78413A514

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: 02f2dc65f8decb4645fb847ec84ab164623bd49ce40520f2aa61d7a6ee298412
Instruction ID: fad00b1da9617d80bd8a90c6072497a42bb0367d759920c2ec60a91d8f0b8cf6
Opcode Fuzzy Hash: 02f2dc65f8decb4645fb847ec84ab164623bd49ce40520f2aa61d7a6ee298412
Instruction Fuzzy Hash: EB21C770618B888FD794EF2CC498B9ABBE0FB99344F50491DE489C32A0DB75D844CB42

Function 000001F78413A3D0 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78413A3F7
CreateFileA.KERNEL32 ref: 000001F78413A426
ReadFile.KERNEL32 ref: 000001F78413A44E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: 58da95cd914e928df27caef5f136864f76f7d90ee48b638eaa7250070e662160
Instruction ID: e4a1ee60c164570e9c96ec83d82756585a9c243d08da9cca3922560321b9489c
Opcode Fuzzy Hash: 58da95cd914e928df27caef5f136864f76f7d90ee48b638eaa7250070e662160
Instruction Fuzzy Hash: 2101D37461CB888FD744EF28C49971ABBE1FB99345F50091DF48AC32A0DB79D945CB42

Function 00007FF762AE4140 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32 ref: 00007FF762AE4159
TranslateMessage.USER32 ref: 00007FF762AE4168
DispatchMessageA.USER32 ref: 00007FF762AE4173

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 592db406a15101d98d1bfc7a93d39be7e429bab12ec8d4365a76516f4c6005f4
Instruction ID: f1aa2681dfa295dd5ead749061b049c9cde6f495232805893a7137f802752425
Opcode Fuzzy Hash: 592db406a15101d98d1bfc7a93d39be7e429bab12ec8d4365a76516f4c6005f4
Instruction Fuzzy Hash: C1015E2192C592E6FF907B20A855F7AE664AF91341FD01031EACE41895DFECD04AEB30

Function 00007FF762AC21B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC236B

Strings

gfff, xrefs: 00007FF762AC21F0

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: gfff
API String ID: 1173767890-1553575800
Opcode ID: bd7c02e19e7797869487961a1e51ca7333e1f9954b24b3a2c72c06caf69b2669
Instruction ID: 560e5a6e9beb51606e2fbfe69935e793261ef3646542b2cecad57741564891a7
Opcode Fuzzy Hash: bd7c02e19e7797869487961a1e51ca7333e1f9954b24b3a2c72c06caf69b2669
Instruction Fuzzy Hash: E0519A23708BC586DB458F2899116BDFBB1F788B40F8D8235DA48877A9CB7CD155C700

Function 00007FF762AE3F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

00007FF8A8DA5F50.D3D9 ref: 00007FF762AE3F7B

Strings

@, xrefs: 00007FF762AE400A

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007
String ID: @
API String ID: 3568877910-2766056989
Opcode ID: 73d6871cf4131e7e7e3c516ea5bb2b6940c2de2e4e255355f0021467e71eb675
Instruction ID: 538d212f197d33c86ee6e07026e8fa78c6f93d9a2def99b71dead1404672235e
Opcode Fuzzy Hash: 73d6871cf4131e7e7e3c516ea5bb2b6940c2de2e4e255355f0021467e71eb675
Instruction Fuzzy Hash: 36110A70E08606D5FF80AB01E80CBB5A7A0BB54784F90413DD94D577A0DFFDA16ACB20

Function 000001F78413A2F0 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78413A310
CreateFileA.KERNEL32 ref: 000001F78413A33F

Part of subcall function 000001F78405A170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405A18D

Part of subcall function 000001F784139E50: type_info::_name_internal_method.LIBCMTD ref: 000001F784139EF0
Part of subcall function 000001F784139E50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784139F56
Part of subcall function 000001F784139E50: CreateFileA.KERNEL32 ref: 000001F784139F82

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFile$type_info::_name_internal_method
String ID:
API String ID: 2627539804-0
Opcode ID: 98ea87f00965d57ac3efe53a622e5d3c7e907a059cd269744f0d00fbdf9eee7f
Instruction ID: 9ca926d551f565682c5df73a16427c933e6ea0623520bb1967d9e8c9f81e57c5
Opcode Fuzzy Hash: 98ea87f00965d57ac3efe53a622e5d3c7e907a059cd269744f0d00fbdf9eee7f
Instruction Fuzzy Hash: E0111E7061CB898FD794EF28C44976AB7E1FBD9341F40492DE08DC3291DB79C8458B42

Function 00007FF762AEBB9C Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_RTC_Initialize.LIBCMT ref: 00007FF762AEBBD4
00007FF8C6121B20.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF762AEBC20

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C6121Initialize
String ID:
API String ID: 2978892875-0
Opcode ID: d68fa1dd1f25c5d9833bb5b41399011af0f0bca26c4982c59452d0f3d9cb9bed
Instruction ID: bb15d092f393c3b98f50a322223889ad005f78dab2a834525725d13c9eb43a42
Opcode Fuzzy Hash: d68fa1dd1f25c5d9833bb5b41399011af0f0bca26c4982c59452d0f3d9cb9bed
Instruction Fuzzy Hash: 0D119C45E48243E2FFD477B1455AAB8C9465F95740FC40930ED9D462C3EDDCA983E232

Function 00007FF762AEBB34 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF762AEBB64

Part of subcall function 00007FF762AEC368: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF762AEC371

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF762AEBB6A

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: f263315650486d802dc5ceafc5012ad1b5bad17f869d85328af45017b7dfee40
Instruction ID: f4340e4aa909211d3bf2ec088bbd52e608a8230dbc41c198a4961b912cea8d52
Opcode Fuzzy Hash: f263315650486d802dc5ceafc5012ad1b5bad17f869d85328af45017b7dfee40
Instruction Fuzzy Hash: 11F09A10E19307E0FFA97665241A9B88101AF08770F980B30DEFC093C6EEDCA497E230

Function 00007FF762AE1B90 Relevance: 1.7, APIs: 1, Instructions: 199libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF762AE1DDE

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0687a482410035a8978432453c5d728bbb6bc986c65ef01f96900fa291c08832
Instruction ID: 09159b990cf086fefa956e09e051fdb11c60ff82f264b2fbeb568757c8d9a959
Opcode Fuzzy Hash: 0687a482410035a8978432453c5d728bbb6bc986c65ef01f96900fa291c08832
Instruction Fuzzy Hash: B6A19436619B84C6DBA0DB1AE49072AB7A4F7C8B94F504125EECE83B68DF7CD451DB00

Function 000001F78417F2BC Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001F78417F2EC

Part of subcall function 000001F78417FD70: std::bad_alloc::bad_alloc.LIBCMTD ref: 000001F78417FD79

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 40e99fc6ce4dc2d146cdf7f013a5a6f8ee3dd898e06d9c12abdcb6339ef11b74
Instruction ID: 09173b3d28c6ef698e3dc20b89734112aaf33b5e0f4b55e168041909741639f6
Opcode Fuzzy Hash: 40e99fc6ce4dc2d146cdf7f013a5a6f8ee3dd898e06d9c12abdcb6339ef11b74
Instruction Fuzzy Hash: 7B014B34A3D90F4AFA98AE75A98D3FA2AD5BB483C1F94143CD515C61DAE994CC81C111

Function 00007FF762AEB780 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF762AEB7A3

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 68dcdc5df13b1305609106057423c5647b76bdd97cd7c73a0b3a13548c0169f4
Instruction ID: a4e47060dacc178d6c841dc7d889b6db3c384ec0b20c3a0e35a8b96e41b41373
Opcode Fuzzy Hash: 68dcdc5df13b1305609106057423c5647b76bdd97cd7c73a0b3a13548c0169f4
Instruction Fuzzy Hash: 96014061619F41D1DBA0AB18E445A2AF3A4FF88798F800734EADD42B94DFBCD511DB14

Non-executed Functions

Function 00007FF762AD6090 Relevance: 58.2, APIs: 5, Strings: 26, Instructions: 3919COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF762A9CB20: __swprintf_l.LIBCMT ref: 00007FF762A9CC55

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD6942
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD69E9
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD8B07

Strings

font->ContainerAtlas->TexID == _CmdHeader.TextureId, xrefs: 00007FF762AD92A9, 00007FF762AD9B64
IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease))), xrefs: 00007FF762AD6C39, 00007FF762AD6CA8, 00007FF762AD6CE5, 00007FF762AD6D27, 00007FF762AD6D64, 00007FF762AD6DAF, 00007FF762AD7714, 00007FF762AD77AA, 00007FF762AD78C8, 00007FF762AD7976, 00007FF762AD7A08, 00007FF762AD7AA4, 00007FF762AD7B4B, 00007FF762AD7BF2, 00007FF762AD7C2C, 00007FF762AD7CDA
g.DragDropActive || g.ActiveId == id || g.ActiveId == 0 || g.ActiveIdPreviousFrame == id || (g.CurrentMultiSelect != 0 && g.BoxSel, xrefs: 00007FF762ADA0A6
buf[0] != 0, xrefs: 00007FF762AD88BC
state != 0, xrefs: 00007FF762AD6FCC, 00007FF762AD761C, 00007FF762AD887E, 00007FF762AD9355
callback_data.BufSize == state->BufCapacity, xrefs: 00007FF762AD8BA6
@, xrefs: 00007FF762ADA0BA
!((flags & ImGuiInputTextFlags_CallbackCompletion) && (flags & ImGuiInputTextFlags_AllowTabInput)), xrefs: 00007FF762AD617D
apply_new_text_length >= 0, xrefs: 00007FF762AD8E9B
callback_data.Buf == callback_buf, xrefs: 00007FF762AD8B83
i >= 0 && i < Size, xrefs: 00007FF762AD7134, 00007FF762AD7227, 00007FF762AD7546
!((flags & ImGuiInputTextFlags_CallbackHistory) && (flags & ImGuiInputTextFlags_Multiline)), xrefs: 00007FF762AD6155
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AD712D, 00007FF762AD7220, 00007FF762AD753F
callback_data.BufTextLen == (int)strlen(callback_data.Buf), xrefs: 00007FF762AD8C70
callback_data.Flags == flags, xrefs: 00007FF762AD8BC9
#SCROLLY, xrefs: 00007FF762AD67C1, 00007FF762AD67F0, 00007FF762AD9E36
%*s%.*s, xrefs: 00007FF762AD9FA0
state && state->ID == id, xrefs: 00007FF762AD6B9F
buf != 0 && buf_size >= 0, xrefs: 00007FF762AD612D
idx <= obj->TextLen, xrefs: 00007FF762AD7110, 00007FF762AD7203
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AD6C32, 00007FF762AD6CA1, 00007FF762AD6CDE, 00007FF762AD6D20, 00007FF762AD6D5D, 00007FF762AD6DA8, 00007FF762AD770D, 00007FF762AD77A3, 00007FF762AD78C1, 00007FF762AD796F, 00007FF762AD7A01, 00007FF762AD7A9D, 00007FF762AD7B44, 00007FF762AD7BEB, 00007FF762AD7C25, 00007FF762AD7CD3, 00007FF762ADA09F
callback != 0, xrefs: 00007FF762AD674D, 00007FF762AD89AB
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AD92A2, 00007FF762AD9B5D
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762AD6126, 00007FF762AD614E, 00007FF762AD6176, 00007FF762AD6746, 00007FF762AD6B98, 00007FF762AD6F3E, 00007FF762AD6FC5, 00007FF762AD7109, 00007FF762AD71FC, 00007FF762AD7615, 00007FF762AD8877, 00007FF762AD88B5, 00007FF762AD89A4, 00007FF762AD8B7C, 00007FF762AD8B9F, 00007FF762AD8BC2, 00007FF762AD8C69, 00007FF762AD8E94, 00007FF762AD8F51, 00007FF762AD934E
password_font->Glyphs.empty() && password_font->IndexAdvanceX.empty() && password_font->IndexLookup.empty(), xrefs: 00007FF762AD6F45
apply_new_text_length <= buf_size, xrefs: 00007FF762AD8F58

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310$__swprintf_l
String ID: !((flags & ImGuiInputTextFlags_CallbackCompletion) && (flags & ImGuiInputTextFlags_AllowTabInput))$!((flags & ImGuiInputTextFlags_CallbackHistory) && (flags & ImGuiInputTextFlags_Multiline))$#SCROLLY$%*s%.*s$@$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease)))$apply_new_text_length <= buf_size$apply_new_text_length >= 0$buf != 0 && buf_size >= 0$buf[0] != 0$callback != 0$callback_data.Buf == callback_buf$callback_data.BufSize == state->BufCapacity$callback_data.BufTextLen == (int)strlen(callback_data.Buf)$callback_data.Flags == flags$font->ContainerAtlas->TexID == _CmdHeader.TextureId$g.DragDropActive || g.ActiveId == id || g.ActiveId == 0 || g.ActiveIdPreviousFrame == id || (g.CurrentMultiSelect != 0 && g.BoxSel$i >= 0 && i < Size$idx <= obj->TextLen$password_font->Glyphs.empty() && password_font->IndexAdvanceX.empty() && password_font->IndexLookup.empty()$state != 0$state && state->ID == id
API String ID: 2185106832-4266151527
Opcode ID: 2e47b44ae7e68c9b264366a916df0331105604c339e4ebef53baa41483c6feeb
Instruction ID: 9411023a085fc5cbdbc4de5a03d43018e48c34486f9b9ea6f20e032ecf0c8f53
Opcode Fuzzy Hash: 2e47b44ae7e68c9b264366a916df0331105604c339e4ebef53baa41483c6feeb
Instruction Fuzzy Hash: 4A93F532A08686CAEB90EF35D444AB9B7A0FF59788F848635DE4C17695CFF8E445CB10

Function 00007FF762A99E10 Relevance: 50.0, APIs: 3, Strings: 25, Instructions: 1049COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762A99F42
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A9AA84
00007FF8C612A0D0.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF762A9AEDF

Strings

Left, xrefs: 00007FF762A9AD0F
it >= Data && it < Data + Size, xrefs: 00007FF762A99F07
Right, xrefs: 00007FF762A9AD1B
333?, xrefs: 00007FF762A9ACDE
Debug##Default, xrefs: 00007FF762A9AFCA
GetCurrentWindowRead()->Flags & ImGuiWindowFlags_Tooltip, xrefs: 00007FF762A9AD9C
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF762A99E54
HoveredId: 0x%08X, xrefs: 00007FF762A9ACF7
g.WindowsFocusOrder.Size <= g.Windows.Size, xrefs: 00007FF762A9A584
g.MovingWindow && g.MovingWindow->RootWindow, xrefs: 00007FF762A9A6D0
Middle, xrefs: 00007FF762A9AD27
g.Viewports.Size == 1, xrefs: 00007FF762A9A0FE
g.Font->IsLoaded(), xrefs: 00007FF762A9A274
i >= 0 && i < Size, xrefs: 00007FF762A99E96, 00007FF762A99ECA, 00007FF762A9A121, 00007FF762A9A241, 00007FF762A9A8F5, 00007FF762A9A92C, 00007FF762A9A95F, 00007FF762A9AAFA
Size > 0, xrefs: 00007FF762A9ABDE
g.CurrentWindow->IsFallbackWindow == true, xrefs: 00007FF762A9B026
Click %s Button to break in debugger! (remap w/ Ctrl+Shift), xrefs: 00007FF762A9AD51
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A99E8F, 00007FF762A99EC3, 00007FF762A99F00, 00007FF762A9A11A, 00007FF762A9A23A, 00007FF762A9A8EE, 00007FF762A9A925, 00007FF762A9A958, 00007FF762A9AAF3, 00007FF762A9ABD7
Press ESC to abort picking., xrefs: 00007FF762A9AD03
NewFrame(): ClearActiveID() because it isn't marked alive anymore!, xrefs: 00007FF762A9A3C3
gfff, xrefs: 00007FF762A9B114
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A99E4D, 00007FF762A9A0F7, 00007FF762A9A26D, 00007FF762A9A57D, 00007FF762A9A6C9, 00007FF762A9A70E, 00007FF762A9AD95, 00007FF762A9B01F
(Debug Log: Auto-disabled some ImGuiDebugLogFlags after 2 frames), xrefs: 00007FF762A9AFA2
Remap w/ Ctrl+Shift: click anywhere to select new mouse button., xrefs: 00007FF762A9AD3B
GImGui != 0, xrefs: 00007FF762A9A715

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C610C612F020F61310
String ID: (Debug Log: Auto-disabled some ImGuiDebugLogFlags after 2 frames)$333?$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$Click %s Button to break in debugger! (remap w/ Ctrl+Shift)$Debug##Default$GImGui != 0$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$GetCurrentWindowRead()->Flags & ImGuiWindowFlags_Tooltip$HoveredId: 0x%08X$Left$Middle$NewFrame(): ClearActiveID() because it isn't marked alive anymore!$Press ESC to abort picking.$Remap w/ Ctrl+Shift: click anywhere to select new mouse button.$Right$Size > 0$g.CurrentWindow->IsFallbackWindow == true$g.Font->IsLoaded()$g.MovingWindow && g.MovingWindow->RootWindow$g.Viewports.Size == 1$g.WindowsFocusOrder.Size <= g.Windows.Size$gfff$i >= 0 && i < Size$it >= Data && it < Data + Size
API String ID: 2611590445-8291574
Opcode ID: 67dd819bf459e58f4dc24f307201e7a997b3b530ade4f3c3acdfb8b4452a2f7a
Instruction ID: a4951c2ac570bbe0ce5cae9e9bdc6a675cfd764abdec00a733674229b05a0745
Opcode Fuzzy Hash: 67dd819bf459e58f4dc24f307201e7a997b3b530ade4f3c3acdfb8b4452a2f7a
Instruction Fuzzy Hash: 3CC2C032E146C2C9DFA1EF36C8446E8B7A1FF54748F948236DE085B6A5DFB8A541C720

Function 00007FF762AC25F0 Relevance: 41.9, APIs: 9, Strings: 14, Instructions: 1603COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC3F7F
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC4005

Strings

font_offset >= 0 && "FontData is incorrect, or FontNo cannot be found.", xrefs: 00007FF762AC28CC
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AC27B9, 00007FF762AC27DE, 00007FF762AC2864, 00007FF762AC290A, 00007FF762AC2A12, 00007FF762AC2F5E, 00007FF762AC2FA1, 00007FF762AC2FE6, 00007FF762AC3128, 00007FF762AC369D, 00007FF762AC39DD, 00007FF762AC3B38
n < (Storage.Size << 5), xrefs: 00007FF762AC2B57, 00007FF762AC2BB3, 00007FF762AC2BE5
glyph_index_in_font != 0, xrefs: 00007FF762AC3163
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762AC2B50, 00007FF762AC2BAC, 00007FF762AC2BDE
0 && "stbtt_InitFont(): failed to parse FontData. It is correct and complete? Check FontDataSize.", xrefs: 00007FF762AC2A58
cfg.DstFont && (!cfg.DstFont->IsLoaded() || cfg.DstFont->ContainerAtlas == atlas), xrefs: 00007FF762AC2821
atlas->ConfigData.Size > 0, xrefs: 00007FF762AC2635
i >= 0 && i < Size, xrefs: 00007FF762AC27C0, 00007FF762AC27E5, 00007FF762AC286B, 00007FF762AC2911, 00007FF762AC2A19, 00007FF762AC2F65, 00007FF762AC2FA8, 00007FF762AC2FED, 00007FF762AC312F, 00007FF762AC36A4, 00007FF762AC39E4, 00007FF762AC3B3F
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC262E, 00007FF762AC281A, 00007FF762AC28C5, 00007FF762AC295A, 00007FF762AC2A5F, 00007FF762AC2A80, 00007FF762AC2D4C, 00007FF762AC315C, 00007FF762AC3ABA
src_range[0] <= src_range[1] && "Invalid range: is your glyph range array persistent? it is zero-terminated?", xrefs: 00007FF762AC2961
src_tmp.GlyphsList.Size == src_tmp.GlyphsCount, xrefs: 00007FF762AC2D53
font->ConfigData == font_config, xrefs: 00007FF762AC3AC1
src_tmp.DstIndex != -1, xrefs: 00007FF762AC2A79

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: 0 && "stbtt_InitFont(): failed to parse FontData. It is correct and complete? Check FontDataSize."$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$atlas->ConfigData.Size > 0$cfg.DstFont && (!cfg.DstFont->IsLoaded() || cfg.DstFont->ContainerAtlas == atlas)$font->ConfigData == font_config$font_offset >= 0 && "FontData is incorrect, or FontNo cannot be found."$glyph_index_in_font != 0$i >= 0 && i < Size$n < (Storage.Size << 5)$src_range[0] <= src_range[1] && "Invalid range: is your glyph range array persistent? it is zero-terminated?"$src_tmp.DstIndex != -1$src_tmp.GlyphsList.Size == src_tmp.GlyphsCount
API String ID: 1173767890-2192739418
Opcode ID: 80a92c5cf435319950cd35234684aa65eed7adde482fdeb0840858b163b0eb86
Instruction ID: 25542e7f8c577535f608c933b4645a7dfd5a39578b56a9fb671e91904174a830
Opcode Fuzzy Hash: 80a92c5cf435319950cd35234684aa65eed7adde482fdeb0840858b163b0eb86
Instruction Fuzzy Hash: B2F21732B04A86C6EB95EF25D484ABDB7A0FB58744F848236CE4D57760DFB8E446CB10

Function 00007FF762A97390 Relevance: 26.8, APIs: 10, Strings: 5, Instructions: 530COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A975A9
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A9767F
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97776
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97807
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A978BC
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97965
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A979F6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97AB5
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97B84
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97C89

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A973C9, 00007FF762A97407
Forgot to shutdown Platform backend?, xrefs: 00007FF762A973A9
(g.IO.BackendRendererUserData == 0) && "Forgot to shutdown Renderer backend?", xrefs: 00007FF762A9740E
(g.IO.BackendPlatformUserData == 0) && "Forgot to shutdown Platform backend?", xrefs: 00007FF762A973D0
Forgot to shutdown Renderer backend?, xrefs: 00007FF762A973E7

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: (g.IO.BackendPlatformUserData == 0) && "Forgot to shutdown Platform backend?"$(g.IO.BackendRendererUserData == 0) && "Forgot to shutdown Renderer backend?"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Forgot to shutdown Platform backend?$Forgot to shutdown Renderer backend?
API String ID: 1173767890-2716422499
Opcode ID: 96087274a65a48a19f2292afb59cc2bb9d0ee349fad39154f4d4ad274d245eb9
Instruction ID: 32d8377ee7278e6f1f20fb10339a5148e870294abaf67db73764e6c7e5eb8b8f
Opcode Fuzzy Hash: 96087274a65a48a19f2292afb59cc2bb9d0ee349fad39154f4d4ad274d245eb9
Instruction Fuzzy Hash: 3B42BE72A18A82D2CB49EF24C9585FCB3A5FB54B84F984136CF0D4B654DFB8E566C320

Function 00007FF762AC97F0 Relevance: 24.4, Strings: 19, Instructions: 617COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AC9957, 00007FF762AC9B22, 00007FF762AC9EDD, 00007FF762AC9F2E, 00007FF762ACA278, 00007FF762ACA2BE
inner_window == g.CurrentWindow, xrefs: 00007FF762AC989F
table != 0 && "Only call EndTable() if BeginTable() returns true!", xrefs: 00007FF762AC984D
Too many PopItemWidth!, xrefs: 00007FF762AC9F83
Calling PopStyleColor() too many times!, xrefs: 00007FF762AC97F7
Mismatching PushID/PopID!, xrefs: 00007FF762AC9F0F
(inner_window->IDStack.back() == table_instance->TableInstanceID) && "Mismatching PushID/PopID!", xrefs: 00007FF762AC9F65
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762AC9A9E, 00007FF762AC9C1E, 00007FF762AC9DB3, 00007FF762AC9E3D, 00007FF762ACA340
(table->Flags & ImGuiTableFlags_ScrollX) == 0, xrefs: 00007FF762ACA0EC
i >= 0 && i < Size, xrefs: 00007FF762AC995E, 00007FF762ACA27F, 00007FF762ACA2C5
table->RowPosY2 == inner_window->DC.CursorPos.y, xrefs: 00007FF762AC99D4
(outer_window->DC.ItemWidthStack.Size >= temp_data->HostBackupItemWidthStackSize) && "Too many PopItemWidth!", xrefs: 00007FF762AC9FB1
g.CurrentWindow == outer_window && g.CurrentTable == table, xrefs: 00007FF762ACA224
Size > 0, xrefs: 00007FF762AC9B29, 00007FF762AC9EE4, 00007FF762AC9F35
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF762AC9846, 00007FF762AC9898, 00007FF762AC98C0, 00007FF762AC99CD, 00007FF762AC9F5E, 00007FF762AC9FAA, 00007FF762ACA0E5, 00007FF762ACA21D, 00007FF762ACA240
p >= Buf.Data && p < Buf.Data + Buf.Size, xrefs: 00007FF762ACA347
outer_window == inner_window || outer_window == inner_window->ParentWindow, xrefs: 00007FF762AC98C7
g.TablesTempDataStacked > 0, xrefs: 00007FF762ACA247
p >= Data && p < DataEnd, xrefs: 00007FF762AC9AA5, 00007FF762AC9C25, 00007FF762AC9DBA, 00007FF762AC9E44

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: (inner_window->IDStack.back() == table_instance->TableInstanceID) && "Mismatching PushID/PopID!"$(outer_window->DC.ItemWidthStack.Size >= temp_data->HostBackupItemWidthStackSize) && "Too many PopItemWidth!"$(table->Flags & ImGuiTableFlags_ScrollX) == 0$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$Calling PopStyleColor() too many times!$Mismatching PushID/PopID!$Size > 0$Too many PopItemWidth!$g.CurrentWindow == outer_window && g.CurrentTable == table$g.TablesTempDataStacked > 0$i >= 0 && i < Size$inner_window == g.CurrentWindow$outer_window == inner_window || outer_window == inner_window->ParentWindow$p >= Buf.Data && p < Buf.Data + Buf.Size$p >= Data && p < DataEnd$table != 0 && "Only call EndTable() if BeginTable() returns true!"$table->RowPosY2 == inner_window->DC.CursorPos.y
API String ID: 0-2342475368
Opcode ID: c7d7ccd073aa28cc0a8da63f02696dfd21ea439c566dee167eb27b63e243ea54
Instruction ID: 4d6041e21467af1d5cda47b00e5b955656a0baa6b76f18a7479ed15860173288
Opcode Fuzzy Hash: c7d7ccd073aa28cc0a8da63f02696dfd21ea439c566dee167eb27b63e243ea54
Instruction Fuzzy Hash: 0772B432A08A86D6EB95DB36C544BF8B360FF55744F888232DE49132A1DFF8B595CB10

Function 00007FF762ADCB40 Relevance: 23.8, APIs: 4, Strings: 9, Instructions: 1043COMMON

Download Yara Rule

APIs

00007FF8C61149A0.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF762ADCE46
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762ADCF53
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762ADD049
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ADD0CA

Strings

tab->NameOffset < tab_bar->TabsNames.Buf.Size, xrefs: 00007FF762ADD1D0
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762ADD9D0
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762ADCC00, 00007FF762ADCC4B, 00007FF762ADCC7E, 00007FF762ADCCD1, 00007FF762ADCD30, 00007FF762ADD125, 00007FF762ADD27C, 00007FF762ADD449, 00007FF762ADD477, 00007FF762ADD4A7, 00007FF762ADD5CC
IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease))), xrefs: 00007FF762ADD9D7
tab->LastFrameVisible >= tab_bar->PrevFrameVisible, xrefs: 00007FF762ADD155
N/A, xrefs: 00007FF762ADD1B2
i >= 0 && i < Size, xrefs: 00007FF762ADCC07, 00007FF762ADCC52, 00007FF762ADCC85, 00007FF762ADCCD8, 00007FF762ADCD37, 00007FF762ADD12C, 00007FF762ADD283, 00007FF762ADD450, 00007FF762ADD47E, 00007FF762ADD4AE, 00007FF762ADD5D3
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762ADD14E, 00007FF762ADD1C9
Calling PopStyleColor() too many times!, xrefs: 00007FF762ADCB43

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$F61310$C610C61149F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$Calling PopStyleColor() too many times!$IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease)))$N/A$i >= 0 && i < Size$tab->LastFrameVisible >= tab_bar->PrevFrameVisible$tab->NameOffset < tab_bar->TabsNames.Buf.Size
API String ID: 1871915874-961183113
Opcode ID: 99a11c1a350e8a9dfd3b351aa328eb123f9d651ded0f6308aafe3ce9168905aa
Instruction ID: f50861b09fac98a6d6ceeb6c899539aa4dc7ad27f10ab2b829a7ec74a1ef570d
Opcode Fuzzy Hash: 99a11c1a350e8a9dfd3b351aa328eb123f9d651ded0f6308aafe3ce9168905aa
Instruction Fuzzy Hash: 6CB2C233A08A85C6DB95DF36C0405B9B7A1FF58788F948B36DE49632A4DFB8E445CB10

Function 00007FF762AE0D02 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 232keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 00007FF762AE0D24
GetKeyState.USER32 ref: 00007FF762AE0D62
GetKeyState.USER32 ref: 00007FF762AE0D98
GetKeyState.USER32 ref: 00007FF762AE0DCE
GetKeyState.USER32 ref: 00007FF762AE0DE0
GetKeyState.USER32 ref: 00007FF762AE0EB1
GetKeyState.USER32 ref: 00007FF762AE0EED
GetKeyState.USER32 ref: 00007FF762AE0F3D
GetKeyState.USER32 ref: 00007FF762AE0F79
GetKeyState.USER32 ref: 00007FF762AE0FC9
GetKeyState.USER32 ref: 00007FF762AE1005

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AE0E8F
ImGui::IsNamedKey(key), xrefs: 00007FF762AE0E96

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: State
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$ImGui::IsNamedKey(key)
API String ID: 1649606143-1336968070
Opcode ID: 320e79d58a395caa32967525c0a4eeebff8b16c0838ad5b5bb5afecf55618b72
Instruction ID: a219a0ee6f63f73531f1ec00019b5a5ecae2cf88cba2661c288fa0e4db4faa1b
Opcode Fuzzy Hash: 320e79d58a395caa32967525c0a4eeebff8b16c0838ad5b5bb5afecf55618b72
Instruction Fuzzy Hash: 5F911411E6C666E5FFF1B6355400BB9A2818FA1748F990236DCCE265D5CEEC7883E270

Function 00007FF762AA6EC0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 524COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AA7633

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762AA718C, 00007FF762AA7270
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AA7043, 00007FF762AA7134, 00007FF762AA7463
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AA6F74, 00007FF762AA733E, 00007FF762AA750E, 00007FF762AA75C1
Remaining, xrefs: 00007FF762AA7525
key != ImGuiKey_None, xrefs: 00007FF762AA713B
i >= 0 && i < Size, xrefs: 00007FF762AA6F7B, 00007FF762AA7345, 00007FF762AA7515
0 && "Unknown event!", xrefs: 00007FF762AA746A
Processed, xrefs: 00007FF762AA74F9
it >= Data && it < Data + Size && it_last >= it && it_last <= Data + Size, xrefs: 00007FF762AA75C8
n >= 0 && n < BITCOUNT, xrefs: 00007FF762AA7193, 00007FF762AA7277
button >= 0 && button < ImGuiMouseButton_COUNT, xrefs: 00007FF762AA704A

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: 0 && "Unknown event!"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$Processed$Remaining$button >= 0 && button < ImGuiMouseButton_COUNT$i >= 0 && i < Size$it >= Data && it < Data + Size && it_last >= it && it_last <= Data + Size$key != ImGuiKey_None$n >= 0 && n < BITCOUNT
API String ID: 2490902527-1923509833
Opcode ID: 8a7e1af03d72756e019b02673daee7c066d9e9cf1c3008671a80216385de6d30
Instruction ID: 6300dc7c4da3c16d0a07099b7187b9f78777db898f507e2f8e47fcc14803cff3
Opcode Fuzzy Hash: 8a7e1af03d72756e019b02673daee7c066d9e9cf1c3008671a80216385de6d30
Instruction Fuzzy Hash: 5E42F962B082C296EFD8AB2498507BEFB90FF51744F844135DE994BA98CBFCE454C760

Function 00007FF762A96CB0 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 396COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF762A95CA0), ref: 00007FF762A971A7
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A97227

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762A97329
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A96CE9, 00007FF762A96E19, 00007FF762A96F47
Window, xrefs: 00007FF762A96D06
!g.Initialized && !g.SettingsLoaded, xrefs: 00007FF762A96CF0
Table, xrefs: 00007FF762A96E3E
n >= 0 && n < BITCOUNT, xrefs: 00007FF762A97330
FindSettingsHandler(handler->TypeName) == 0, xrefs: 00007FF762A96E20, 00007FF762A96F4E

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C610F020F61310
String ID: !g.Initialized && !g.SettingsLoaded$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$FindSettingsHandler(handler->TypeName) == 0$Table$Window$n >= 0 && n < BITCOUNT
API String ID: 310658293-416841283
Opcode ID: 6999e506cd3f841049ed0ddc9bbeb4f37ac2a9f693a45f5d1a2f228a3b90db1c
Instruction ID: 01bcdc5865217bd6558079402f19332e120bb0238147e6a6fa99320ea0f2398f
Opcode Fuzzy Hash: 6999e506cd3f841049ed0ddc9bbeb4f37ac2a9f693a45f5d1a2f228a3b90db1c
Instruction Fuzzy Hash: 4412BE72A19B82C6EB90EF25E8446B8B7A4FB54B44F944136CE8D473A4DFBCE455C320

Function 00007FF762AB1D70 Relevance: 15.0, APIs: 10, Instructions: 50clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF762AB1D7B
MultiByteToWideChar.KERNEL32 ref: 00007FF762AB1DAE
GlobalAlloc.KERNEL32 ref: 00007FF762AB1DC2
GlobalLock.KERNEL32 ref: 00007FF762AB1DD3
MultiByteToWideChar.KERNEL32 ref: 00007FF762AB1DF2
GlobalUnlock.KERNEL32 ref: 00007FF762AB1DFB
EmptyClipboard.USER32 ref: 00007FF762AB1E01
SetClipboardData.USER32 ref: 00007FF762AB1E0F
GlobalFree.KERNEL32 ref: 00007FF762AB1E1D
CloseClipboard.USER32 ref: 00007FF762AB1E23

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: ClipboardGlobal$ByteCharMultiWide$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 1965520120-0
Opcode ID: ebbd9d8b24dcedb596b0ca59058d4c86985b5e6383d3a38eef27f5b3966815bd
Instruction ID: 4b0d30eef8d41355af9f25d50680ef51fb746f5d0c1a3de74f28098690020824
Opcode Fuzzy Hash: ebbd9d8b24dcedb596b0ca59058d4c86985b5e6383d3a38eef27f5b3966815bd
Instruction Fuzzy Hash: 58119675A08E01C2EF947B25B804535E2A5AFC8BD1F484138DE8E477A4DEFCD445D710

Function 00007FF762AC7CE0 Relevance: 13.8, Strings: 10, Instructions: 1289COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762AC7E49, 00007FF762AC7E8A, 00007FF762AC7F88, 00007FF762AC8219, 00007FF762AC8334, 00007FF762AC8381, 00007FF762AC851D, 00007FF762AC863F, 00007FF762AC8671, 00007FF762AC88F9, 00007FF762AC8931, 00007FF762AC8A65, 00007FF762AC8E40, 00007FF762AC8E7A, 00007FF762AC8F0F, 00007FF762AC91D4, 00007FF762AC9206
column->IndexWithinEnabledSet <= column->DisplayOrder, xrefs: 00007FF762AC800F
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AC86DD
table->LeftMostEnabledColumn >= 0 && table->RightMostEnabledColumn >= 0, xrefs: 00007FF762AC8168
!is_visible, xrefs: 00007FF762AC8CC9
i >= 0 && i < Size, xrefs: 00007FF762AC86E4
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF762AC7D54, 00007FF762AC8008, 00007FF762AC8161, 00007FF762AC8CC2
#ContextMenu, xrefs: 00007FF762AC9129
p >= Data && p < DataEnd, xrefs: 00007FF762AC7E50, 00007FF762AC7E91, 00007FF762AC7F8F, 00007FF762AC8220, 00007FF762AC833B, 00007FF762AC8388, 00007FF762AC8524, 00007FF762AC8646, 00007FF762AC8678, 00007FF762AC8900, 00007FF762AC8938, 00007FF762AC8A6C, 00007FF762AC8E47, 00007FF762AC8E81, 00007FF762AC8F16, 00007FF762AC91DB, 00007FF762AC920D
table->IsLayoutLocked == false, xrefs: 00007FF762AC7D5B

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: !is_visible$#ContextMenu$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$column->IndexWithinEnabledSet <= column->DisplayOrder$i >= 0 && i < Size$p >= Data && p < DataEnd$table->IsLayoutLocked == false$table->LeftMostEnabledColumn >= 0 && table->RightMostEnabledColumn >= 0
API String ID: 0-1387518580
Opcode ID: 4a9ae7a7dfc95e9f833c2f08296e03bc7dc638ae3a7b9870f2afbfcbe5ec5d51
Instruction ID: 58332c68d3bd4b0e1d1a5680fce0fffd23eb4192f0241f5648e25543483f215a
Opcode Fuzzy Hash: 4a9ae7a7dfc95e9f833c2f08296e03bc7dc638ae3a7b9870f2afbfcbe5ec5d51
Instruction Fuzzy Hash: F7E2D532A08685D6EB96EB36C1417B8B760FF59784F488321DF48136A5DBF8F4A5CB10

Function 00007FF762AB6C90 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 830COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762AB71E5

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2705777111
Opcode ID: ed100c909a3311f44bcdd3e20e5d115049063c2e232d0146e083f4a0e98039ee
Instruction ID: dbc1ecb1af413f28903dc179a2419b9d378507bc425bd352022d3872890957bc
Opcode Fuzzy Hash: ed100c909a3311f44bcdd3e20e5d115049063c2e232d0146e083f4a0e98039ee
Instruction Fuzzy Hash: 4572CE23E18BE885C743DB3694426B9B7E1EF6E781F59C323ED44A6661EBB8D441C700

Function 00007FF762AB1C20 Relevance: 12.1, APIs: 8, Instructions: 87clipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF762A910A0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A9112E

OpenClipboard.USER32 ref: 00007FF762AB1C38
GetClipboardData.USER32 ref: 00007FF762AB1C55
CloseClipboard.USER32 ref: 00007FF762AB1C63

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Clipboard$00007C610CloseDataF020Open
String ID:
API String ID: 330523670-0
Opcode ID: 26d566c6706ed3b603c2ca6413b7fcc995dc930fd5e624c9433e805aea778b59
Instruction ID: a43b652e32b8db2a74b8bf55bfca3da7a13e43a325e0dea90144ea97be544ead
Opcode Fuzzy Hash: 26d566c6706ed3b603c2ca6413b7fcc995dc930fd5e624c9433e805aea778b59
Instruction Fuzzy Hash: B231C532B08B81C3EB94AF25B80456AA6E4FBC8B91F540134DF8D47794DFBCE451D620

Function 00007FF762AEC0F8 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF762AEC114
RtlCaptureContext.KERNEL32 ref: 00007FF762AEC141
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF762AEC15B
RtlVirtualUnwind.KERNEL32 ref: 00007FF762AEC19C
IsDebuggerPresent.KERNEL32 ref: 00007FF762AEC1F0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF762AEC20D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF762AEC218

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 8964dd5a87bbd0479f9b080791705f60ec265abbfbc2f45a2eb81db15352648c
Instruction ID: ff5c6aa3ea5586f3d751021e77c787a944d433669ba2314acfd6bc86077fc94e
Opcode Fuzzy Hash: 8964dd5a87bbd0479f9b080791705f60ec265abbfbc2f45a2eb81db15352648c
Instruction Fuzzy Hash: ED317572608B81D5EBA0AF64E8407EDB365F784744F844039DE8E47794EFB8C249C710

Function 00007FF762AAE1C0 Relevance: 10.5, Strings: 8, Instructions: 475COMMON

Download Yara Rule

Strings

!scoring_rect.IsInverted(), xrefs: 00007FF762AAE9E4
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AAE25D, 00007FF762AAE286, 00007FF762AAE9DD
<NULL>, xrefs: 00007FF762AAE522
[nav] NavMoveRequest: clamp NavRectRel for gamepad move, xrefs: 00007FF762AAE6AF
[nav] NavMoveRequestForward %d, xrefs: 00007FF762AAE2A9
[nav] NavInitRequest: from move, window "%s", layer=%d, xrefs: 00007FF762AAE530
g.NavMoveFlags & ImGuiNavMoveFlags_Forwarded, xrefs: 00007FF762AAE28D
g.NavMoveDir != ImGuiDir_None && g.NavMoveClipDir != ImGuiDir_None, xrefs: 00007FF762AAE264

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: !scoring_rect.IsInverted()$<NULL>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$[nav] NavInitRequest: from move, window "%s", layer=%d$[nav] NavMoveRequest: clamp NavRectRel for gamepad move$[nav] NavMoveRequestForward %d$g.NavMoveDir != ImGuiDir_None && g.NavMoveClipDir != ImGuiDir_None$g.NavMoveFlags & ImGuiNavMoveFlags_Forwarded
API String ID: 0-1751011103
Opcode ID: e4aba979aa13f89c1d393d52a5a001510e270dacfaf0202835dd2f82b435fe5c
Instruction ID: a56d59bceacd4297c9ee3c261ec7e376edb9e499da63caddec84c2d62daabaa2
Opcode Fuzzy Hash: e4aba979aa13f89c1d393d52a5a001510e270dacfaf0202835dd2f82b435fe5c
Instruction Fuzzy Hash: EC32F732D1878A82EBD2AB3681416F8F350EF69754F588332DE58265E1DFE87491C660

Function 00007FF762AB96B0 Relevance: 10.4, Strings: 8, Instructions: 438COMMON

Download Yara Rule

Strings

dx >= 0, xrefs: 00007FF762AB999A
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762AB9742, 00007FF762AB9808, 00007FF762AB98C7, 00007FF762AB9970, 00007FF762AB9993, 00007FF762AB9B43, 00007FF762AB9B6F
x >= 0 && x < len, xrefs: 00007FF762AB98CE
dy >= 0, xrefs: 00007FF762AB9977
sy1 > y_final-0.01f, xrefs: 00007FF762AB9B76
fabsf(area) <= 1.01f, xrefs: 00007FF762AB9B4A
e->ey >= y_top, xrefs: 00007FF762AB9749
e->sy <= y_bottom && e->ey >= y_top, xrefs: 00007FF762AB980F

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$dx >= 0$dy >= 0$e->ey >= y_top$e->sy <= y_bottom && e->ey >= y_top$fabsf(area) <= 1.01f$sy1 > y_final-0.01f$x >= 0 && x < len
API String ID: 0-3568222241
Opcode ID: 790997296c3ace0f49b917fc0f4bb1bfed2a2440f2ab62fef7e3b804057f5052
Instruction ID: 15eba76b633028eecbfd09f6c148ef89e8273f44ccc22e1bd2ae213bd815369e
Opcode Fuzzy Hash: 790997296c3ace0f49b917fc0f4bb1bfed2a2440f2ab62fef7e3b804057f5052
Instruction Fuzzy Hash: 9912F622D18B8AC5EB52A73351824B5F250AFBF3C5F58D732ED48325B2DFA87191DA10

Function 00007FF762ACCDD0 Relevance: 9.0, Strings: 7, Instructions: 237COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762ACCE4C, 00007FF762ACCEDE, 00007FF762ACCF7C, 00007FF762ACD089
(0) && "Calling PopItemFlag() too many times!", xrefs: 00007FF762ACD13A
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762ACD133
Calling PopItemFlag() too many times!, xrefs: 00007FF762ACD11D
*Missing Text*, xrefs: 00007FF762ACCE76
p >= Data && p < DataEnd, xrefs: 00007FF762ACCE53, 00007FF762ACCEE5, 00007FF762ACCF83, 00007FF762ACD090
<Unknown>, xrefs: 00007FF762ACD0B9

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: (0) && "Calling PopItemFlag() too many times!"$*Missing Text*$<Unknown>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$Calling PopItemFlag() too many times!$p >= Data && p < DataEnd
API String ID: 0-3275063505
Opcode ID: daca524e7c5dbf27fa7a34285fc0e3a370f51538253c794bdcc54b755110fd88
Instruction ID: b2eba9af6d11bdc1249764c4edc25ddec6ba67732fabdc64f305838e880ff0f2
Opcode Fuzzy Hash: daca524e7c5dbf27fa7a34285fc0e3a370f51538253c794bdcc54b755110fd88
Instruction Fuzzy Hash: B1B1D472B08B82D1EF94AB18D504AA8A792FB45B84F844036DE4D037E5DFFCE855CB60

Function 00007FF762AAD620 Relevance: 8.1, Strings: 6, Instructions: 635COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AAD945, 00007FF762AADD34, 00007FF762AADDD9, 00007FF762AADF0A
g.NavLayer == ImGuiNavLayer_Main || g.NavLayer == ImGuiNavLayer_Menu, xrefs: 00007FF762AAD94C
g.NavMoveDir == ImGuiDir_None, xrefs: 00007FF762AADDE0
g.NavWindow != 0, xrefs: 00007FF762AADF11
g.NavActivateDownId == g.NavActivateId, xrefs: 00007FF762AADD3B
[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s", xrefs: 00007FF762AAD837

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s"$g.NavActivateDownId == g.NavActivateId$g.NavLayer == ImGuiNavLayer_Main || g.NavLayer == ImGuiNavLayer_Menu$g.NavMoveDir == ImGuiDir_None$g.NavWindow != 0
API String ID: 0-2167808928
Opcode ID: 0183191b6d91be417bd1c7107b1b726c92c41574d8174999c2f60281904307fd
Instruction ID: a6a992893f8f08ac1d3ddad733c902a3a5f2fd7d2bbfca145873a0e1f4bed13c
Opcode Fuzzy Hash: 0183191b6d91be417bd1c7107b1b726c92c41574d8174999c2f60281904307fd
Instruction Fuzzy Hash: 8672A532D08AC2C9EFE5AB35C0447B9A791EF55B48F884235DE98176E5CFF86481C7A0

Function 00007FF762ACF9E0 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762ACFCFF, 00007FF762AD0051, 00007FF762AD00F9
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AD0028
id != 0, xrefs: 00007FF762ACFB9B
button >= 0 && button < ((int)(sizeof(g.IO.MouseDown) / sizeof(*(g.IO.MouseDown)))), xrefs: 00007FF762AD002F
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762ACFB94
button >= 0 && button < ImGuiMouseButton_COUNT, xrefs: 00007FF762ACFD06, 00007FF762AD0058, 00007FF762AD0100

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$button >= 0 && button < ((int)(sizeof(g.IO.MouseDown) / sizeof(*(g.IO.MouseDown))))$button >= 0 && button < ImGuiMouseButton_COUNT$id != 0
API String ID: 2490902527-2768765550
Opcode ID: 88b3baaae7ef37454bd0309ba98a3de903c58a9088266fe0384f8de82cd0dde6
Instruction ID: 40e5ce131a04ab169be8d77bf0ffb4b1aa064228aaf8a73d13963ce402a614ff
Opcode Fuzzy Hash: 88b3baaae7ef37454bd0309ba98a3de903c58a9088266fe0384f8de82cd0dde6
Instruction Fuzzy Hash: C322E132F08286C6EFE9A6259140BB9E691EF45344F84413ADE5D573E2CFECB854CB60

Function 00007FF762A9DFB0 Relevance: 7.2, Strings: 5, Instructions: 977COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9E70D, 00007FF762A9E77B, 00007FF762A9E903, 00007FF762A9E944, 00007FF762A9E986, 00007FF762A9E9C0, 00007FF762A9EA27, 00007FF762A9EA5C, 00007FF762A9EA87, 00007FF762A9EAB9
6, xrefs: 00007FF762A9E607
#RESIZE, xrefs: 00007FF762A9E142
5, xrefs: 00007FF762A9E62E
idx == 0 || idx == 1, xrefs: 00007FF762A9E714, 00007FF762A9E782, 00007FF762A9E90A, 00007FF762A9E94B, 00007FF762A9E98D, 00007FF762A9E9C7, 00007FF762A9EA2E, 00007FF762A9EA63, 00007FF762A9EA8E, 00007FF762A9EAC0

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: #RESIZE$5$6$C:\Users\55yar\Desktop\imgui-master\imgui.h$idx == 0 || idx == 1
API String ID: 0-650503096
Opcode ID: bf26349d3ab49ba21dda182bb6882259765bc9e983ce837090972ddbe99c5440
Instruction ID: ca1cbfd312dec9e87befece879fdf7432413b2b90eb661fec3b57246a9d7fcfe
Opcode Fuzzy Hash: bf26349d3ab49ba21dda182bb6882259765bc9e983ce837090972ddbe99c5440
Instruction Fuzzy Hash: 29B22D32D18689C5EB92DB3795416B9B360FF59344F688732EE48235A2DFF8B885C710

Function 00007FF762ACD530 Relevance: 6.4, Strings: 5, Instructions: 140COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762ACD5AF
settings->ID == table->ID, xrefs: 00007FF762ACD5EE
settings->ColumnsCount == table->ColumnsCount && settings->ColumnsCountMax >= settings->ColumnsCount, xrefs: 00007FF762ACD617
p >= begin() && p < end(), xrefs: 00007FF762ACD5B6
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF762ACD5E7, 00007FF762ACD610

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$p >= begin() && p < end()$settings->ColumnsCount == table->ColumnsCount && settings->ColumnsCountMax >= settings->ColumnsCount$settings->ID == table->ID
API String ID: 0-2168725360
Opcode ID: dbd1ca440d040c993ee2685d397bd915aafff7e4aec8d0b619bb3bcf36a6bb7e
Instruction ID: c025b5e57aaa66938278614833e13c92b4fb4113d434bf093629118d409815ea
Opcode Fuzzy Hash: dbd1ca440d040c993ee2685d397bd915aafff7e4aec8d0b619bb3bcf36a6bb7e
Instruction Fuzzy Hash: 8461E333A18A81C6DB91EF25E4846A9BBA0FB40744F84C436DF8D473A1DBBCE549CB11

Function 00007FF762AEC388 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF762AEC3B4
GetCurrentThreadId.KERNEL32 ref: 00007FF762AEC3C2
GetCurrentProcessId.KERNEL32 ref: 00007FF762AEC3CE
QueryPerformanceCounter.KERNEL32 ref: 00007FF762AEC3DE

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 68b080e5c74ecdc989d9497fb427bfec2812cf223949a70a0905cf8ba2b6c893
Instruction ID: 11cc7aed08dc24d0f163f32ea2a921b0bc4ec1a8ac944ee1bf71f389fd3f2f7b
Opcode Fuzzy Hash: 68b080e5c74ecdc989d9497fb427bfec2812cf223949a70a0905cf8ba2b6c893
Instruction Fuzzy Hash: 16110A22B14F018AEF40DB60E8547B873A4FB59758F840E31DE6E46BA4EFB8D159C390

Function 00007FF762AAFA00 Relevance: 5.6, Strings: 4, Instructions: 628COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AAFEAC, 00007FF762AB00D0, 00007FF762AB012C
##NavUpdateWindowing, xrefs: 00007FF762AAFAE6
shared_mods != 0, xrefs: 00007FF762AAFEB3
GImGui != 0, xrefs: 00007FF762AB00D7, 00007FF762AB0133

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: ##NavUpdateWindowing$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0$shared_mods != 0
API String ID: 0-1670481530
Opcode ID: 04b31613541f7851fe5fa51a6883c1d55b506e0910f57327a67c4b686c1ca123
Instruction ID: 9b7b3988ea853f3fac7e0b93010da1eed4c3affb2449d5aa278f7a49a355d8b5
Opcode Fuzzy Hash: 04b31613541f7851fe5fa51a6883c1d55b506e0910f57327a67c4b686c1ca123
Instruction Fuzzy Hash: 5462C332E08786D6EFE9AA318144BB9E290FF55744F888239CE4D536D1CFE97464C760

Function 00007FF762A9FBB0 Relevance: 5.4, Strings: 4, Instructions: 420COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9FD32, 00007FF762A9FF5F
#COLLAPSE, xrefs: 00007FF762A9FDAE
Size > 0, xrefs: 00007FF762A9FD39, 00007FF762A9FF66
#CLOSE, xrefs: 00007FF762A9FFDA

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: #CLOSE$#COLLAPSE$C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-766050946
Opcode ID: c667e738bb88e9983f5b0a5b33468422bbcf6a4303e5676e8c40f70c724579e5
Instruction ID: 5c42cdf89ee3e022041424dcce9abe481cd9f3a908156dd6804ae3784b8fdacd
Opcode Fuzzy Hash: c667e738bb88e9983f5b0a5b33468422bbcf6a4303e5676e8c40f70c724579e5
Instruction Fuzzy Hash: 13125C32E18785C5EB91DB369441BF8F360EF6A384F548736EE4C636A1DFA8A485C710

Function 00007FF762AD0DE0 Relevance: 5.4, Strings: 4, Instructions: 420COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AD111A, 00007FF762AD1152
ImMax(size_contents_v, size_visible_v) > 0.0f, xrefs: 00007FF762AD1000
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762AD0FF9
idx == 0 || idx == 1, xrefs: 00007FF762AD1121, 00007FF762AD1159

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$ImMax(size_contents_v, size_visible_v) > 0.0f$idx == 0 || idx == 1
API String ID: 0-3128625980
Opcode ID: dc63a2eb52d91a7c96ab9617dc742f0ba242692b369b0ab69c027296cb449c46
Instruction ID: c6555f602e169959614f622d2cc761015239d88ee43a0e692f0305bda927679c
Opcode Fuzzy Hash: dc63a2eb52d91a7c96ab9617dc742f0ba242692b369b0ab69c027296cb449c46
Instruction Fuzzy Hash: 46120822D187C9C1EB93A63790416B9E350AF6E784F5CCB32FD58325A1DBE8B4C1C610

Function 00007FF762AD2A00 Relevance: 5.3, Strings: 4, Instructions: 302COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AD2CA3
##v, xrefs: 00007FF762AD2A6E, 00007FF762AD2ECF
i >= 0 && i < Size, xrefs: 00007FF762AD2CAA
#ComboPopup, xrefs: 00007FF762AD2C31

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: ##v$#ComboPopup$C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 0-2429816084
Opcode ID: d223ba95fa3f8431c3527eb8a8addc1fc094f61dda7c71b05821a76b8b7267f5
Instruction ID: 6fdb5e38c1c09ab90a7bbf54a4fbb0b28de5e26c5f8095b41ecbe1dd2a249fa2
Opcode Fuzzy Hash: d223ba95fa3f8431c3527eb8a8addc1fc094f61dda7c71b05821a76b8b7267f5
Instruction Fuzzy Hash: A4E10632E14B85CAEB61DF3684406E9B360FF69348F549B22EE08379A5DFB8A055D710

Function 00007FF762ADC310 Relevance: 4.1, Strings: 3, Instructions: 301COMMON

Download Yara Rule

Strings

(0) && "Calling PopItemFlag() too many times!", xrefs: 00007FF762ADC8CB
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762ADC8C4
Calling PopItemFlag() too many times!, xrefs: 00007FF762ADC8AE

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: (0) && "Calling PopItemFlag() too many times!"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Calling PopItemFlag() too many times!
API String ID: 0-102052167
Opcode ID: 96fb338a3eb5323ad8e16e2236e7e16ed0364ae2ad41a9e1da31dbf1eaac17b2
Instruction ID: 9ec8ce25d7e9d84ca144c7131972bcda80834cdf82970e4e97f401171dc4fc03
Opcode Fuzzy Hash: 96fb338a3eb5323ad8e16e2236e7e16ed0364ae2ad41a9e1da31dbf1eaac17b2
Instruction Fuzzy Hash: 47E1E6329186C9C1EB66AB3690417F9F361EF59744F888732EE88235E1DFECA495C710

Function 00007FF762ABB1E0 Relevance: 3.3, APIs: 2, Instructions: 255COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ABB53F
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ABB5C0

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID:
API String ID: 1173767890-0
Opcode ID: 840806cd119453e176316f103cfa6115c689a532c86d21d08463b5bbe60d1203
Instruction ID: 5958bd8b75052cf84411a130debabac19a661cd01fc3f2dddbf8e87dd3431671
Opcode Fuzzy Hash: 840806cd119453e176316f103cfa6115c689a532c86d21d08463b5bbe60d1203
Instruction Fuzzy Hash: DCB12633E14A95C9D761EF3590846BEF3A4FF59B85F448322EF8512650EBB8E482C710

Function 00007FF762AE105B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32 ref: 00007FF762AE105D
GetLocaleInfoA.KERNEL32 ref: 00007FF762AE1079

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: InfoKeyboardLayoutLocale
String ID:
API String ID: 1218629382-0
Opcode ID: 9e33f65f36021c76e3ce5085f13d9bf961fb33b85001965e3fe80dccfd441406
Instruction ID: 587d48e721c94c2e176b64a367a5c76b97f7038005d69e3519fb38a7f914ca79
Opcode Fuzzy Hash: 9e33f65f36021c76e3ce5085f13d9bf961fb33b85001965e3fe80dccfd441406
Instruction Fuzzy Hash: 62F0A066714A81D6EBA28B26A400ABAF394EB48754F584037CFCE53310DEBDD887D750

Function 00007FF762AAC250 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

(window->ChildFlags | g.NavWindow->ChildFlags) & ImGuiChildFlags_NavFlattened, xrefs: 00007FF762AAC2E4
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AAC2DD

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: (window->ChildFlags | g.NavWindow->ChildFlags) & ImGuiChildFlags_NavFlattened$C:\Users\55yar\Desktop\imgui-master\imgui.cpp
API String ID: 0-3836044477
Opcode ID: 5a185c5bc87efbe87e49fe26606f6f425be744948ca03a92641440ced4ace0dc
Instruction ID: 93d4c6c4bb53d5bc58401e05a99d21de165e0c8b1925f3ffd2cca341aecc1f79
Opcode Fuzzy Hash: 5a185c5bc87efbe87e49fe26606f6f425be744948ca03a92641440ced4ace0dc
Instruction Fuzzy Hash: 86D1E722D08A8EC1F7E2A63B40424B9E3919F6E385F5C9732FD48369E1CBD87585C590

Function 00007FF762AB7EF0 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762AB8FAD
!(o > b->size || o < 0), xrefs: 00007FF762AB8FB4

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: !(o > b->size || o < 0)$C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2013812653
Opcode ID: 338cbcf2d73f435f5922b98e8238c06777b811b88471036ee86486d399c18bc5
Instruction ID: 97055198f75436782481782f3cd10eb6c61e1704ec740274f5c8cf94d9436b59
Opcode Fuzzy Hash: 338cbcf2d73f435f5922b98e8238c06777b811b88471036ee86486d399c18bc5
Instruction Fuzzy Hash: 0BB1D132A08AC5CAFB01DF7E90411BDB7B0FB99385F545325EF8922675DBB8A585CB00

Function 00007FF762ABBFC0 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

pixels[i*stride_in_bytes] == 0, xrefs: 00007FF762ABC1F5
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762ABC1EE

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$pixels[i*stride_in_bytes] == 0
API String ID: 0-15633718
Opcode ID: 31de7da7b85a2ca0f7b465d4c6b43859fb456ff60d2410b47046c024e5081591
Instruction ID: 2f1ee498e505a0755d4375955e437f70000b1db30c900c8794f19d11bd3a2a8c
Opcode Fuzzy Hash: 31de7da7b85a2ca0f7b465d4c6b43859fb456ff60d2410b47046c024e5081591
Instruction Fuzzy Hash: 6D714B7360C2E28BD7A6572CA840B6EEED2B799340F5C4235EEC9C3B85C9BCD505CA50

Function 00007FF762ABBD10 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762ABBF4D
pixels[i] == 0, xrefs: 00007FF762ABBF54

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$pixels[i] == 0
API String ID: 0-2060079458
Opcode ID: 00354369be909df9498fe21faccccd311e8301600fa052487b4864d57ac2e6d2
Instruction ID: f170602c4ca720c31d55a410a9dbc8ee02ffc486fc2eb5ca7eeb0c1a3df0284b
Opcode Fuzzy Hash: 00354369be909df9498fe21faccccd311e8301600fa052487b4864d57ac2e6d2
Instruction Fuzzy Hash: 6E71F66362C6E186CB658B39D844A7DFFA1F785305F484236EECC82B95CABDE114CB10

Function 00007FF762AC59E0 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

text_end != 0, xrefs: 00007FF762AC5A2F
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC5A28

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$text_end != 0
API String ID: 0-48455972
Opcode ID: 337525c904e070bd42df79c0a6487294a94bd2ebcfc3121796ca707f84feba5e
Instruction ID: 6e2c3ea05edcbf9f7dc516168fd6216dd78af04899aa0416826901930220efae
Opcode Fuzzy Hash: 337525c904e070bd42df79c0a6487294a94bd2ebcfc3121796ca707f84feba5e
Instruction Fuzzy Hash: 2641FB21F0D65AC6EFA1A9235480579E751AF65780FDC8732FD0C277A4ABFCE481CA10

Function 00007FF762AA46F0 Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AA470F
Size > 0, xrefs: 00007FF762AA4716

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-1180621679
Opcode ID: 6ed20166e65553b91257ace29f513335ab454b8572dbed2f61cfc2601968656f
Instruction ID: d39ec44247d28e4dec949730b95fef006f7751259c472de8fd3c8f4f2edfdaf9
Opcode Fuzzy Hash: 6ed20166e65553b91257ace29f513335ab454b8572dbed2f61cfc2601968656f
Instruction Fuzzy Hash: 2B319C72B141E58BEBD8CB62A810F797B60E3D5782B896122EFC017A48C67CD511CB60

Function 00007FF762AA4620 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AA4648
Size > 0, xrefs: 00007FF762AA464F

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-1180621679
Opcode ID: 440f36ff81ebcb3adc85cc04d88a8c0a58b369e470e635c1928618b8866c0834
Instruction ID: 5053bf76631a1ee597ece8cfe20906ebea2df180e76bdda4b86e40d65766641f
Opcode Fuzzy Hash: 440f36ff81ebcb3adc85cc04d88a8c0a58b369e470e635c1928618b8866c0834
Instruction Fuzzy Hash: 8D11B7B1604691C6DB48CB61D4E04B9B7A0F794782F85103BEBDA07655DE7CD181C760

Function 000001F78406BA30 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

P, xrefs: 000001F78406BE43

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 69ad6d8646a8d42a4d38cd2fe8030801224298b73a5447b55754f5dd44c8bdc4
Instruction ID: 8d23a3463a63e8f51a77355ec5cb7ed67557956edc59af991f81d5355c93b7fc
Opcode Fuzzy Hash: 69ad6d8646a8d42a4d38cd2fe8030801224298b73a5447b55754f5dd44c8bdc4
Instruction Fuzzy Hash: 0A12D0702187459FD348DF28C090A6BB7E2FBCD348F504A6DE48AD77A5D634EA41CB42

Function 000001F784142720 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

@, xrefs: 000001F784142AA8

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: af22b2a64cd9b34464c746f31960b8c553625a99857650b96e506a8a1dbf1dca
Instruction ID: bf08cff67f41dfc113875fdbc59f4951682b181798b140e3a0bc6ab00095685a
Opcode Fuzzy Hash: af22b2a64cd9b34464c746f31960b8c553625a99857650b96e506a8a1dbf1dca
Instruction Fuzzy Hash: 09E1FE7421CB888FE7A4DF18D45876AB7E2FB99345F10492DE48EC32A0DB75D885CB06

Function 00007FF762AB54F0 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762AB5726

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2705777111
Opcode ID: 64546066472ca3b8349dd8d249968d4cd0d82be6d00cd49db611cd94df8f4d3b
Instruction ID: 877332d4947cfc785f4b61319027dca6b61510248ba30d5f9539315b8520d150
Opcode Fuzzy Hash: 64546066472ca3b8349dd8d249968d4cd0d82be6d00cd49db611cd94df8f4d3b
Instruction Fuzzy Hash: 08514AA6B244B183DF609F2AC8C19BC77D1E78A743FD44176D65C82E51C5AEC14ADF20

Function 00007FF762ABDB50 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d529cf8631021c5dd542a830c84e469b7f6db80fccbf318bd5255d4788bf88
Instruction ID: c69dc7da272a0ca7ef4ce3b9acaf6e980d5d7398789e6e6606c3e1f3e57d654e
Opcode Fuzzy Hash: 19d529cf8631021c5dd542a830c84e469b7f6db80fccbf318bd5255d4788bf88
Instruction Fuzzy Hash: 8E927A33924B8886C756CF37958146CBB60FFADB85B19D716EE0823361EB75E4A4DB00

Function 00007FF762A95D90 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C612
String ID:
API String ID: 1428191659-0
Opcode ID: f9d01269032edfe605ba9ee75bb53b8e442012ac64e2949f0b5a13a459ae737e
Instruction ID: 510fcec47d7b5d5b61f24e9e75ba62b3ee827a16734092983929c3e7da146adb
Opcode Fuzzy Hash: f9d01269032edfe605ba9ee75bb53b8e442012ac64e2949f0b5a13a459ae737e
Instruction Fuzzy Hash: 56828F73815BC187D728CF30B9981DAB7A8FB55340F105219DBF623A61DB78E1A6E708

Function 00007FF762ADA370 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b4d47ad76f81d195c8f0f126609d9310c86f704e33473ce772df188177d854
Instruction ID: 8ae26718017cfa158aefd00e764439a3e094980b3a5b4bec93ec0e82a5ba77b8
Opcode Fuzzy Hash: 26b4d47ad76f81d195c8f0f126609d9310c86f704e33473ce772df188177d854
Instruction Fuzzy Hash: BC220433E08685CAEB91DA3690407FDF361FF59348F484B36EE48225A6DBF8A454CB11

Function 00007FF762ABC270 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56881822656bce64306f4bdbbfd4d3a54c53e1fbf9d1ba752f976963bfc6c0c
Instruction ID: 2004ed83324b57e91ae262ae42d67a9ccf3d90cf80e25167756ddd713633796f
Opcode Fuzzy Hash: c56881822656bce64306f4bdbbfd4d3a54c53e1fbf9d1ba752f976963bfc6c0c
Instruction Fuzzy Hash: D2024532A186C0CAD761CB369040AB9F7A1FF5D785F148322EF8963695EB7CE591CB10

Function 00007FF762AC6BC0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cdcacff072863030bac574a795dcf5713a463dc51147c05da48169f858605a4
Instruction ID: 16597ecfae207fd8b94cc40c2a445c78fcb33a55622c11d4af784ff2b7cf3980
Opcode Fuzzy Hash: 5cdcacff072863030bac574a795dcf5713a463dc51147c05da48169f858605a4
Instruction Fuzzy Hash: 01020923E18B89C2D751E63794425B9F360FFAE385F585721FE4422AB6CFA9F051DA00

Function 00007FF762ADBA80 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5317f72f240fe5e613bfbcefe3a1641e28353fe1cc31e2d5af9e94ad44fd5358
Instruction ID: 90e597fe18801ab5bbfbcfa0f91ef11676bba1abf420f3a742b60cb0b4b507dc
Opcode Fuzzy Hash: 5317f72f240fe5e613bfbcefe3a1641e28353fe1cc31e2d5af9e94ad44fd5358
Instruction Fuzzy Hash: 18F1A332908281CAEFB5AA259040BBDB7A0EF59744F884E35DE89076D5DFFDE445CB20

Function 00007FF762A99730 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc59dc2018c5ed4bc9c3a55fd55fd1d2e106552e6602e1d74bb624f49eb36f9
Instruction ID: 3d3bb9ab3c8eeb40df0bf762a4538599974dc0143df0e7a9b48e1df958fafc3e
Opcode Fuzzy Hash: afc59dc2018c5ed4bc9c3a55fd55fd1d2e106552e6602e1d74bb624f49eb36f9
Instruction Fuzzy Hash: 5DD1D251D2D2C3EDEFE1AE364A00AB9A790EF12748FA88135DE491A5D5CFED6C41C231

Function 00007FF762ADE5B0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fbf8747a14f15bf5d526cc27580a8984dc6b205a8b29d6e8ef1f11398739796
Instruction ID: 23c9b6d2e547e4a06e9a77439c4b332a5ca0cfc4b6adbdc622a68c096861964d
Opcode Fuzzy Hash: 7fbf8747a14f15bf5d526cc27580a8984dc6b205a8b29d6e8ef1f11398739796
Instruction Fuzzy Hash: 00C13B36750B8982EB508F3BD454BAD6761EB9EF88F09D231CE0A17BA4DF7AC1458700

Function 00007FF762ABAD40 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562b7d3f91c9f74b619fe1397834ae2ab76450cf0a24359a5ff58522b0b22631
Instruction ID: 185a6c64e2c1855f88eabe0689b3de9411c9165c5c6fd1a90a9ee8af2b566a4f
Opcode Fuzzy Hash: 562b7d3f91c9f74b619fe1397834ae2ab76450cf0a24359a5ff58522b0b22631
Instruction Fuzzy Hash: 67B1D822E28FCC81E263A63750825F9E250AF7F3C5F2DDB23FD84756B29BA461D19510

Function 00007FF762AA5A30 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cb8aba6307fe7dc9cd5f23d641e01c29a23161fcd7abab4b59ac3142b8c2da
Instruction ID: 6dadd538244f246844f33da624c5601afe79b44bdacf5bca95f96e91f8d5f0ca
Opcode Fuzzy Hash: 07cb8aba6307fe7dc9cd5f23d641e01c29a23161fcd7abab4b59ac3142b8c2da
Instruction Fuzzy Hash: 10D1BE32D0A3C1D5E7919F358440AF8BBD4FB66B48F4C827ADF8817A56CBA85450DBB0

Function 00007FF762AAF250 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103458bef360e4307c807517193c080bccb7cfe3cd90ec02abd82c8c74968f6
Instruction ID: 80a13fe5ee5bc95fbea71b2797b33e8292a9d5df81cd5392dc6ad41e47438f23
Opcode Fuzzy Hash: 2103458bef360e4307c807517193c080bccb7cfe3cd90ec02abd82c8c74968f6
Instruction Fuzzy Hash: E2910332918685C6EBEAAF36C0007F9B3A0FF04758F58833ACE59565D4DBF96484CB60

Function 000001F7840A3841 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3933692052abbb617f534a10efaa6307047042e1db0389fe2a76f298085f77
Instruction ID: 8f60a195d6f7ff8a9d00f3ef039faeb7920a6cf85c5f7e98934ea5b2fa68ee25
Opcode Fuzzy Hash: 1c3933692052abbb617f534a10efaa6307047042e1db0389fe2a76f298085f77
Instruction Fuzzy Hash: 48410DDFC0DAC51BC7428664ACAA6827F709A2324EBCF58DBD498CA587F048D409D712

Function 000001F784054850 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 000001F784055360: _WChar_traits.LIBCPMTD ref: 000001F78405538D

Part of subcall function 000001F784054AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784054AD0
Part of subcall function 000001F784054AA0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F784054B2F
Part of subcall function 000001F784054AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784054B41

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840548B8

Strings

a, xrefs: 000001F784054928
a, xrefs: 000001F7840548F6
y, xrefs: 000001F784054919
, xrefs: 000001F78405491E
, xrefs: 000001F78405490A
t, xrefs: 000001F78405492D
l, xrefs: 000001F784054941
K, xrefs: 000001F78405490F
e, xrefs: 000001F784054914
, xrefs: 000001F784054937
b, xrefs: 000001F78405494B
D, xrefs: 000001F784054923
o, xrefs: 000001F784054946
c, xrefs: 000001F784054905
g, xrefs: 000001F7840548FB
B, xrefs: 000001F78405493C
M, xrefs: 000001F7840548F1
i, xrefs: 000001F784054900
a, xrefs: 000001F784054932
KDBM, xrefs: 000001F7840549A9

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork$Char_traits
String ID: $ $ $B$D$K$KDBM$M$a$a$a$b$c$e$g$i$l$o$t$y
API String ID: 1777712374-1292890139
Opcode ID: c02a726d3c2bd88a4534588b83aa4fca235328903684469cf21292f4d99c4a12
Instruction ID: 6c49366aef59224a1f000f4a35e4f2d570b0a8f06c6c940d6189bd1ac98bc9c2
Opcode Fuzzy Hash: c02a726d3c2bd88a4534588b83aa4fca235328903684469cf21292f4d99c4a12
Instruction Fuzzy Hash: CB61D77050CB848FE761EB68C449B9BBBE1FBA9304F04495DA4C9C7261DBB99488CB53

Function 00007FF762AA7C60 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 76COMMON

Download Yara Rule

APIs

00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF762AA7C8F
00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF762AA7CA4

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AA7CB3, 00007FF762AA7CD6, 00007FF762AA7CFB, 00007FF762AA7D1D, 00007FF762AA7D41, 00007FF762AA7D65, 00007FF762AA7D89
strcmp(version, "1.91.6 WIP") == 0 && "Mismatched version string!", xrefs: 00007FF762AA7CBA
1.91.6 WIP, xrefs: 00007FF762AA7C80, 00007FF762AA7C98
sz_style == sizeof(ImGuiStyle) && "Mismatched struct layout!", xrefs: 00007FF762AA7D02
sz_vec2 == sizeof(ImVec2) && "Mismatched struct layout!", xrefs: 00007FF762AA7D24
sz_vec4 == sizeof(ImVec4) && "Mismatched struct layout!", xrefs: 00007FF762AA7D48
sz_vert == sizeof(ImDrawVert) && "Mismatched struct layout!", xrefs: 00007FF762AA7D6C
sz_idx == sizeof(ImDrawIdx) && "Mismatched struct layout!", xrefs: 00007FF762AA7D90
sz_io == sizeof(ImGuiIO) && "Mismatched struct layout!", xrefs: 00007FF762AA7CDD

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C6125630
String ID: 1.91.6 WIP$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$strcmp(version, "1.91.6 WIP") == 0 && "Mismatched version string!"$sz_idx == sizeof(ImDrawIdx) && "Mismatched struct layout!"$sz_io == sizeof(ImGuiIO) && "Mismatched struct layout!"$sz_style == sizeof(ImGuiStyle) && "Mismatched struct layout!"$sz_vec2 == sizeof(ImVec2) && "Mismatched struct layout!"$sz_vec4 == sizeof(ImVec4) && "Mismatched struct layout!"$sz_vert == sizeof(ImDrawVert) && "Mismatched struct layout!"
API String ID: 1529501491-1295771896
Opcode ID: 81d2e9201c58c4257a11a08258dd765dc5fa7c07bb397093847fbf6462c9f984
Instruction ID: 6c91425fcef8342b9c225f2bf76702c8d8a4c701ceca99fd02d83c1163e4789a
Opcode Fuzzy Hash: 81d2e9201c58c4257a11a08258dd765dc5fa7c07bb397093847fbf6462c9f984
Instruction Fuzzy Hash: 95314120A08A42D0FF95BB05E844975B765FFA5784FC85031DC4D07AA8DFEDE546C7A0

Function 000001F7840D69A0 Relevance: 17.0, APIs: 11, Instructions: 484COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840D6BDD
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D6C5A
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D6C73
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840D6CB3
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D6D12
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D6D2B
_Min_value.LIBCPMTD ref: 000001F7840D6D62
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D6D7E
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D6D97
_Max_value.LIBCPMTD ref: 000001F7840D6DCE
_Min_value.LIBCPMTD ref: 000001F7840D6DEB

Part of subcall function 000001F7840DF140: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840DF165

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Affinity::operator!=Concurrency::details::HardwareMin_value$Max_valueSchedulerScheduler::_
String ID:
API String ID: 2048856540-0
Opcode ID: e866146c94e960af1540157134187f2a0fce7dbc0c02fbcd93b84c3e2d61bdcf
Instruction ID: b66d98bd80945d6e7d05ecdca6ce0d3c783c93c5e78bbda4424e4c6e85452d40
Opcode Fuzzy Hash: e866146c94e960af1540157134187f2a0fce7dbc0c02fbcd93b84c3e2d61bdcf
Instruction Fuzzy Hash: CF02CD7151CB898FDBB5EF18C458BEBB3E1FB98340F400A6EA58EC3291DA749545CB42

Function 000001F7840D6FF0 Relevance: 17.0, APIs: 11, Instructions: 484COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840D722D
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D72AA
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D72C3
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840D7303
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D7362
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D737B
_Min_value.LIBCPMTD ref: 000001F7840D73B2
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D73CE
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840D73E7
_Max_value.LIBCPMTD ref: 000001F7840D741E
_Min_value.LIBCPMTD ref: 000001F7840D743B

Part of subcall function 000001F7840DF190: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840DF1B5

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Affinity::operator!=Concurrency::details::HardwareMin_value$Max_valueSchedulerScheduler::_
String ID:
API String ID: 2048856540-0
Opcode ID: 34194c3b2c4dfd965ddaab666ebbea208bd56193119cc555b2f518073ecbe67a
Instruction ID: 27f017b5b4d43a85a35d93ce414d9de58d843030f98c6e170bb043384f6ad682
Opcode Fuzzy Hash: 34194c3b2c4dfd965ddaab666ebbea208bd56193119cc555b2f518073ecbe67a
Instruction Fuzzy Hash: 5C02DB7111CB898FDBB5EF18C458BEBB7E1FBA8344F400A6E958EC3291DA709545CB42

Function 00007FF762A9C240 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 313COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762A9C5B2

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A9C25A, 00007FF762A9C332, 00007FF762A9C615
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9C672
##Foreground, xrefs: 00007FF762A9C5E0
draw_data->CmdLists.Size == draw_data->CmdListsCount, xrefs: 00007FF762A9C61C
Size > 0, xrefs: 00007FF762A9C679
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF762A9C339
##Background, xrefs: 00007FF762A9C3E3
g.Initialized, xrefs: 00007FF762A9C261

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: ##Background$##Foreground$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$Size > 0$draw_data->CmdLists.Size == draw_data->CmdListsCount$g.Initialized
API String ID: 2490902527-3285338674
Opcode ID: 55e0a90a21c0d75db33410e0f2d76169ae9688cc536bc39d37b1e1ec5e10517e
Instruction ID: 2bd4fe5159edd7987671538deecb5cc79920870934229cf4f86681f7c6624bac
Opcode Fuzzy Hash: 55e0a90a21c0d75db33410e0f2d76169ae9688cc536bc39d37b1e1ec5e10517e
Instruction Fuzzy Hash: 51E1A432F14A82C6EF90EF26D944AA9B7A6FB48B44F944035DE4D47695DFB8EC41C310

Function 00007FF762AD52B0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 211COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD53CB
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD5498

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AD5525
((char*)(state->undo_rec + state->redo_point)) >= buf_begin, xrefs: 00007FF762AD5441
C:\Users\55yar\Desktop\imgui-master\imstb_textedit.h, xrefs: 00007FF762AD543A, 00007FF762AD546E
i >= 0 && i < Size, xrefs: 00007FF762AD552C
((char*)(state->undo_rec + state->redo_point + 1) + move_size) <= buf_end, xrefs: 00007FF762AD5475
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762AD5501
idx <= obj->TextLen, xrefs: 00007FF762AD5508

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: ((char*)(state->undo_rec + state->redo_point + 1) + move_size) <= buf_end$((char*)(state->undo_rec + state->redo_point)) >= buf_begin$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$C:\Users\55yar\Desktop\imgui-master\imstb_textedit.h$i >= 0 && i < Size$idx <= obj->TextLen
API String ID: 2490902527-1648308927
Opcode ID: cba7749c605e8c7e24c6b8a343890df7f9a2b9aba5917ea33c91d25d186e9d41
Instruction ID: 7149f754e7bd5df4f71b60c62e91b4dde445743d49fca9c7959e5b9de1cfbb8d
Opcode Fuzzy Hash: cba7749c605e8c7e24c6b8a343890df7f9a2b9aba5917ea33c91d25d186e9d41
Instruction Fuzzy Hash: 5391DCB2B14B8582EF44DF28D044BBCB762FB95B88F884135CE4A17659DBBCE542C721

Function 00007FF762AC19E0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 180COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140(00000000,?,00000000,?,00007FF762AC1E8F), ref: 00007FF762AC1C6E

Strings

font_cfg->SizePixels > 0.0f && "Is ImFontConfig struct correctly initialized?", xrefs: 00007FF762AC1A60
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AC1BD7, 00007FF762AC1C0F
!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF762AC1A13
font_cfg->OversampleH > 0 && font_cfg->OversampleV > 0 && "Is ImFontConfig struct correctly initialized?", xrefs: 00007FF762AC1A86
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC1A0C, 00007FF762AC1A32, 00007FF762AC1A59, 00007FF762AC1A7F, 00007FF762AC1BAB
font_cfg->FontData != 0 && font_cfg->FontDataSize > 0, xrefs: 00007FF762AC1A39
Size > 0, xrefs: 00007FF762AC1BDE, 00007FF762AC1C16
Fonts.Size > 0 && "Cannot use MergeMode for the first font", xrefs: 00007FF762AC1BB2

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$Fonts.Size > 0 && "Cannot use MergeMode for the first font"$Size > 0$font_cfg->FontData != 0 && font_cfg->FontDataSize > 0$font_cfg->OversampleH > 0 && font_cfg->OversampleV > 0 && "Is ImFontConfig struct correctly initialized?"$font_cfg->SizePixels > 0.0f && "Is ImFontConfig struct correctly initialized?"
API String ID: 2490902527-1408190167
Opcode ID: b09eefd3328623ce888b009cefca10f17047618d8816258d79a3665aee2993cc
Instruction ID: 1121254c0b4cbe5d94eeb289e9d8cf7a98782c89422176b5042bff660e4447f5
Opcode Fuzzy Hash: b09eefd3328623ce888b009cefca10f17047618d8816258d79a3665aee2993cc
Instruction Fuzzy Hash: 19918C32608B82D6EF90EF25E840AA8B7A4FB44B84F844136CE4D43365DFBCD5A9D751

Function 000001F7840C2A10 Relevance: 15.2, APIs: 10, Instructions: 190COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 000001F7840C2A62

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

std::make_error_code.LIBCPMTD ref: 000001F7840C2AB6
std::make_error_code.LIBCPMTD ref: 000001F7840C2AF1

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 2527301759-0
Opcode ID: 71ef438b1bb58b4182dc28e9ffd7d5b29104a32867a1bdd3a258c92d20c36c8b
Instruction ID: 5018510df6d9a489adc8755a6d5d25acdfd077bff6f443c48a3217fd2df2f5f6
Opcode Fuzzy Hash: 71ef438b1bb58b4182dc28e9ffd7d5b29104a32867a1bdd3a258c92d20c36c8b
Instruction Fuzzy Hash: B2611B7062C7569BE264DF19C498BBBB6E1BBC43D0F4008BDF086C75E2DAA4DC41D642

Function 00007FF762AC0850 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 322COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00007FF762ABD0B7), ref: 00007FF762AC0A83
00007FF8B9F61310.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00007FF762ABD0B7), ref: 00007FF762AC0C0C
00007FF8B9F61310.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00000000,00007FF762ABD0B7), ref: 00007FF762AC0C2C

Strings

it >= Data && it < Data + Size, xrefs: 00007FF762AC0A45
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AC08C7, 00007FF762AC0961, 00007FF762AC09CA, 00007FF762AC0A3E, 00007FF762AC0BD7, 00007FF762AC0C75
i >= 0 && i < Size, xrefs: 00007FF762AC0968, 00007FF762AC09D1, 00007FF762AC0BDE
Size > 0, xrefs: 00007FF762AC08CE, 00007FF762AC0C7C
, xrefs: 00007FF762AC0C34

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: $C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$i >= 0 && i < Size$it >= Data && it < Data + Size
API String ID: 2490902527-669993125
Opcode ID: 71389e765cdf82a4882dcaf081e1e13a47cd802ca95431e42650f4a32f630d61
Instruction ID: 6b158d3b33fbc9c562e94b75cfbd0913b37079a51aab216692873e1dfa7692a3
Opcode Fuzzy Hash: 71389e765cdf82a4882dcaf081e1e13a47cd802ca95431e42650f4a32f630d61
Instruction Fuzzy Hash: 65E19EB2B08A86CAEF94DF15D440B69A3A5FB84B84F858135CE4E87764DFB8E441CB50

Function 00007FF762AA3320 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 206COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AA34DD
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AA353A

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AA360E
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AA34F4, 00007FF762AA3551
<NULL>, xrefs: 00007FF762AA3456
i >= 0 && i < Size, xrefs: 00007FF762AA34FB, 00007FF762AA3558
window == 0 || window->RootWindow != 0, xrefs: 00007FF762AA3615
[focus] FocusWindow("%s", UnlessBelowModal): prevented by "%s"., xrefs: 00007FF762AA3461

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: <NULL>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$[focus] FocusWindow("%s", UnlessBelowModal): prevented by "%s".$i >= 0 && i < Size$window == 0 || window->RootWindow != 0
API String ID: 2490902527-1613245857
Opcode ID: 38ba76fbec77e7e4ee3866a5998e65f7bd94d7ae0fa5277d0de83dec56c81f92
Instruction ID: 4bd65dd97c4fc1f83acd4e03adeb7a07a0a03343be56fcbf0e69f056323cb14c
Opcode Fuzzy Hash: 38ba76fbec77e7e4ee3866a5998e65f7bd94d7ae0fa5277d0de83dec56c81f92
Instruction Fuzzy Hash: 0AA19132A09682DAEFE9AF15D144AF9E791EF40780F880036DE9D07A95DFECE454C361

Function 00007FF762ACDF40 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 114COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ACE006

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762ACE069, 00007FF762ACE0CA
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762ACE115
table->MemoryCompacted == false, xrefs: 00007FF762ACDF6F
i >= 0 && i < Size, xrefs: 00007FF762ACE11C
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF762ACDF68
p >= Buf.Data && p < Buf.Data + Buf.Size, xrefs: 00007FF762ACE0D1
p >= Data && p < DataEnd, xrefs: 00007FF762ACE070

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$i >= 0 && i < Size$p >= Buf.Data && p < Buf.Data + Buf.Size$p >= Data && p < DataEnd$table->MemoryCompacted == false
API String ID: 1173767890-1783795845
Opcode ID: 05490356745c638e72b665715467a340bbf28cbfda5662b06804bd3badcdefa0
Instruction ID: 2afea86ff3bc6001a5b811fe9de8ae8d5c114f253bcd9ba885e3f47fb9d4d805
Opcode Fuzzy Hash: 05490356745c638e72b665715467a340bbf28cbfda5662b06804bd3badcdefa0
Instruction Fuzzy Hash: 8D51BA72A08A82C6DF50AF14E8546E8B7A4FB54B88F880036CE4D4B7A4DFFDE146C750

Function 000001F78409A850 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F78409A955
shared_ptr.LIBCMTD ref: 000001F78409A9C3

Strings

d, xrefs: 000001F78409A95C

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Decorator::getTableTypeshared_ptr
String ID: d
API String ID: 143873753-2564639436
Opcode ID: 69cead7afb0e039ecb5138173952be44cfc6b8be8a7abe79b5a91df074882742
Instruction ID: a089e327300074397895baebc23ce0f07a6edb93e9a815dae47591dd60038546
Opcode Fuzzy Hash: 69cead7afb0e039ecb5138173952be44cfc6b8be8a7abe79b5a91df074882742
Instruction Fuzzy Hash: EE91213051C7898FD794EF28C458BABBBE1FFD9340F4409ADB489C32A2DA749945CB42

Function 000001F78409AB60 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F78409AC65
shared_ptr.LIBCMTD ref: 000001F78409ACD3

Strings

d, xrefs: 000001F78409AC6C

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Decorator::getTableTypeshared_ptr
String ID: d
API String ID: 143873753-2564639436
Opcode ID: 1a6a6722034d945976169db871c6d8bc4f2ed9e348582280147d843b730620fb
Instruction ID: 782072ce34f90663cfc2bc888f7bd569dd21cc8f34c54fd93bcca05455e36a0c
Opcode Fuzzy Hash: 1a6a6722034d945976169db871c6d8bc4f2ed9e348582280147d843b730620fb
Instruction Fuzzy Hash: 1591243051C7898FD794EF28C458BABBBE1FFD9340F4449ADB489C32A2DA749945CB42

Function 000001F78409A540 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F78409A647
shared_ptr.LIBCMTD ref: 000001F78409A6B5

Strings

d, xrefs: 000001F78409A64E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Decorator::getTableTypeshared_ptr
String ID: d
API String ID: 143873753-2564639436
Opcode ID: 2612a0b920fc091130e9c3c3613e0ec6eef3206baac283914f1a5a83fc148c58
Instruction ID: 770fc16a9271cfadac68ed4f8c3a9ebc3eebdfc8b7ddaea3bb7be12b6775c698
Opcode Fuzzy Hash: 2612a0b920fc091130e9c3c3613e0ec6eef3206baac283914f1a5a83fc148c58
Instruction Fuzzy Hash: 6991203061C7898FD794EF28C4587ABBBE1FFD9340F4409ADB489C32A2DA749945CB52

Function 00007FF762AC4020 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 216COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF762AB50E0: 00007FF8C61149A0.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF762AB5139

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC43A0

Strings

user_rects.Size >= 1, xrefs: 00007FF762AC4074
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AC4100, 00007FF762AC4128, 00007FF762AC4156, 00007FF762AC417E, 00007FF762AC41C6, 00007FF762AC421A, 00007FF762AC4245, 00007FF762AC4280, 00007FF762AC42AC
pack_context != 0, xrefs: 00007FF762AC4054
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC404D, 00007FF762AC406D, 00007FF762AC42D4
i >= 0 && i < Size, xrefs: 00007FF762AC4107, 00007FF762AC412F, 00007FF762AC415D, 00007FF762AC4185, 00007FF762AC41CD, 00007FF762AC4221, 00007FF762AC424C, 00007FF762AC4287, 00007FF762AC42B3
pack_rects[i].w == user_rects[i].Width && pack_rects[i].h == user_rects[i].Height, xrefs: 00007FF762AC42DB

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C610C61149F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$i >= 0 && i < Size$pack_context != 0$pack_rects[i].w == user_rects[i].Width && pack_rects[i].h == user_rects[i].Height$user_rects.Size >= 1
API String ID: 3027678408-766226355
Opcode ID: 772eaf52f8a00a670f05471158b65ee58448afbc09224eec8e1d511d86153d15
Instruction ID: ad7b1f0ae0baa66023cac5564f7043d85856dde6dfec79540d0425e36b38c573
Opcode Fuzzy Hash: 772eaf52f8a00a670f05471158b65ee58448afbc09224eec8e1d511d86153d15
Instruction Fuzzy Hash: 2FA16B72B08A52D6EF84AF15D4409B8A765FB90B88B804136CE8E477A4DFFCE546C760

Function 00007FF762A9D070 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 172COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762A9D2E0

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A9D109, 00007FF762A9D1FE
it >= Data && it < Data + Size, xrefs: 00007FF762A9D2AB
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9D1C8, 00007FF762A9D23F, 00007FF762A9D2A4
g.WindowsFocusOrder[window->FocusOrder] == window, xrefs: 00007FF762A9D205
i >= 0 && i < Size, xrefs: 00007FF762A9D1CF, 00007FF762A9D246
!g.WindowsFocusOrder.contains(window), xrefs: 00007FF762A9D110

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: !g.WindowsFocusOrder.contains(window)$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$g.WindowsFocusOrder[window->FocusOrder] == window$i >= 0 && i < Size$it >= Data && it < Data + Size
API String ID: 2490902527-3130785268
Opcode ID: 9f02b039fdcaa7b742a3d60f602bcfec43f35c8abd80d2da92b53ff394a33b45
Instruction ID: a0c14a1c7c420cc002e3804e161d986c7ced669567c3020cb2849a07d3552abf
Opcode Fuzzy Hash: 9f02b039fdcaa7b742a3d60f602bcfec43f35c8abd80d2da92b53ff394a33b45
Instruction Fuzzy Hash: C4719132B15A82D1DF60AF15D840AF8A761FB94B84FA44032CE4E47654CFF9E996C720

Function 00007FF762A9B560 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 159COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762A9B7D7

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A9B703
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9B5AC, 00007FF762A9B6A9, 00007FF762A9B722, 00007FF762A9B769
i >= 0 && i < Size, xrefs: 00007FF762A9B5B3
Size > 0, xrefs: 00007FF762A9B6B0, 00007FF762A9B729
cmd.ElemCount == 6, xrefs: 00007FF762A9B70A
it >= Data && it <= Data + Size, xrefs: 00007FF762A9B770

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$cmd.ElemCount == 6$i >= 0 && i < Size$it >= Data && it <= Data + Size
API String ID: 2490902527-3684587188
Opcode ID: 32f969d57518e8ff86bb7a1ee6f74f0bf99713afd0104c017ab027245c74de74
Instruction ID: ac2ffd7662d20e5fb03f7769a98284f8db765e27e053c8cc55b6ea9bbd95c4e6
Opcode Fuzzy Hash: 32f969d57518e8ff86bb7a1ee6f74f0bf99713afd0104c017ab027245c74de74
Instruction Fuzzy Hash: 6C81D322A18AC5D2EB509B2AD8407B9B320FF98744F949331DE8D176A4DFFDE586C710

Function 000001F7840A0EC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 000001F78405A110: char_traits.LIBCPMTD ref: 000001F78405A13D

type_info::_name_internal_method.LIBCMTD ref: 000001F7840A0F36
type_info::_name_internal_method.LIBCMTD ref: 000001F7840A0F55
type_info::_name_internal_method.LIBCMTD ref: 000001F7840A0FE6
type_info::_name_internal_method.LIBCMTD ref: 000001F7840A1041
type_info::_name_internal_method.LIBCMTD ref: 000001F7840A1093

Strings

, xrefs: 000001F7840A0F08
', xrefs: 000001F7840A0F6D

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$char_traits
String ID: $'
API String ID: 2432257368-2481900351
Opcode ID: 52a6df86987effc56c3942b1dc471f96e7d443776264125f91504f2597ebadb0
Instruction ID: 9b9738b71ff56e52bb063a99cae3e1d2ec119bf1eb3fa45eac3ea32a1ca2ca52
Opcode Fuzzy Hash: 52a6df86987effc56c3942b1dc471f96e7d443776264125f91504f2597ebadb0
Instruction Fuzzy Hash: 5251313151CB898FD3A0FF14C489BEBB7E1FB98341F40496DA08AC72A2DEB49544CB42

Function 00007FF762AE0C30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

TrackMouseEvent.USER32 ref: 00007FF762AE0CCE
GetMessageExtraInfo.USER32 ref: 00007FF762AE126A
TrackMouseEvent.USER32 ref: 00007FF762AE12FB
TrackMouseEvent.USER32 ref: 00007FF762AE1305
ScreenToClient.USER32 ref: 00007FF762AE1331

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AE134E
Ctx != 0, xrefs: 00007FF762AE1355

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: EventMouseTrack$ClientExtraInfoMessageScreen
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 3561655495-3890275027
Opcode ID: abe9a299fd20b9a6fbd2fc3767dffb8d4ebf984e011b516c80763c98f3087046
Instruction ID: 24817844a4bb35861d4a674b9a7f6365db5527818e8bac97a3ce765531353742
Opcode Fuzzy Hash: abe9a299fd20b9a6fbd2fc3767dffb8d4ebf984e011b516c80763c98f3087046
Instruction Fuzzy Hash: 9561F072B08652DAEB90DF61D440ABDB3B5FB44744F98403ADE8A53A94CFF8E846D710

Function 00007FF762A9CB20 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 130COMMON

Download Yara Rule

APIs

__swprintf_l.LIBCMT ref: 00007FF762A9CC55
__swprintf_l.LIBCMT ref: 00007FF762A9CC67

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A9CB5A
#Child, xrefs: 00007FF762A9CCB9
id != 0, xrefs: 00007FF762A9CB61
%s/%s_%08X, xrefs: 00007FF762A9CC49
%s/%08X, xrefs: 00007FF762A9CC5C

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: __swprintf_l
String ID: #Child$%s/%08X$%s/%s_%08X$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$id != 0
API String ID: 1488884202-1586801193
Opcode ID: 6db79fa99209152f1d7b5e30e8589ad90eaa443debf081e66ebce48769e8c08d
Instruction ID: d3577692cfc2d409aac9d5ad442673579ef00ef9ed753db9a4b12e42aa91d83c
Opcode Fuzzy Hash: 6db79fa99209152f1d7b5e30e8589ad90eaa443debf081e66ebce48769e8c08d
Instruction Fuzzy Hash: FB51DC32E08A85D6EB94EF269440AE9B7A1FF98744F948136DF4803691CFF8A4A5C710

Function 00007FF762AB43E0 Relevance: 12.4, APIs: 8, Instructions: 350COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB446E
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB455A
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB45DA
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB46F6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB4806
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB48E6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB4966
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB49E7

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID:
API String ID: 1173767890-0
Opcode ID: 3bdaf2d7e444b422f850cb11a475b2b945d7ea902e82f7935716d9e8c5838d19
Instruction ID: f49f4b8713023d3c7de204f9db29272ffb1977a4eb0076b5c537937925a7dff0
Opcode Fuzzy Hash: 3bdaf2d7e444b422f850cb11a475b2b945d7ea902e82f7935716d9e8c5838d19
Instruction Fuzzy Hash: 7E026E32A19982D2DB89FF65D5954FCE374FB54B40B904232DB0E831A1DFB8E56AC710

Function 00007FF762AB9E40 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 426COMMON

Download Yara Rule

Strings

z->direction, xrefs: 00007FF762ABA008
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF762ABA001, 00007FF762ABA0E1, 00007FF762ABA17E
z->ey >= scan_y_top, xrefs: 00007FF762ABA185
z != 0, xrefs: 00007FF762ABA0E8

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$z != 0$z->direction$z->ey >= scan_y_top
API String ID: 0-479673919
Opcode ID: 9fd9bdd6ad68a8098bfebc2115c419c8b9b529cc5a024d7a6b8dab4b64df2eeb
Instruction ID: cdd331983efad8f2785895fa2488b7b863fdeafaf112a8cf0edbef2ff9f16581
Opcode Fuzzy Hash: 9fd9bdd6ad68a8098bfebc2115c419c8b9b529cc5a024d7a6b8dab4b64df2eeb
Instruction Fuzzy Hash: BA12F432908AC5C6DB92DF36D0416A9F3A0FF58785F588322DE4963665EFB8E195CB00

Function 00007FF762A98380 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A98442
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A984FA
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A9858A

Part of subcall function 00007FF762A981E0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A98269
Part of subcall function 00007FF762A981E0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A982E9
Part of subcall function 00007FF762A981E0: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A9836A

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A98624

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A983B3
DrawList == &DrawListInst, xrefs: 00007FF762A983BA

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$DrawList == &DrawListInst
API String ID: 1173767890-20161693
Opcode ID: 8f0dc90c3efb46d4bbd22a949c9ecc273bb37a15ecf20fa59b12ee5c9ffabb3b
Instruction ID: 3ec18252835dc219e72385753796c63cd6b66b3fef03e37a3eec2cb7ba5a89cd
Opcode Fuzzy Hash: 8f0dc90c3efb46d4bbd22a949c9ecc273bb37a15ecf20fa59b12ee5c9ffabb3b
Instruction Fuzzy Hash: FF71E172A19A82C6CB85EF14D4955FCB3B5FB54B84FA84236CE0E87260DFB8D55AC340

Function 00007FF762ACCA90 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762ACCB41
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ACCBC0

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762ACCC4E
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF762ACCC78
column->SortOrder < table->SortSpecsCount, xrefs: 00007FF762ACCC7F
p >= Data && p < DataEnd, xrefs: 00007FF762ACCC55

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C610F020F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$column->SortOrder < table->SortSpecsCount$p >= Data && p < DataEnd
API String ID: 310658293-2291414753
Opcode ID: 0431d1fd47e77aa1f7e3d261d8250983adf7b6efdf7b2589177fc9585646c7a3
Instruction ID: 08d8fc8998e124f34a75cbb0b5c47b5b988a83e023937154e3ab07c49792568d
Opcode Fuzzy Hash: 0431d1fd47e77aa1f7e3d261d8250983adf7b6efdf7b2589177fc9585646c7a3
Instruction Fuzzy Hash: 2A619F32708A92D6DB48EF29D1845BCB761FB44B40F844136DF5D873A4DBB8E566C710

Function 00007FF762AD38D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 117COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD39CD
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD39E0

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AD3A05
pos <= text_len, xrefs: 00007FF762AD3909
i >= 0 && i < Size, xrefs: 00007FF762AD3A0C
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762AD3902

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$i >= 0 && i < Size$pos <= text_len
API String ID: 2490902527-3124524525
Opcode ID: 43148d90905608da133ba6f2dc9b7995a38c7d11a5028563e3b51f33180f49da
Instruction ID: 46ba8472ef444fdf6e0b1f0f179d7885b1af71fb15f535243467485baf1ca241
Opcode Fuzzy Hash: 43148d90905608da133ba6f2dc9b7995a38c7d11a5028563e3b51f33180f49da
Instruction Fuzzy Hash: 3E41E532B08646C6EF64AB15E8506BAF761FB84784F840435DECE43695DEFCE582C720

Function 000001F78408FBC0 Relevance: 9.4, APIs: 6, Instructions: 410COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F78408FC91

Part of subcall function 000001F784090350: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78409035E

Part of subcall function 000001F784093150: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784093163

bool_.LIBCPMTD ref: 000001F78408FDA3
shared_ptr.LIBCMTD ref: 000001F78408FDB0
UnDecorator::getVbTableType.LIBCMTD ref: 000001F78408FE53
bool_.LIBCPMTD ref: 000001F78408FF3B
shared_ptr.LIBCMTD ref: 000001F78408FF48

Part of subcall function 000001F784093080: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78409308E
Part of subcall function 000001F784093080: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840930C4

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Decorator::getTableTypebool_shared_ptr
String ID:
API String ID: 2413108386-0
Opcode ID: 860d05d0c23d945e2812b9969cd3f9d0f2eb79ac7c3eafe6dc3321d711d52ae6
Instruction ID: e7051b59068a3c5de9dd774eb80882c1e616cb29ccff1c57a1b5e9a55c977439
Opcode Fuzzy Hash: 860d05d0c23d945e2812b9969cd3f9d0f2eb79ac7c3eafe6dc3321d711d52ae6
Instruction Fuzzy Hash: 7EF1C33111CA458FD765EF28C859BFBB7E1FF99340F5049ADA089C72E2DAB09944CB42

Function 000001F7840BE080 Relevance: 9.4, APIs: 6, Instructions: 408COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840BE0A3
Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840BE0B7
std::make_error_code.LIBCPMTD ref: 000001F7840BE0D0
std::make_error_code.LIBCPMTD ref: 000001F7840BE132
std::make_error_code.LIBCPMTD ref: 000001F7840BE300

Part of subcall function 000001F784066020: Concurrency::details::_ReaderWriterLock::_ReaderWriterLock.LIBCMTD ref: 000001F78406602E

std::make_error_code.LIBCPMTD ref: 000001F7840BE1B7

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::GroupReaderScheduleSegmentUnrealizedWriter$Concurrency::details::_LockLock::_std::error_condition::error_condition
String ID:
API String ID: 3233732842-0
Opcode ID: 4de1addda922bb358011cb094d11cd136575d8eaefb607a23010c85f2e40a63c
Instruction ID: 2664d1e4b8ba818bd94546c1f0bc1f37211bec4838357165c1d9fa555fefcabd
Opcode Fuzzy Hash: 4de1addda922bb358011cb094d11cd136575d8eaefb607a23010c85f2e40a63c
Instruction Fuzzy Hash: D7F18F3011C7898FD7A4EF28C459BEBB7E1FB95340F5048ADA58DC32D2DEB499458B42

Function 000001F78408BB60 Relevance: 9.1, APIs: 6, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F78408BBA6
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 000001F78408BBC9
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 000001F78408BBEF
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 000001F78408BC62
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 000001F78408BC88
List.LIBCMTD ref: 000001F78408BC94

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextIdentityQueueWork$Affinity::operator!=HardwareList
String ID:
API String ID: 2242293343-0
Opcode ID: 88a63c18065b4d406e2cb50c44761dcb7cf26b639b903796a9ee2bdb5b598967
Instruction ID: 8fc4a045b34ccdd8a03a057f73fc24b34dc52dc2e03449e81d10aa001df17fff
Opcode Fuzzy Hash: 88a63c18065b4d406e2cb50c44761dcb7cf26b639b903796a9ee2bdb5b598967
Instruction Fuzzy Hash: C941203011CA498FD794EF28D859BEBB7E0FBA4341F80496DA089D32D2EEB4D944C742

Function 000001F7840D1A30 Relevance: 9.1, APIs: 6, Instructions: 93COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1A5E

Part of subcall function 000001F7840A76A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840A76B8

type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1A80

Part of subcall function 000001F7840D0D30: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840D0D48

type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1AA2
type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1AC4
type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1AE6
type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1B08

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: aeb162027570cbcb45857eaeecfccc621a0a56d2e3941c5bc9fa514a50d9ad9c
Instruction ID: c1b18d0d621b013c4702a3a1d6e79531ac2f3895e8203bbf8abf7e6bdc7afb33
Opcode Fuzzy Hash: aeb162027570cbcb45857eaeecfccc621a0a56d2e3941c5bc9fa514a50d9ad9c
Instruction Fuzzy Hash: EF31783061CB898FDA94EF28C459BAFB7E1FB99380F50496DA48DC3292DA70D845C752

Function 00007FF762ACE150 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762ACE2FB
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762ACE432

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF762ACE1C5, 00007FF762ACE202, 00007FF762ACE332, 00007FF762ACE36F
p < end(), xrefs: 00007FF762ACE209, 00007FF762ACE376
p >= begin() && p < end(), xrefs: 00007FF762ACE1CC, 00007FF762ACE339

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C610F020F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$p < end()$p >= begin() && p < end()
API String ID: 310658293-1901453082
Opcode ID: 9aee298ee965694e484d48163432ec4cc781f88492cc277dff30295049130940
Instruction ID: b8ebff675e86648feee53dd29231bfc39f39a009ef26bd433882b0f34cdfe0e7
Opcode Fuzzy Hash: 9aee298ee965694e484d48163432ec4cc781f88492cc277dff30295049130940
Instruction Fuzzy Hash: 8981EE72B04A82D2EF58AB14DA496A8F3A5FB44B84F884136CE4D473A4EFBCE555C710

Function 00007FF762AC13B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC1484
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC1567
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC15F0

Strings

!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF762AC13DA
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC13D3

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 1173767890-3599239301
Opcode ID: a32acda8ac8af02c719bca1bcece888833a57668d5cda898378eef80b58275bd
Instruction ID: f81e93ace21217132651e856d406ac7a060a73f53a5cb2debea1723c155ed0fe
Opcode Fuzzy Hash: a32acda8ac8af02c719bca1bcece888833a57668d5cda898378eef80b58275bd
Instruction Fuzzy Hash: 6361A0B2B09A46D6DF85EF14E1546BCB3B0FB14B84B948226CB1E43364DFB8D56AC740

Function 00007FF762A92E30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

00007FF8C6118950.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF762A92EC1
00007FF8C6118950.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF762A92EEC
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A92FA9

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762A92E51
filename && mode, xrefs: 00007FF762A92E58

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$C6118950$C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$filename && mode
API String ID: 3653100989-1878659873
Opcode ID: f2c59e7ee1b2eeed8209b2d3b8f89095980b2d1d2566467a124b1568a8a534f6
Instruction ID: 6df993e1d39086819258e18b2f87203c8076d9952b9b57a098c33b82c251e976
Opcode Fuzzy Hash: f2c59e7ee1b2eeed8209b2d3b8f89095980b2d1d2566467a124b1568a8a534f6
Instruction Fuzzy Hash: BA41A321A19A42C1EF98FF16A844678E3A4EF94B94BA44132DD4E47B94DFFCE856C310

Function 00007FF762AE13F9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetMessageExtraInfo.USER32 ref: 00007FF762AE13F9
GetCapture.USER32 ref: 00007FF762AE1491
SetCapture.USER32 ref: 00007FF762AE149F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AE14BE
Ctx != 0, xrefs: 00007FF762AE14C5

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Capture$ExtraInfoMessage
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 2172523684-3890275027
Opcode ID: 923c053ce066281c7ac671ef25c172f5d6b9f676048f14a3257d116d11b5ca04
Instruction ID: f948ad0e4510626de87e20c4b626ece3ca6bb69c24254ff9152aab786d7b6186
Opcode Fuzzy Hash: 923c053ce066281c7ac671ef25c172f5d6b9f676048f14a3257d116d11b5ca04
Instruction Fuzzy Hash: 8C210CB6605A42C2EB91DB25D400AB9B394FF44BA4FC00131DE6D47394DFB8E947D750

Function 00007FF762AB1F40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

printf.MSPDB140-MSVCRT ref: 00007FF762AB203E

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AB2019
[%05d] , xrefs: 00007FF762AB1FAF
[%s] [%05d] , xrefs: 00007FF762AB1F9A
Size > 0, xrefs: 00007FF762AB2020

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: printf
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$[%05d] $[%s] [%05d]
API String ID: 3524737521-3476604433
Opcode ID: 3791ea77b646f4efedb4acf6e20016a352b3f2d24d4217499d1552f2091f9011
Instruction ID: 1b801a95c66da64424f6de0befaa52b521941c8c84731ac76e46880affb662ed
Opcode Fuzzy Hash: 3791ea77b646f4efedb4acf6e20016a352b3f2d24d4217499d1552f2091f9011
Instruction Fuzzy Hash: FD21C172A04A42D5EF50AF12F8449EAE7A1FB44785F844036EE8D53664CFBCE845C710

Function 00007FF762ADFA50 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF762ADFAD2

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762ADFAAA
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF762ADFA84
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF762ADFAB1
bd != nullptr && "No platform backend to shutdown, or already shutdown?", xrefs: 00007FF762ADFA8B

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: FreeLibrary
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$bd != nullptr && "No platform backend to shutdown, or already shutdown?"
API String ID: 3664257935-1332676508
Opcode ID: 8892cb04782d5aeb6a338803f32bc4cec3f8f323c030194c26ef7242e1d1625e
Instruction ID: dac4038d3e9f608642e6265fe1175bac6e9cc5faa751db0d7240cd24505c338b
Opcode Fuzzy Hash: 8892cb04782d5aeb6a338803f32bc4cec3f8f323c030194c26ef7242e1d1625e
Instruction Fuzzy Hash: 47315E31A09A42D2EF94AF15E840A78B7A0FB54B84F88853ADE4D47774DFACE466C350

Function 00007FF762AE14F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetMessageExtraInfo.USER32 ref: 00007FF762AE14F3
GetCapture.USER32 ref: 00007FF762AE1573
ReleaseCapture.USER32 ref: 00007FF762AE157E

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AE1593
Ctx != 0, xrefs: 00007FF762AE159A

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: Capture$ExtraInfoMessageRelease
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 1767768705-3890275027
Opcode ID: cb19a9e6c1605ae45a3bbd78077dd2cfbef91a2a50fb1b9c956a217acb42d625
Instruction ID: 1b939758eabae3dc35c3925044e0b542c052900e4c898c680fcbe6f6c45a5ece
Opcode Fuzzy Hash: cb19a9e6c1605ae45a3bbd78077dd2cfbef91a2a50fb1b9c956a217acb42d625
Instruction Fuzzy Hash: 8E213462A15A52D2EF91AB65D400AB9A2A1FB84BD4FC00031CD8F07394CFFCE847D320

Function 000001F7840A5F20 Relevance: 8.0, APIs: 5, Instructions: 479COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 000001F7840A6127

Part of subcall function 000001F78407AB90: std::error_condition::error_condition.LIBCPMTD ref: 000001F78407ABAE

Part of subcall function 000001F7840855D0: _Func_class.LIBCONCRTD ref: 000001F7840855E3

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840A615A
std::make_error_code.LIBCPMTD ref: 000001F7840A61A5

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::Func_classGroupScheduleSegmentUnrealizedstd::error_condition::error_condition
String ID:
API String ID: 831135708-0
Opcode ID: 63f4ccc0c719f990fd2cecc369a8989cbc0d16d11778b62a075870b531d386af
Instruction ID: 6b48805ae326247b1cee9fd8a12b9fcfba67f74a6ded18d7bfbc334ff2e5e44b
Opcode Fuzzy Hash: 63f4ccc0c719f990fd2cecc369a8989cbc0d16d11778b62a075870b531d386af
Instruction Fuzzy Hash: 00F1453111CB498FE7A5EF24C859BEBB2E1FB94340F9049BDA44DC32D2DE7899458B42

Function 000001F7840A2740 Relevance: 7.9, APIs: 5, Instructions: 422COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840A27C5
std::make_error_code.LIBCPMTD ref: 000001F7840A2810
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840A2904
Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 000001F7840A2BB3

Part of subcall function 000001F7840AF6A0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840AF6CB

Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 000001F7840A2C8E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Scheduler$ProcessorProxyRoot::Virtual$Base::ChoresConcurrency::details::_EmptyGroupQueue::ScheduleScheduler::_SegmentStructuredUnrealizedWorkstd::make_error_code
String ID:
API String ID: 1866601945-0
Opcode ID: 1c48c8f7abf4ee09f37d3fb5ff55bc5fc80e92da85bd99eabbe83459b1591442
Instruction ID: be78eb4e49e98f6d14213721f5e50ec59abc1ec48d228a18e71ccf81f5ed2eb5
Opcode Fuzzy Hash: 1c48c8f7abf4ee09f37d3fb5ff55bc5fc80e92da85bd99eabbe83459b1591442
Instruction Fuzzy Hash: 86F1EF3161CB498FE7A5EF28C459BEBB3E1FB98340F40496EA48DC3291DE749585CB42

Function 000001F7840913D0 Relevance: 7.8, APIs: 5, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28bcf8cbf4f9d8ee0fb80cf63995194d2d98c00cad99854f8db27e055435d40e
Instruction ID: ef64274676969d92eb79650a16acb4839a6510eb330a58c049ccb7217d5f29ce
Opcode Fuzzy Hash: 28bcf8cbf4f9d8ee0fb80cf63995194d2d98c00cad99854f8db27e055435d40e
Instruction Fuzzy Hash: ABB1C23011CA898FDBA4EF18C495FAAB7E1FBD8345F50495DA08EC72A1DB70D881CB42

Function 000001F784085960 Relevance: 7.8, APIs: 5, Instructions: 294COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 000001F784085A03
fpos.LIBCPMTD ref: 000001F784085B8E
fpos.LIBCPMTD ref: 000001F784085BC9
fpos.LIBCPMTD ref: 000001F784085C3C

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 3f23ec98ed8d0db8145a29062c11fbcc78a6c96a5bf2dc5e6165215fd931549f
Instruction ID: f6e2ca325930c72aa9f4b0f919d3b92431a01a86c485443f7ba2a3331e5144c5
Opcode Fuzzy Hash: 3f23ec98ed8d0db8145a29062c11fbcc78a6c96a5bf2dc5e6165215fd931549f
Instruction Fuzzy Hash: 3EB1CC3021CB898FD7A4DF18C959BAAB7E0FBA9355F54096DA4DAC32D0D7B4D844CB02

Function 000001F7840C99B0 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 000001F7840C99F1

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

std::make_error_code.LIBCPMTD ref: 000001F7840C9A94
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840C9B96
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840C9BBA

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwarestd::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 1851498522-0
Opcode ID: 216af3604e034a8d617a86ff12bb7c94723bc8f844cd3d72ff026fb2d344c1b4
Instruction ID: 023b0c3ba42341dfdbaa90f566f59ed66ad21b42f7ac557ac7bfbb6da8724e7f
Opcode Fuzzy Hash: 216af3604e034a8d617a86ff12bb7c94723bc8f844cd3d72ff026fb2d344c1b4
Instruction Fuzzy Hash: 90A14F3111CB4A8BE765EF54C449BFFB3E1FB94394F400AADA08AC21E1DEB4D9458782

Function 000001F7840BF260 Relevance: 7.7, APIs: 5, Instructions: 229COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 000001F7840BF2A2

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

std::make_error_code.LIBCPMTD ref: 000001F7840BF373

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 2527301759-0
Opcode ID: 52cd85fabb40296642562d013464caab3b67d2761199756b925dca6721a50769
Instruction ID: 006790f53f667cea36cc70de251c14a5df69b05f3f1b53bd1d0955138993e8ef
Opcode Fuzzy Hash: 52cd85fabb40296642562d013464caab3b67d2761199756b925dca6721a50769
Instruction Fuzzy Hash: 0D91F23111C7899BE365EF24C459BEBB7E1FBD4380F40596DA08AC71E2DEB09944CB46

Function 000001F7840B6EA9 Relevance: 7.7, APIs: 5, Instructions: 198COMMON

Download Yara Rule

APIs

Mailbox.LIBCMTD ref: 000001F7840B6EF2
Mailbox.LIBCMTD ref: 000001F7840B6F2A
Mailbox.LIBCMTD ref: 000001F7840B6F95
Mailbox.LIBCMTD ref: 000001F7840B6FC6
Mailbox.LIBCMTD ref: 000001F7840B6FF0

Part of subcall function 000001F78407BC30: Mailbox.LIBCMTD ref: 000001F78407BC7E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Mailbox
String ID:
API String ID: 1763892119-0
Opcode ID: 06a3ff207c22bb6f37366860b149ab3668e7e4d9713726df24d0a8770affc0a8
Instruction ID: d6555532b3aab4f41d8dfe185c6cf3cb7e7f5b5fa82cbbe5415a0df94a168c60
Opcode Fuzzy Hash: 06a3ff207c22bb6f37366860b149ab3668e7e4d9713726df24d0a8770affc0a8
Instruction Fuzzy Hash: BF61433150CA898FD7A5EA18C458BFBB7E1FBA8345F400A6EA48AD3291DE71D944C743

Function 000001F7840726B0 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 000001F7840726D8
Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F784072767

Part of subcall function 000001F784070B80: std::error_condition::error_condition.LIBCPMTD ref: 000001F784070BB2

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840727FE
std::error_condition::error_condition.LIBCPMTD ref: 000001F78407286F
Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840728DC

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_$std::error_condition::error_condition$std::bad_exception::bad_exception
String ID:
API String ID: 3801495819-0
Opcode ID: 855e9fad3cf8b62679a3ed4dce5103e3daddbb4618be66b587f956b2a1f93412
Instruction ID: 323c83042bc52633af99a4b8f4b4c7b2df3734c36fb4d782aabf032f45524b4b
Opcode Fuzzy Hash: 855e9fad3cf8b62679a3ed4dce5103e3daddbb4618be66b587f956b2a1f93412
Instruction Fuzzy Hash: 3061FA3461CB498FD7A4EF28C488BEAB7E1FB98350F50896DE089C7291DB74D845CB42

Function 000001F7840EAAA0 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F7840EAAC8

Part of subcall function 000001F7840EC040: shared_ptr.LIBCPMTD ref: 000001F7840EC061

__crt_scoped_stack_ptr.LIBCPMTD ref: 000001F7840EAB47
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840EABA6
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840EABBD
__crt_scoped_stack_ptr.LIBCPMTD ref: 000001F7840EAC66

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork__crt_scoped_stack_ptr$Decorator::getTableTypeshared_ptr
String ID:
API String ID: 2480882750-0
Opcode ID: 91d403a99b0aa0b9c84ca8b623b580e6659b45cf93c11dcecb02eb8a3e2d9174
Instruction ID: cc0f4da5c3b45d747d27ccf7937594ea9216ea1daa9e820ebf94d2575b4ee35a
Opcode Fuzzy Hash: 91d403a99b0aa0b9c84ca8b623b580e6659b45cf93c11dcecb02eb8a3e2d9174
Instruction Fuzzy Hash: CB61E03051CB498FD7A4EF28C449BABB7E0FB98341F50496EA48DC32A1DB75D885CB42

Function 000001F7840EA5E0 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F7840EA608

Part of subcall function 000001F7840EC140: shared_ptr.LIBCPMTD ref: 000001F7840EC161

__crt_scoped_stack_ptr.LIBCPMTD ref: 000001F7840EA687
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840EA6E6
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840EA6FD
__crt_scoped_stack_ptr.LIBCPMTD ref: 000001F7840EA7A6

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork__crt_scoped_stack_ptr$Decorator::getTableTypeshared_ptr
String ID:
API String ID: 2480882750-0
Opcode ID: f2ef7a86016f0f96fb29ac205b938adafa905e91da66757f72e9247496227554
Instruction ID: 11eed52d6dcbc33679b0df2b6677730aba2d392d702290411ea28d305297f1d0
Opcode Fuzzy Hash: f2ef7a86016f0f96fb29ac205b938adafa905e91da66757f72e9247496227554
Instruction Fuzzy Hash: E961D07051CB498FD7A4EF28C449BABB7E0FB98341F50496EA48DC32A1DB75D885CB42

Function 000001F7840BFF60 Relevance: 7.7, APIs: 5, Instructions: 171COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840BFF83
Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840BFF97
std::make_error_code.LIBCPMTD ref: 000001F7840BFFB0
std::make_error_code.LIBCPMTD ref: 000001F7840C0003

Part of subcall function 000001F784066020: Concurrency::details::_ReaderWriterLock::_ReaderWriterLock.LIBCMTD ref: 000001F78406602E

std::make_error_code.LIBCPMTD ref: 000001F7840C0067

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::GroupReaderScheduleSegmentUnrealizedWriter$Concurrency::details::_LockLock::_std::error_condition::error_condition
String ID:
API String ID: 3233732842-0
Opcode ID: 8fc910353a04408718612e5cf30e4eda843c1b23e99fc2a10d87dd0fa77c1dfc
Instruction ID: afae80953270a59023e53f9d9c0a61d6f50e05d13fc57e74546e6ab101b85c9e
Opcode Fuzzy Hash: 8fc910353a04408718612e5cf30e4eda843c1b23e99fc2a10d87dd0fa77c1dfc
Instruction Fuzzy Hash: 4B51AF3011D6498BE2A4EF18C959BEBB3E1FB94340F5045BDA48DC32E2DEB49845CB46

Function 000001F7840C0D30 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840C0D65

Part of subcall function 000001F7840C42A0: type_info::_name_internal_method.LIBCMTD ref: 000001F7840C42B8

std::make_error_code.LIBCPMTD ref: 000001F7840C0D7E

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840C0DA7
std::make_error_code.LIBCPMTD ref: 000001F7840C0DC0

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwarestd::make_error_code$std::error_condition::error_conditiontype_info::_name_internal_method
String ID:
API String ID: 2306575402-0
Opcode ID: 4b51986160a4cd423a99c67445d446e796d3c0d4e65a0d82bc8bd3ca371d903f
Instruction ID: ac58d3de87420046e5a6312a2be1ef710e47f1a16d2bc13d0502df9f89ba3694
Opcode Fuzzy Hash: 4b51986160a4cd423a99c67445d446e796d3c0d4e65a0d82bc8bd3ca371d903f
Instruction Fuzzy Hash: F651723021C7468BE760EF64C4557FBB7E1FB84394F504AADA08AD61D2EAB4D904DB42

Function 00007FF762A92CA0 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF762A92CE2
MultiByteToWideChar.KERNEL32 ref: 00007FF762A92D05
MultiByteToWideChar.KERNEL32 ref: 00007FF762A92D53
MultiByteToWideChar.KERNEL32 ref: 00007FF762A92D73
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762A92DFC

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: ByteCharMultiWide$00007C610F020
String ID:
API String ID: 1061835773-0
Opcode ID: 238211e2dd296852fc445dc02d55ac6e72dd57f90259a6a8d4c8cb9abac53d7c
Instruction ID: dc2dd41d72fd2025ce6f888db7038cc0a3e19708c270d156f943779abee28049
Opcode Fuzzy Hash: 238211e2dd296852fc445dc02d55ac6e72dd57f90259a6a8d4c8cb9abac53d7c
Instruction Fuzzy Hash: 5B411132A08F4182D764EF16B8404A9B7A5FB88BD4F488236DE4D07BA4DF7CC55AC300

Function 000001F7840D1C70 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1C9E

Part of subcall function 000001F7840D0D30: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840D0D48

type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1CC0
type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1CE2
type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1D04
type_info::_name_internal_method.LIBCMTD ref: 000001F7840D1D26

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 1289f65bedd4f753d9bc64e073d9728bff9e2b420633cab40bd45a22262cb7c2
Instruction ID: e52a8c4610212de315c4c1066368902d0bfcea86be74981e6834e23bec912e41
Opcode Fuzzy Hash: 1289f65bedd4f753d9bc64e073d9728bff9e2b420633cab40bd45a22262cb7c2
Instruction Fuzzy Hash: 1D219F3061CB898FD6A4FF28C4597AFB7E1FBD8340F50496DA08DC3292DA70D8458752

Function 000001F78409BF60 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F78409BF8E

Part of subcall function 000001F7840A76A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840A76B8

type_info::_name_internal_method.LIBCMTD ref: 000001F78409BFB0
type_info::_name_internal_method.LIBCMTD ref: 000001F78409BFD2
type_info::_name_internal_method.LIBCMTD ref: 000001F78409BFF4
type_info::_name_internal_method.LIBCMTD ref: 000001F78409C016

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 815c5ab9791d234820be11a13cdb67723ff592c1cb60b69b78e51ea6d37036d7
Instruction ID: dce5d24c2d0324f7f35c60b56fe7379b4d946a3d1fe653bdc7722c5b4bab68bf
Opcode Fuzzy Hash: 815c5ab9791d234820be11a13cdb67723ff592c1cb60b69b78e51ea6d37036d7
Instruction Fuzzy Hash: 88216E3061CB498FD6A4FF28C4597AFB7E1FBD8340F90496DA48DC3292DA74D8458752

Function 000001F7840BFCF0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840BFD17

Part of subcall function 000001F7840C42A0: type_info::_name_internal_method.LIBCMTD ref: 000001F7840C42B8

std::make_error_code.LIBCPMTD ref: 000001F7840BFD2D

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840BFD50
std::make_error_code.LIBCPMTD ref: 000001F7840BFD66

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwarestd::make_error_code$std::error_condition::error_conditiontype_info::_name_internal_method
String ID:
API String ID: 2306575402-0
Opcode ID: 18c570fd0deab407a0f837e49046f6b791d582b1a6d6ce112fe98874db57e66e
Instruction ID: cae530a8932b8ecaa4f3d66ec9bf0fef5ea0b201b0f1015c6e2afa4615f75c33
Opcode Fuzzy Hash: 18c570fd0deab407a0f837e49046f6b791d582b1a6d6ce112fe98874db57e66e
Instruction Fuzzy Hash: 8F21FE3021CB4A9BE645EF24C459BFBB6E2FBC4380F4049BDA085C72E6DAA4D941D785

Function 000001F7840B94F0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840B951A
shared_ptr.LIBCMTD ref: 000001F7840B952E

Part of subcall function 000001F7840C1B90: shared_ptr.LIBCMTD ref: 000001F7840C1B9E

allocator.LIBCPMTD ref: 000001F7840B9542
shared_ptr.LIBCMTD ref: 000001F7840B9554
allocator.LIBCPMTD ref: 000001F7840B9568

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: shared_ptr$allocator$Affinity::operator!=Concurrency::details::Hardware
String ID:
API String ID: 1053258265-0
Opcode ID: 731d90d100de80035144f11b9cbff0f6121979b4b1cf63ee1738207ad95db791
Instruction ID: cd9d29225a666a782e64e9f8a27ebd9db77c42bfae1c27c6c120877e3b524a6c
Opcode Fuzzy Hash: 731d90d100de80035144f11b9cbff0f6121979b4b1cf63ee1738207ad95db791
Instruction Fuzzy Hash: 59111F7051CB498FD7A0EF28C4497EBBBE1FBD8391F404A6DA48DD3291DA70D9458B82

Function 000001F78405E510 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 341COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F78405E53C
type_info::_name_internal_method.LIBCMTD ref: 000001F78405E5F2
type_info::_name_internal_method.LIBCMTD ref: 000001F78405E6BA

Part of subcall function 000001F78405A110: char_traits.LIBCPMTD ref: 000001F78405A13D

Strings

, xrefs: 000001F78405E734

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$char_traits
String ID:
API String ID: 2432257368-3916222277
Opcode ID: fc3064d62a3cd5194dff096c9fc33b5f2c68b979ee5dc823d586b5ed394c8f21
Instruction ID: a8dc189f52fea1c8db7d9c67383f56e2c6775d617e532b7d6b853a88d8751aad
Opcode Fuzzy Hash: fc3064d62a3cd5194dff096c9fc33b5f2c68b979ee5dc823d586b5ed394c8f21
Instruction Fuzzy Hash: DEC1DA3152CB898BE765EF28C459BEBB3E1FB98344F410A6DA08AD31D1DF749944CB42

Function 00007FF762A97D10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 246COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762A97F8E

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A98054
#MOVE, xrefs: 00007FF762A980C0
Size > 0, xrefs: 00007FF762A9805B

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: #MOVE$C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 2490902527-319756798
Opcode ID: a965c5a7e196307ce80f4d594ba493067b977d02000f34dec74c3b5a605e1374
Instruction ID: 511f3ea786aa31f289bd23bd17e5086fe18cfd1f48b52a1ddb47eaba9df684ce
Opcode Fuzzy Hash: a965c5a7e196307ce80f4d594ba493067b977d02000f34dec74c3b5a605e1374
Instruction Fuzzy Hash: 07D15B32606BC1DAD754DF29E98879CB7A8F305B14FA94239CBA8073A0DF75E062C714

Function 000001F7840A3328 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840A374F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840A37BB
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840A3815

Strings

e, xrefs: 000001F7840A340C

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID: e
API String ID: 1865873047-4024072794
Opcode ID: a5aedeaa2a5e8da9842271219853bb447ad559dd74de6758b306763cffed3ded
Instruction ID: 2cbcd14609841b0089a89376ae665c15db3008233721c57962d369bbe2811b74
Opcode Fuzzy Hash: a5aedeaa2a5e8da9842271219853bb447ad559dd74de6758b306763cffed3ded
Instruction Fuzzy Hash: AE611D3151CB458FE794EF68C489BABB7E1FB98341F50096EE18AC72A1D7B4D841CB12

Function 00007FF762AB1090 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140(00000000,?,00000000,000001F7FF821C00,00007FF762AB0EC1,?,?,00000000,00007FF762A99F9A), ref: 00007FF762AB114C
00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AB12A7

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AB10C3
g.Initialized, xrefs: 00007FF762AB10CA

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$g.Initialized
API String ID: 2490902527-1422301356
Opcode ID: 3e9c344c1d301b24d002604c38042e59a87773ff59d66f59d2992e4b1af52429
Instruction ID: 4c94c0471f4388934e68b8dcf2426c4641e6b32936c86c28fe5311c2d5185e48
Opcode Fuzzy Hash: 3e9c344c1d301b24d002604c38042e59a87773ff59d66f59d2992e4b1af52429
Instruction Fuzzy Hash: C0612B52F0D682C5EF91AA15A808ABAE791AB41BC6FC84535CE5C87385EEFCD445C720

Function 000001F78406C5F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_Subatomic.LIBCONCRTD ref: 000001F78406C660
_Subatomic.LIBCONCRTD ref: 000001F78406C6FC

Strings

d, xrefs: 000001F78406C630

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Subatomic
String ID: d
API String ID: 3648745215-2564639436
Opcode ID: 54bdeb58da35ab94bcf85085278a1c4949db9dfd6b8a7e539e187413d69c00dd
Instruction ID: 1ca2a72b66b8839664c6db52d04ffc1b02b10a9d86125bcfb6db3a401f34bd63
Opcode Fuzzy Hash: 54bdeb58da35ab94bcf85085278a1c4949db9dfd6b8a7e539e187413d69c00dd
Instruction Fuzzy Hash: 1541F27021DB489FD754EF28C44D7ABB7E2FB99345F40596EA08AD3260DBB4D5408B42

Function 00007FF762AE1091 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32 ref: 00007FF762AE1094
MultiByteToWideChar.KERNEL32 ref: 00007FF762AE116F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AE1188
Ctx != 0, xrefs: 00007FF762AE118F

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: ByteCharMultiUnicodeWideWindow
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 3417139564-3890275027
Opcode ID: d9a610a5f53e9fa10297ec8690aded1cef327910e5f6d708596898dc3a383a64
Instruction ID: e91e2ba90eebd7ce25918c69cde377a735b784f675a063703aac0af2b4b1c254
Opcode Fuzzy Hash: d9a610a5f53e9fa10297ec8690aded1cef327910e5f6d708596898dc3a383a64
Instruction Fuzzy Hash: 0651D522B18652D6EBA5DF24C450AB9A3A1FB44B48F984036DE8D47A84DFFCDC47D720

Function 00007FF762AB41F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB4304
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB43C6

Strings

!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF762AB4224, 00007FF762AB4255
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AB421D, 00007FF762AB424E

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 1173767890-3599239301
Opcode ID: e21a51cd6fc816a2bd9147ba443e1185ee90a422f277b73c4d41c78987587b6a
Instruction ID: c8df96538cb0b3b3a34f5bfeb162e7d1529911b753f6e42c00f8ae05ccee70be
Opcode Fuzzy Hash: e21a51cd6fc816a2bd9147ba443e1185ee90a422f277b73c4d41c78987587b6a
Instruction Fuzzy Hash: 6F51BA72A08A82C2DF84EF14E4549BCB3B4FB58B81B984236CE4E43660DFBCD596C740

Function 000001F784054AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784054AD0
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F784054B2F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784054B41

Strings

, xrefs: 000001F784054B85

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 991905282-3916222277
Opcode ID: 36a22229416e564e8440cefac388c07ecd404f3bbc27db4e377a02a1a41e44dc
Instruction ID: 08fbd319a26adb4e2e50d532633b4fd178aaead3690951608fe1be7639554aa6
Opcode Fuzzy Hash: 36a22229416e564e8440cefac388c07ecd404f3bbc27db4e377a02a1a41e44dc
Instruction Fuzzy Hash: 9041E730118B458FE394EF28C4997ABBBE0FB84345F91596DB4D9D22A1CBB09845CB42

Function 00007FF762AA3110 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AA3241

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AA3138, 00007FF762AA3194, 00007FF762AA31D7, 00007FF762AA320B, 00007FF762AA325E
i >= 0 && i < Size, xrefs: 00007FF762AA319B, 00007FF762AA31DE, 00007FF762AA3212, 00007FF762AA3265
Size > 0, xrefs: 00007FF762AA313F

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$i >= 0 && i < Size
API String ID: 2490902527-3833649686
Opcode ID: 2d656bff229cbb4746685fbfad4308eb7320790fdcd0fb319f4a17860adbbdb5
Instruction ID: 59341679b87f4926cea7cb36f1506a79069ef30e571a5fe5f293c583b22e510e
Opcode Fuzzy Hash: 2d656bff229cbb4746685fbfad4308eb7320790fdcd0fb319f4a17860adbbdb5
Instruction Fuzzy Hash: 95415171A14A86D2EF94AB11E4809E9E765FF94B84F840135DEDE43A64CFECF249C360

Function 00007FF762AC1620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC16C6
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AC1744

Strings

!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF762AC1640
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC1639

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 1173767890-3599239301
Opcode ID: cb5a36fee1d6425d1c033b334fafb6d3c66ff7acfe97189d89c7330356846d2d
Instruction ID: d5a86cfbbc0aa060f11a063e46315c8aa0f006121fa37e1ced168a655108a0e7
Opcode Fuzzy Hash: cb5a36fee1d6425d1c033b334fafb6d3c66ff7acfe97189d89c7330356846d2d
Instruction Fuzzy Hash: CB31D173709A42C6CB85EF18D4954B8B3B5FB14B84B984237CA0E43364DFB8C5AAC740

Function 000001F7840C2950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 000001F7840C29A7

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

std::make_error_code.LIBCPMTD ref: 000001F7840C29D2
std::make_error_code.LIBCPMTD ref: 000001F7840C29EE

Strings

}, xrefs: 000001F7840C2996

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID: }
API String ID: 2527301759-4239843852
Opcode ID: be98c45c2635ea1b7c099d9ee1afc8aab728c4e80a3655f5ac3be0dc2360b2bb
Instruction ID: 69e2f8b12d5fe69b83159e6bd084cff0b3954f69a96f6e9eba50f21d3d718a56
Opcode Fuzzy Hash: be98c45c2635ea1b7c099d9ee1afc8aab728c4e80a3655f5ac3be0dc2360b2bb
Instruction Fuzzy Hash: 8E212C3051C6868BE364DF58C0487ABBBE1FB85390F5009BDE08AC25E1D6B4C9809706

Function 000001F7841179A0 Relevance: 6.5, APIs: 4, Instructions: 491COMMON

Download Yara Rule

APIs

Part of subcall function 000001F78405A170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405A18D

Part of subcall function 000001F78405A110: char_traits.LIBCPMTD ref: 000001F78405A13D

type_info::_name_internal_method.LIBCMTD ref: 000001F784117A14

Part of subcall function 000001F784139E50: type_info::_name_internal_method.LIBCMTD ref: 000001F784139EF0
Part of subcall function 000001F784139E50: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784139F56
Part of subcall function 000001F784139E50: CreateFileA.KERNEL32 ref: 000001F784139F82

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F784117AE4

Part of subcall function 000001F784055180: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784055217

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$EmptyQueue::StructuredWork$type_info::_name_internal_method$Affinity::operator!=CreateFileHardwarechar_traits
String ID:
API String ID: 2370075206-0
Opcode ID: a65eba7b441e30818a227a1c83e82e3293a1d35dbeeb2e9a63ea877c5ac8c65b
Instruction ID: 7a89a474d6b3adc4596e829e814e38a04cef1f69782d0ff6ae4c6d53d3b7b342
Opcode Fuzzy Hash: a65eba7b441e30818a227a1c83e82e3293a1d35dbeeb2e9a63ea877c5ac8c65b
Instruction Fuzzy Hash: A3020F3112CA498AE365FF24C459BEBB7E0FB94344F5149BEA08AD31E2DE709945CB42

Function 000001F7840B3900 Relevance: 6.4, APIs: 4, Instructions: 439COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840B3951

Part of subcall function 000001F784082880: _Ptr_base.LIBCMTD ref: 000001F784082893

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Base::ChoresConcurrency::details::GroupPtr_baseScheduleSegmentUnrealized
String ID:
API String ID: 3333744592-0
Opcode ID: 570f11bbdc05f9da95d07b3fdbdb974941727138929f366d8f2bea2d8099bd35
Instruction ID: e6b22028a668ba29e1922e1f400f5aa2266dbf572eb017203efe9d035cf7df30
Opcode Fuzzy Hash: 570f11bbdc05f9da95d07b3fdbdb974941727138929f366d8f2bea2d8099bd35
Instruction Fuzzy Hash: 0CF1CE3111CB8D8FE7A5EF18C859BEBB3E1FB98340F50496EA48DC3295DAB495448B42

Function 000001F7840A5890 Relevance: 6.4, APIs: 4, Instructions: 359COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840A5917
std::make_error_code.LIBCPMTD ref: 000001F7840A5992
Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 000001F7840A5B1C

Part of subcall function 000001F7840AF870: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840AF8CD
Part of subcall function 000001F7840AF870: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840AF8E4

Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 000001F7840A5CAB

Part of subcall function 000001F784086BC0: char_traits.LIBCPMTD ref: 000001F784086BE0

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Scheduler$Concurrency::details::$Concurrency::details::_ProcessorProxyRoot::Scheduler::_Virtual$Base::ChoresGroupScheduleSegmentUnrealizedchar_traitsstd::make_error_code
String ID:
API String ID: 3113402709-0
Opcode ID: 8315beeaeb721658927f8f770d131a9c147b9258a1641d469c0d50eda48e832c
Instruction ID: 55de320805da6e1214a7ae37b9354210e6ca19ef5362a46ebc5b0467c7f34ce5
Opcode Fuzzy Hash: 8315beeaeb721658927f8f770d131a9c147b9258a1641d469c0d50eda48e832c
Instruction Fuzzy Hash: 08C10E3151CB4D8FE7A5EB28C459BEBB3E1FBA8340F40096E948EC3291DE749945CB42

Function 000001F784062C70 Relevance: 6.4, APIs: 4, Instructions: 351COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784062CA2
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784062E63
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784062E78

Part of subcall function 000001F78405B170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405B17E
Part of subcall function 000001F78405B170: _Max_value.LIBCPMTD ref: 000001F78405B1A3
Part of subcall function 000001F78405B170: _Min_value.LIBCPMTD ref: 000001F78405B1D1

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F784062FB7

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
String ID:
API String ID: 348937374-0
Opcode ID: 9076abe83797b2f5b95f51d9a62a17b5c4646a91e0ea6bac038e2092eb8d8266
Instruction ID: f67cb720acb70ba312f58efd95b34bda4ed24c66846e433c6bbf60c475877219
Opcode Fuzzy Hash: 9076abe83797b2f5b95f51d9a62a17b5c4646a91e0ea6bac038e2092eb8d8266
Instruction Fuzzy Hash: DCD1AE3061CB898FD7A4EF18C459BABB7E1FBE8345F41496DA08DD32A1DA70D941CB42

Function 000001F784073390 Relevance: 6.3, APIs: 4, Instructions: 324COMMON

Download Yara Rule

APIs

std::error_condition::error_condition.LIBCPMTD ref: 000001F78407352B
std::error_condition::error_condition.LIBCPMTD ref: 000001F784073551

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::error_condition::error_condition
String ID:
API String ID: 246976077-0
Opcode ID: 5f3126eda9a4eb9af231d5239096d653e2129c4e3c35e502a72c1b9b8bd3846d
Instruction ID: 6588452c80310f04b5e3f47a3d805fb2d420431a25237e7a4bfb7891f945311f
Opcode Fuzzy Hash: 5f3126eda9a4eb9af231d5239096d653e2129c4e3c35e502a72c1b9b8bd3846d
Instruction Fuzzy Hash: B5C1023021CB498FE7A5EF28C455BEBB7E1FB98350F50496DA08AC3291DB75D941CB42

Function 000001F7840C1370 Relevance: 6.3, APIs: 4, Instructions: 304COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 000001F7840C1564

Part of subcall function 000001F7840950A0: char_traits.LIBCPMTD ref: 000001F7840950C1

Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 000001F7840C15C1

Part of subcall function 000001F7840CA0F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 000001F7840CA112

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Scheduler$Concurrency::details::Concurrency::details::_Decorator::getProcessorProxyRoot::Scheduler::_TableTypeVirtualchar_traits
String ID:
API String ID: 1673230147-0
Opcode ID: 54f13db51325af36e86bb9f0e7cfac0249b4394f15ed719d382bbe191eb23ca8
Instruction ID: fa05d74e8d0885f310f9d519322be8fa3655b4d06f0c6f37d5eb867bc47d5e79
Opcode Fuzzy Hash: 54f13db51325af36e86bb9f0e7cfac0249b4394f15ed719d382bbe191eb23ca8
Instruction Fuzzy Hash: 0CC1B87051CB898FE7A4EF18C489BEBB7E1FBA8340F50496E948DC3291DB749484CB42

Function 000001F7840C24C0 Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 000001F7840C24E3
std::make_error_code.LIBCPMTD ref: 000001F7840C24FC

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

std::make_error_code.LIBCPMTD ref: 000001F7840C253B

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::GroupScheduleSegmentUnrealizedstd::error_condition::error_condition
String ID:
API String ID: 1046759889-0
Opcode ID: 28292fa4d794b396cedd1ba8fdc4833dcd5acff12edfc6de44ad94c6088fe729
Instruction ID: f838742ef28bed9be7c693d88ee1842c685b191b2ab651971706e706084fa943
Opcode Fuzzy Hash: 28292fa4d794b396cedd1ba8fdc4833dcd5acff12edfc6de44ad94c6088fe729
Instruction Fuzzy Hash: 31B1AB3051CB898FD6A4EF28C459BEBB7E1FB98340F5049ADA48DC32D2DE719845CB42

Function 000001F78408BF20 Relevance: 6.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34be266543894efc96d51f676f5f1ca7cc37a58dd76303ca975cdefcda27a6da
Instruction ID: 4c113ae6aff1093a28845b7e09708968096d3f8908304c6142efff9f832f0d69
Opcode Fuzzy Hash: 34be266543894efc96d51f676f5f1ca7cc37a58dd76303ca975cdefcda27a6da
Instruction Fuzzy Hash: 8991F03011CA498FDB94EF18C495FAAB7F1FBE9344F50495DA08EC72A2DA70E941CB42

Function 000001F7840BDCB0 Relevance: 6.2, APIs: 4, Instructions: 212COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 000001F7840BDCED

Part of subcall function 000001F784068FE0: std::error_condition::error_condition.LIBCPMTD ref: 000001F784068FFE

std::make_error_code.LIBCPMTD ref: 000001F7840BDD3C

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 2527301759-0
Opcode ID: 58c7311be2cb89b8753877e7c75642fcbb82317ee9f238dba1156d6b4c2a68d4
Instruction ID: eda055f2970667c09e8e4a848995be3a94c866a967ce3330470e657efa8b927c
Opcode Fuzzy Hash: 58c7311be2cb89b8753877e7c75642fcbb82317ee9f238dba1156d6b4c2a68d4
Instruction Fuzzy Hash: 5081D03051CA8A8BE7A5EF18C459BFFB7E1FB94340F5049ADA08AC21E1DA749845DB42

Function 000001F784085700 Relevance: 6.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 000001F78408579A
fpos.LIBCPMTD ref: 000001F784085863
fpos.LIBCPMTD ref: 000001F7840858B2
fpos.LIBCPMTD ref: 000001F78408594F

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: a06c74410f647526738439c1d7a2df2a66b16ccba1c99b2313f6c08277eab004
Instruction ID: 39ac4e16dfc7ce28b71d6b054820814e7000b1a127cfd0cfb49e6a1912626f09
Opcode Fuzzy Hash: a06c74410f647526738439c1d7a2df2a66b16ccba1c99b2313f6c08277eab004
Instruction Fuzzy Hash: BD81F93051CB498FE7A4DB28C949B6BBBE0FB98351F54496DB4D9C32A0C664D840CB02

Function 000001F7840CB2A0 Relevance: 6.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840CB33B
type_info::_name_internal_method.LIBCMTD ref: 000001F7840CB462

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwaretype_info::_name_internal_method
String ID:
API String ID: 1927102706-0
Opcode ID: 31633297509520c3cf38a8ab650ddf2738620efd7f833d6bc15245c323a4a252
Instruction ID: dc62cd84b35b0e3645fe29c00466233d04fceeb667ff08fd901c92f035e47abf
Opcode Fuzzy Hash: 31633297509520c3cf38a8ab650ddf2738620efd7f833d6bc15245c323a4a252
Instruction Fuzzy Hash: B271CD3015CB49CFE6B5EF28D459BEBB7E1FB98350F80096DA48DC3291DA74D9428742

Function 000001F7840CB610 Relevance: 6.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F7840CB6AB
type_info::_name_internal_method.LIBCMTD ref: 000001F7840CB7D2

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwaretype_info::_name_internal_method
String ID:
API String ID: 1927102706-0
Opcode ID: 99a6b33ae6862e60c4063bc95135201a3c42c6b25746548689089e28a85fb9b4
Instruction ID: 63e07fcfb8aaac22b30684f117ffb0001a3f9a86c67707856fc544821ea68a5a
Opcode Fuzzy Hash: 99a6b33ae6862e60c4063bc95135201a3c42c6b25746548689089e28a85fb9b4
Instruction Fuzzy Hash: 21711E3011CA899FD6B1EF18C499BEBB3E1FB98350F40496DE489C3291DE74D9458B42

Function 000001F784068290 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 000001F78405A170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405A18D

type_info::_name_internal_method.LIBCMTD ref: 000001F7840683B2
type_info::_name_internal_method.LIBCMTD ref: 000001F7840683CD
type_info::_name_internal_method.LIBCMTD ref: 000001F78406840F
type_info::_name_internal_method.LIBCMTD ref: 000001F78406842A

Part of subcall function 000001F78405A110: char_traits.LIBCPMTD ref: 000001F78405A13D

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWorkchar_traits
String ID:
API String ID: 1744367693-0
Opcode ID: 30ffffbc32562f55399461986d00f4272352037bfd5b746e90ae5d919702b9bf
Instruction ID: 5174eb7b60fbf20297c9b9ab0d023d95fe0e8b5b93d58df33ed608d5b705fbb4
Opcode Fuzzy Hash: 30ffffbc32562f55399461986d00f4272352037bfd5b746e90ae5d919702b9bf
Instruction Fuzzy Hash: C7512E3111CB859FE3A4EF18C449BABB7E1FB94344F401A6DA089D72E1EBB4D945CB42

Function 00007FF762AD59A0 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AD5A26
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AD5AA3
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AD5B20
00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AD5B9E

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID:
API String ID: 1173767890-0
Opcode ID: 87edbd7c1ca10c775655078cece7bcc32b684bf25203532633eabef71ff50005
Instruction ID: 5f185bfd5091ccc4b7b2e8da72d4df1778a1007f1b045dc35d3edc8baa414c93
Opcode Fuzzy Hash: 87edbd7c1ca10c775655078cece7bcc32b684bf25203532633eabef71ff50005
Instruction Fuzzy Hash: AA51A173619992C6CB89EF18D0954FCB3B1FB58B44B948227DA0E87260EFB8D55BC340

Function 000001F78408C210 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 000001F78408C2E4
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 000001F78408C2F4
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 000001F78408C305

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Affinity::operator!=Base::ContextHardwareIdentityQueueWorkshared_ptr
String ID:
API String ID: 714649587-0
Opcode ID: 56e7f5989e768847083db759d86a7ebfa7ab74bda9f1653fe54440c5e8e10927
Instruction ID: 06427782c68565fc14b6a337ba2a1baebc7296052e42ab30479fd74e5fb134b1
Opcode Fuzzy Hash: 56e7f5989e768847083db759d86a7ebfa7ab74bda9f1653fe54440c5e8e10927
Instruction Fuzzy Hash: 9841DE3011CE498FEB94EF18C499BABB7E1FBA8345F50096DB089C72A1DB74D941CB42

Function 000001F78412FC90 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 000001F78412FE90: _Byte_length.LIBCPMTD ref: 000001F78412FEFE

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F78412FD15
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F78412FD3E
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F78412FD75
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F78412FD9E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Byte_length
String ID:
API String ID: 1141060839-0
Opcode ID: a094d049b7394f019bb74d8a9ce6fa8793c3500efc0350374be82258551a5043
Instruction ID: c087189d01b985016b617732fea028f4ceaa2cec5fd060cf572c7540ce49b80d
Opcode Fuzzy Hash: a094d049b7394f019bb74d8a9ce6fa8793c3500efc0350374be82258551a5043
Instruction Fuzzy Hash: 6441E03051CB498FE754EF18C459BEBF7E0FB98341F50496EA089D32A1DE70A985CB42

Function 000001F7840DD460 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F7840DD48B

Part of subcall function 000001F7840A76A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840A76B8

type_info::_name_internal_method.LIBCMTD ref: 000001F7840DD4AA

Part of subcall function 000001F7840D0D30: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840D0D48

type_info::_name_internal_method.LIBCMTD ref: 000001F7840DD4C9
type_info::_name_internal_method.LIBCMTD ref: 000001F7840DD4E8

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 6ae970fd7b6ecd4af07a3924a38ebf6e4c6a300736612a1d38c72f7b099ca0b1
Instruction ID: 98c4cff1721f60d14f1c022c7681e7524bd4195c906d37d67d53d0e71b0bf8f4
Opcode Fuzzy Hash: 6ae970fd7b6ecd4af07a3924a38ebf6e4c6a300736612a1d38c72f7b099ca0b1
Instruction Fuzzy Hash: EB11913061CB498FD694FF38C4597AFBBE1FBD8380F50496DA089C32A2DA74D8458B52

Function 000001F7840AF060 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F7840AF08B

Part of subcall function 000001F7840A76A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840A76B8

type_info::_name_internal_method.LIBCMTD ref: 000001F7840AF0AA
type_info::_name_internal_method.LIBCMTD ref: 000001F7840AF0C9
type_info::_name_internal_method.LIBCMTD ref: 000001F7840AF0E8

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: cb956ee21f3a3aaa3678e7144402df0106a8d44125415de00697684bfe6ddcac
Instruction ID: ca678fd46076b67a617779bba63c37a4483011ff794556cfbda5cc858c30f691
Opcode Fuzzy Hash: cb956ee21f3a3aaa3678e7144402df0106a8d44125415de00697684bfe6ddcac
Instruction Fuzzy Hash: 6A119F3061CB458FD694FF38C4597AFB7E1FBD8380F50496DA489C32A2DA74D8458B52

Function 000001F78409B130 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 000001F78409B15B

Part of subcall function 000001F7840A76A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 000001F7840A76B8

type_info::_name_internal_method.LIBCMTD ref: 000001F78409B17A
type_info::_name_internal_method.LIBCMTD ref: 000001F78409B199
type_info::_name_internal_method.LIBCMTD ref: 000001F78409B1B8

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 5ebaa40a4f578ec32dc140cd4265ac4d15574f18a09faa97c36fcb5168890ab8
Instruction ID: ac63b6439eb72c3e684a0609526f9a7cf671f4c05e7b69eac58a96fc6401cb14
Opcode Fuzzy Hash: 5ebaa40a4f578ec32dc140cd4265ac4d15574f18a09faa97c36fcb5168890ab8
Instruction Fuzzy Hash: 4A119F3061CB458FD694FF38C459BAFB7E1FBD8380F50496DA089C32A2DA74D8458B52

Function 000001F7840933B0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

_Func_class.LIBCONCRTD ref: 000001F7840933C3
_Func_class.LIBCONCRTD ref: 000001F78409341D

Part of subcall function 000001F784089830: _Func_class.LIBCONCRTD ref: 000001F78408983E
Part of subcall function 000001F784089830: _Func_class.LIBCONCRTD ref: 000001F78408989C

_Func_class.LIBCONCRTD ref: 000001F784093441
_Func_class.LIBCONCRTD ref: 000001F78409344D

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Func_class
String ID:
API String ID: 1670654298-0
Opcode ID: 38473aa2b5a61d29b27f22a10d69b211cbe67f00fd19cdafc6ac81fe98dbe0f4
Instruction ID: e5d47621778b9eb37dccca9dbe5b2fa352e840583eb824c377c82a5a96f624de
Opcode Fuzzy Hash: 38473aa2b5a61d29b27f22a10d69b211cbe67f00fd19cdafc6ac81fe98dbe0f4
Instruction Fuzzy Hash: A011BF3061CA098FD684EF2CC98977B77E1FB99381F40496DB549C32F1DA65D841CB41

Function 000001F7840AEF60 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840AEFAA
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840AEFBE

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 569c5ed67f06eeb5af1f4773db352e515aab386c18c1098d96fcece9d538aa53
Instruction ID: b5ef20eec5b6193832e8f5005fc4c24d1c132b02a45c5b37a58ebd855046bd82
Opcode Fuzzy Hash: 569c5ed67f06eeb5af1f4773db352e515aab386c18c1098d96fcece9d538aa53
Instruction Fuzzy Hash: B501ED70178A5E8BD3D4DF29C8597BBB9D2FB84384FD0087DB549C22E1C6F9D8409652

Function 000001F7840AEEC0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840AEF0A
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840AEF1E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 71fea77b140ac0a4f1f8b75e0cd4dc0f508e3249f89da8f2dac7ae33cd6ace0c
Instruction ID: a95b93286523ffc852eb99e7a600136ec833b28374e533c8377e1429cfa4fa35
Opcode Fuzzy Hash: 71fea77b140ac0a4f1f8b75e0cd4dc0f508e3249f89da8f2dac7ae33cd6ace0c
Instruction Fuzzy Hash: F301ED70178B8A8BE3D5DF29C8987AF75D2FB84384F90096DA04DC22D0DAF9D8509652

Function 000001F784053D40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 000001F784055360: _WChar_traits.LIBCPMTD ref: 000001F78405538D

Part of subcall function 000001F784054740: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405476C
Part of subcall function 000001F784054740: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F78405477E
Part of subcall function 000001F784054740: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 000001F7840547BB

Part of subcall function 000001F784054850: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F7840548B8

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 000001F78405412A

Strings

, xrefs: 000001F7840541B1
X, xrefs: 000001F784053EE3

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Char_traits
String ID: $X
API String ID: 1626164810-1398056850
Opcode ID: b7fe99cffcf7bd97a9e81d5aad9f532e1525070ba119c050f664d87821b138ec
Instruction ID: 8a6594bcde640a2bd82d5297ecde8115287b0f340f23a27e138886472b45a660
Opcode Fuzzy Hash: b7fe99cffcf7bd97a9e81d5aad9f532e1525070ba119c050f664d87821b138ec
Instruction Fuzzy Hash: 51D1897051CB898FD7A4EF28C4997EBB7E1FB98341F50496EA48DC3251DB749884CB42

Function 000001F7840B5560 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

", xrefs: 000001F7840B5636
", xrefs: 000001F7840B574E

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: d9ca275203620766a00d06b5d65ade6f880f8bd0154771a424bc1f8235aa31d6
Instruction ID: ca38bcad1bd0ada80b5514022d57b4f6e6c2404ad39f1388751420968925b935
Opcode Fuzzy Hash: d9ca275203620766a00d06b5d65ade6f880f8bd0154771a424bc1f8235aa31d6
Instruction Fuzzy Hash: 1D71FC3111CB498AD795EF14C495FEBB7E1FBA8384F400AADB08AC31A2DA70D545CB82

Function 000001F784074B00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

std::error_condition::error_condition.LIBCPMTD ref: 000001F784074CEA

Part of subcall function 000001F7840701A0: Concurrency::details::VirtualProcessor::ClaimTicket::InitializeTicket.LIBCMTD ref: 000001F7840701BD

Strings

@, xrefs: 000001F784074B66
@, xrefs: 000001F784074BED

Memory Dump Source

Source File: 00000000.00000002.4474425071.000001F784050000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F784050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f784050000_Nexus-Executor.jbxd

Yara matches

Similarity

API ID: ClaimConcurrency::details::InitializeProcessor::TicketTicket::Virtualstd::error_condition::error_condition
String ID: @$@
API String ID: 2004282921-149943524
Opcode ID: 5d6c2f79357090950899d93de7d3641f261afb3f4bf2f8be1211dfb2002849bd
Instruction ID: 7698e3f87c4a8fd50674d2b784dddd83f3791bba4dd355fbc6b3b559b5a1a718
Opcode Fuzzy Hash: 5d6c2f79357090950899d93de7d3641f261afb3f4bf2f8be1211dfb2002849bd
Instruction Fuzzy Hash: 5951C47050D7498FE7A4EF58C488BBBB7E0FB95385F10496DE189C7290DBB298448B07

Function 00007FF762A99BC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

00007FF8C612A0D0.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF762A99D80

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762A99CBF
max_error > 0.0f, xrefs: 00007FF762A99CC6

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C612
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$max_error > 0.0f
API String ID: 1428191659-3636960062
Opcode ID: 173fbfa97a9e8faf60806451bce5e775cbc6d79fbfbf66f348b23af2c050349d
Instruction ID: 7ba9f3f669af7986699541ac191507f035923c998bc20416f49fca6a3852de28
Opcode Fuzzy Hash: 173fbfa97a9e8faf60806451bce5e775cbc6d79fbfbf66f348b23af2c050349d
Instruction Fuzzy Hash: AD61D332D1878AC9E742AB3785416A9B790EF69744F5CC732EE49361A4DFA8B4C1C620

Function 00007FF762AB0E40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB0F2F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF762AB0E73
g.SettingsWindows.empty(), xrefs: 00007FF762AB0E7A

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$g.SettingsWindows.empty()
API String ID: 1173767890-1747592857
Opcode ID: 170e04b973949e5f49f0dbd9dc130716887260cca0c17508c06e4d01c7df8597
Instruction ID: 2789f48df6fdb05b478ebf7fc82933c0a6d105fcae9d84962316564f2a9295fb
Opcode Fuzzy Hash: 170e04b973949e5f49f0dbd9dc130716887260cca0c17508c06e4d01c7df8597
Instruction Fuzzy Hash: C941F432A19A82C5DF84EF21E5585B8B360FB54B85F984136EE4D07754DFBCE042C710

Function 00007FF762AB2A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB2BA4

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AB2A8F, 00007FF762AB2ABF
i >= 0 && i < Size, xrefs: 00007FF762AB2A96, 00007FF762AB2AC6

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 1173767890-1817040388
Opcode ID: 9a9350dd72d12d3fe3cdaffedce5434e64b06f0471b182a10d57f79dce085956
Instruction ID: 1d0aa985199c2b5b9a74db282c97ff64fa2b971d5b0e58c2945e94e66c9448c8
Opcode Fuzzy Hash: 9a9350dd72d12d3fe3cdaffedce5434e64b06f0471b182a10d57f79dce085956
Instruction Fuzzy Hash: 6741E332A18A82C2DF54EF15E4804A8F374FB54784B944136DF4D47BA0DFB8E5A6C710

Function 00007FF762AB2BC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB2D10

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AB2C0F, 00007FF762AB2C3F
i >= 0 && i < Size, xrefs: 00007FF762AB2C16, 00007FF762AB2C46

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 1173767890-1817040388
Opcode ID: 8a08cfacd40c638483205b80b2c85210fff27a7fdd7df82892847bc392aadf12
Instruction ID: e77befc58e2fe92a71ee6567d50217b18eb2639d0204d3a659735b9c7eb19c36
Opcode Fuzzy Hash: 8a08cfacd40c638483205b80b2c85210fff27a7fdd7df82892847bc392aadf12
Instruction Fuzzy Hash: DA41E332A08A82C2DB44EF14E8945B8F374FB94B89B944132DE8D477A4DFBCE556C350

Function 00007FF762AB2810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB293C

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AB2851, 00007FF762AB2880
i >= 0 && i < Size, xrefs: 00007FF762AB2858, 00007FF762AB2887

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 1173767890-1817040388
Opcode ID: cbd96c97ff7e78fc22fdf30f912b4748780d3bf07ba9c45d4c4a176889ab244b
Instruction ID: f18a949ffb28cc824aab4e0b28f91519bdf520f7010a443a7aba06eff17cb980
Opcode Fuzzy Hash: cbd96c97ff7e78fc22fdf30f912b4748780d3bf07ba9c45d4c4a176889ab244b
Instruction Fuzzy Hash: 48319F72A08A96C2DF44EF24D4804A8B3A4FB84B84B944136DE8D47B64DFB8D557C710

Function 00007FF762A9B200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

00007FF8C61149A0.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF762A9B28E

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762A9B2B5
i >= 0 && i < Size, xrefs: 00007FF762A9B2BC

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007C61149
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 3281661635-1817040388
Opcode ID: 3a94cb1d79306fdc9a050dd449591057f5d3f3fa0e938ade244f3a3a1197444a
Instruction ID: 22f5215ae4f9810ecc69651e8d992c6b4296f257b7b9a3be93e20146a07877ac
Opcode Fuzzy Hash: 3a94cb1d79306fdc9a050dd449591057f5d3f3fa0e938ade244f3a3a1197444a
Instruction Fuzzy Hash: 4721D831B28596C5EFA4DB16E840AADE760FB85B40F984135DE8E47754CEFCE841C710

Function 00007FF762AD5F80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AD6070

Part of subcall function 00007FF762AB3900: 00007FF8B9F61310.VCRUNTIME140 ref: 00007FF762AB393C
Part of subcall function 00007FF762AB3900: 00007FF8C610F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF762AB39BA

Strings

state->TextA.Data != 0, xrefs: 00007FF762AD600B
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF762AD6004

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007$F61310$C610F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$state->TextA.Data != 0
API String ID: 4093856333-1138122324
Opcode ID: aa4380df76de35955622659888f7b988f766b4deb2fbaf4c5fddfc36e82c04f4
Instruction ID: 5a67b894b015a8c9549e5067dcf5a24467a17bf4d26ce12865aa4eac91eca981
Opcode Fuzzy Hash: aa4380df76de35955622659888f7b988f766b4deb2fbaf4c5fddfc36e82c04f4
Instruction Fuzzy Hash: 99218572B04642C2EF58DF25D4556A972A1EB84B45F88443AEE4DCB388DEFCE685C720

Function 00007FF762AB3820 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140(?,?,00000000,00007FF762A9D62F), ref: 00007FF762AB38C4

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF762AB3856
it >= Data && it <= Data + Size, xrefs: 00007FF762AB385D

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$it >= Data && it <= Data + Size
API String ID: 2490902527-3870282576
Opcode ID: 84a9b61979137050a1197245c5bdd7e55bba15df666dd3b8409ce5f9d3bc927c
Instruction ID: 7cf9039bd653f3aaa8305c8776f8ae521b97fed968692ed25be6f289c236c91d
Opcode Fuzzy Hash: 84a9b61979137050a1197245c5bdd7e55bba15df666dd3b8409ce5f9d3bc927c
Instruction Fuzzy Hash: 2B21F3B2B14681D3EF549B5AE6405A8A321FB44BC1B88D035DF9E47B44DFACF5A1C340

Function 00007FF762AB1E80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

00007FF8C87E2E80.IMM32 ref: 00007FF762AB1EA2

Strings

, xrefs: 00007FF762AB1EB5
@, xrefs: 00007FF762AB1EF3

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007
String ID: $@
API String ID: 3568877910-1077428164
Opcode ID: 4be356fa8e074784c90dbf701479d069685c3cbf6e883b402ec0f34ae6b6c832
Instruction ID: 461c6b006721b83874f6448de70f6af1d8064450266bb14ab1a490adbd69c96d
Opcode Fuzzy Hash: 4be356fa8e074784c90dbf701479d069685c3cbf6e883b402ec0f34ae6b6c832
Instruction Fuzzy Hash: 45113A7290878187DB25DF21F14452AB3A1FB89B84F584225EFCA07B18DBBCD985CE00

Function 00007FF762AC7320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

00007FF8B9F61310.VCRUNTIME140(?,?,00000000,00007FF762AC7563,?,?,00000000,00007FF762AC1FCF), ref: 00007FF762AC73A6

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF762AC7351
stb__dout + length <= stb__barrier_out_e, xrefs: 00007FF762AC7358

Memory Dump Source

Source File: 00000000.00000002.4482239218.00007FF762A91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF762A90000, based on PE: true

Associated: 00000000.00000002.4482178365.00007FF762A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF762F58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482239218.00007FF763132000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4482969867.00007FF763133000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483046065.00007FF763135000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff762a90000_Nexus-Executor.jbxd

Similarity

API ID: 00007F61310
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$stb__dout + length <= stb__barrier_out_e
API String ID: 2490902527-3603624656
Opcode ID: 4929abf8706d8f602428b6fe1b765513a0fac0a761fcb1cd9c61d870a0381a7c
Instruction ID: 36d0cb9d0918f886ee8e94afeca30c16a0d48b5a7f9985b2c83cd8fa61072706
Opcode Fuzzy Hash: 4929abf8706d8f602428b6fe1b765513a0fac0a761fcb1cd9c61d870a0381a7c
Instruction Fuzzy Hash: 7D11FE31B18A42E1EF80AB01F9448A5A765FB48BC0BC45036EE5D17764DFBCE9A2C720

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Nexus-Executor.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
Nexus-Executor.exe

Function 00007FF762AE4320 Relevance: 37.6, APIs: 7, Strings: 14, Instructions: 888
windowCOMMON

Function 00007FF762ADF7A0 Relevance: 36.9, APIs: 7, Strings: 14, Instructions: 150
libraryloaderCOMMON

Function 00007FF762AE0330 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 182
keyboardCOMMON

Function 00007FF762ADF2F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 215
COMMON

Function 00007FF762AE3B90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
nativeCOMMON

Function 000001F78407F46A Relevance: 8.0, APIs: 5, Instructions: 519
fileCOMMON

Function 000001F7841610E0 Relevance: 7.7, APIs: 5, Instructions: 166
processCOMMON

Function 00007FF762ADEA60 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
COMMON

Function 00007FF762AE26C0 Relevance: 15.5, APIs: 10, Instructions: 516
COMMON

Function 00007FF762AE3DE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
registryCOMMON

Function 00007FF762AE6800 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 151
windowCOMMON

Function 00007FF762A9D4F0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 218
COMMON

Function 000001F784056FE0 Relevance: 6.7, APIs: 4, Instructions: 693
processCOMMON